As an analyst, you'll be required to understand basic operating
functions,
how they interact with the different security
mechanisms implemented within your own enterprise network
within CYS A.
They have a basic understanding of both Windows analytics machine,
but not so much A Mac
uh Mac O assets.
While they're more secure,
really aren't utilized in an enterprise environment that often and
so we really don't cover it in CYS A.
Uh In fact,
I have my own biases against macOS being that in most enterprise environments,
you'll be challenged to find a uh
enterprise environment that utilizes mostly Mac computers.
In fact,
I estimate that about 95 to 98% of enterprise environments
are solely using a combination between majority of Windows machines
and then secondary as Linux machine. Very, very, very rarely.
Will you find a specific industry that uses macOS aside from
graphics interfaces or marketing or something that has to
do with specifically the utilization of audio video.
Otherwise,
most enterprise environments are going to be Windows based and not macOS based.
Uh If you're using a mac Os, that's fine,
just realize that you need to understand Windows machines
and it might behoove you to create a virtual environment
in which you can operate a Windows machine from,
in order to learn uh security functions as even most security programs and
interfaces are now moving towards a windows environment over that of a Linux.
We see this in the er we also see it in programs and utilities where
the expectation is that a Windows machine with a gooey
interface is much more user friendly than say a Linux box or even a macOS.
There are different characteristics that come into
play when talking about any operating system.
It doesn't matter if it's Linux or a mac or even a Windows environment.
The first one is device management.
How am I managing different devices on my operating system?
And how is that interface interacting with them? Meaning how is the keyboard used?
How is a monitor or mouse utilized?
But there's other
access points as well,
whether it's a new hard drive or maybe a pointer or even a webcam,
that device management needs to be utilized inside the operating system.
And how is that operating system?
Uh catering to that specific device, do I have to download new drivers? Do I have to
just plug and play it? It really depends
there's the user interface,
how am I interacting as a user with that specific operating system
with a WINDOWS device? Everything is double click or
drag it.
It's pretty easiest to utilize a Windows system from a user interface model.
Um whereas a Linux box is much more
derived from a command-line interface and you're having
to type in the command into the terminal
in order to get a programmer application or what
resource management. How do I utilize resources within my environment?
Uh How is ra m being utilized? How is the processing power being utilized?
All of this encompasses the resource management
function of the specific operating system.
Of course, there's process management.
How is the process is being utilized within the different environments?
And then finally,
file system management where Windows is different from a Mac versus a
system in terms of how those files are derived
and how are they stored on my
hard drive or even a USB drive within a Windows file structure.
We utilize an ntfs system or a new technology for file system as opposed to a
FAD or a FAT32 system or how we store our files and directories on our system.
Let's go over that now in a specific Windows device.
All right, within a Windows environment,
you can see here that I've got a virtualized Windows 11 system and it's just
something to kind of showcase the different
directories and subdirectories that we go through at
the very bottom. You can see the file structure of the file explorer.
I'm gonna click on that.
I'm gonna scroll down to my C drive.
It's only got the one operating system drive in this virtualized system.
I click on that and here you can see the program files, X 86.
It's an X 86 system because it's a 64 bit system.
You can see different users.
This is where I would find the different
users that are operating on this specific system.
And then here you could see the different windows
what's in here, right? So if I double click on this,
I can see the different aspects uh integrated within the windows file directory.
Uh If I under red edit inside the system, it will bring up the registry editor.
It's gonna ask me that I'm going to press. Yes.
And you can see the five registries right now.
This is a hierarchical and database encompassing a wide range of settings.
Uh This could include things from desktop
colors to networking to even security configurations,
um
allows different access within the system. So if I expand on to the class route,
you could see a lot of different files associated with the specific system.
Now, most of them just don't make sense, right? Let's say do 386.
And if I go in there, it's a reg
D, you don't need to go that much in depth with the registry editor,
you just need to realize that it's there.
Now, this registry structure comprises major entries known as hives
and each is dedicated to a specific
context or function within the operating system.
This can include signing
configuration items or configuration
and each hive consists of numerous associated entries called keys.
So if I expand into this,
you can see a SL and 60 key and it provides virtual studio launcher
as kind of the uh registry associated with it.
Now, this contains different data names,
different data types and of course different values associated with the specific.
Um Hi.
So for instance, if I go to the user
because we only have the one user and it's a default system.
If I go in here, you can see that value is not set
or a date you brought into it.
And you can see there's really just not a lot of information here that you can read
without going into detail with it.
If I go into the local machine, you can see service last known.
And then of course,
the data was not last seen because it hasn't been associated with it.
But if I go into hardware and I expand that out,
I can see ac pi I could see a description,
I go into systems,
I can expand that even more. I can go to the bios
and I can even go to the central processor
and start going through the different functionalities of it.
Now again, you don't need to be able to read this.
You just need to realize that the hives are associated with different
keys within the structure and that it's being utilized by the Windows system
uh as a hierarchical database to encompass
the different settings associated with windows specifically.
So if I press control, alt delete on my keyboard or if you're in a VirtualBox,
you could do input control, uh import keyboard
control alt delete. Let me show you that real quick. So we'll start from scratch.
All right, on my virtual system.
Normally we press control alt delete to get to our task manager in a VirtualBox.
I'm gonna go down to input keyboard.
I can do a soft keyboard right there
and then just press control alt and then delete. Now there's other ways to do this.
But this is a quick and easy version.
I'm gonna go to task manager.
And then if I blow this up,
you can see different aspects of this uh functionality, right?
For the first one being processes,
I can see the different processes available,
the different CPU that's being utilized in terms of how much memory
uh I can go through here and I can expand that and say, hey, look,
Microsoft teams is actually taking quite a bit of memory.
I can go into this space utilization and the
network utilization and then finally power usage and power usage
over time, right? So the trend of what it's utilizing right now,
this is all under the Windows processes
that we're currently utilizing for this virtual machine
and how it's interacting with the different uh aspect.
Now this is important because
if you're ever doing a
security uh suite on a specific client machine,
sometimes you'll notice something that's taking up quite a bit of CPU space
and that could be indicative of a process ongoing.
Now again,
we have to use a little bit of intelligence here because I see a
program that's using a lot of CPU space and a lot of memory space.
Well, it could be indicative of attack.
It could also be indicative of the program running its normal processes.
So this is where that baseline really comes into play to find out what's going on
with your system and understanding the different uh perplexities of that system.
We can also do Internet explorer.
Internet explorer is utilized in a lot of different aspects of a windows machine.
For instance, if I just do edge like that,
then that is the actual browser.
But when we talk about Windows Explorer,
this is actually the manager of what's going
on and that's what we're referring to here.
So for instance,
if I try to open up an application or let's say
that I just want to do a search for something,
uh it would open it up. So let's do settings
just like that.
It's actually using
exploer to kind of provide that management framework between it, right.
So that's Windows Explorer,
I can do a client server runtime subsystem.
This is essential for the subsystem processes or operations.
Uh And then there's window logon processes which we're not showing
today because we're not logging in uh it's a virtual system.
So we really don't have that capability without adding a bunch of users.
And then of course, I already showed you the task manager. So we know about that
with a Linux
file structure.
It's obviously different than a windows file structure where it's
point click and there is a minimal typing going on.
And even when I did type a command, it popped up a window that I was able to change,
I could manipulate, I could try drop,
I could double click on it and it would do everything I want.
While there are certain aspects of the
system that allow you to do that.
The majority of Linux file structure is all command-line interface.
Let's explore the Linux file structure. Now in person
within a Linux system,
you can see here that I've got a basic virtual launch
running on a Linux platform over my windows operating system.
Uh This Linux box is currently running Kali
Linux
20 24.1.
And I'm going to access the command-line interface using
this little box right here called a terminal.
I'm gonna open up this terminal and then I'm gonna press
control and plus sign to blow it up a little bit.
There we go. You should be able to see that now
and then I'm just going to go through some basic commands.
The first one I want to point out is the root terminal. Now
the root directory, I should say I can access,
doing CD root with a port slash just like that.
But it's going to deny me because I'm not logged into the system as a root user.
I could access the system by a root user. But I caution you from doing so
the root system or the root directory is really protected
to stop you from doing something stupid that
you shouldn't be doing in the first place.
Very rarely will we as users analytics system actually want to log in with recruits.
Because of that aspect of if somebody gets our access to our account,
they can then change the trajectory, they can make some funky settings on there.
What do you think root privileges?
Think uh administrative control and not just
a little bit of administrative control,
full administrative control.
That's the root directory.
The next one I want to go through is the binary directory.
So we're gonna do a CD forward slash binary just like that or I should say then
just like that. And then if I do an L si can see all the different files or structures
annotated within this basic confines, right?
So we see all these little uh directories
or subdirectories associated with our Linux box,
the binary directory.
The next one, if I want to go back,
I'm just gonna type in CD and then I could do a dot dot To go
back one space and you can see that I'm no longer in that bend directory.
I'm now in the original directory. Uh, on top of it,
the next one I want to hit is the boot directory. So I'm gonna do it the same way.
CD forward slash boot.
The boot directory is dedicated for files. Essential
essentials for the booting process. Ie when the system loads up for the first time,
it needs this directory to kind of figure out where it's going,
what it's doing with those different files.
And how do I actually boot up again? I could do an LS. This is a list command within it
and quite a bit of a difference here, right?
We don't have near as many files or directories or subdirectories going into it.
You'll find out that we've only got one subdirectory with grub.
Now, I could go into grub by typing CD grub
this like that and then I can do another list command
and you can see here that it provides me three more directories
or four more if you count fonts and the different aspects of that,
if I want to go back more than one, I like the CD dot dot I'm gonna do a CD,
just a backslash hit enter and you'll see that I am
no longer in the boot directory or the grab directory.
I'm all the way back at the beginning.
The next one I want to do is etc.
So I'm gonna do CE D forward slash, etc just like.
So I'm going to do another LS command and you
can see a little bit of a difference in there.
Now, this directory hosts system wide configuration files and scripts.
Uh There's also some small programs in here. You'll notice that Python is in here.
I think I saw WireShark in here at some point,
but you can see different aspects of the Linux system within the etc folder.
If I want to go back again, I'm just gonna do that CD dot dot
And go through it. I want to also point out that it can press the up arrow
to get any of those commands. I press the down arrow to go back where I was.
So I want to do a CD home. Next.
There we go. And you can see I'm in the home directory right here.
I see that home directory and I'm going to do an LS again
and you can see that this directory,
it holds my personal directories for all my
users that are associated with this system.
So I'm logged in as K Kendrick,
that's the only user associated with this current operating system.
And so the home directory holds my specific user
information associated with that.
If there was more than one user,
I could see the different users associated in the home directory
and be able to identify the different personal directories of all users, right?
So that's one of those like now,
I'm just going to press the up arrow
to go CD calling or period, period to go back one directory
and then the last one I want to show you is the variable directory.
And then we'll do CD, variable or bar for short.
And there you go. This directory contains data such as logs,
support logs. We just talked about that,
databases, websites, temporary files necessary for various programs function.
And it's expected to continuously change throughout the system.
So if I do an LS over here,
you can see that I've got that temporary folder right there. I could do a CDT MP,
get into that.
I could do another LS and you can see there's different information in here.
Well, now obviously this is gonna change if I wanted to go back one directory,
I could put that dot dot
And again, I could do a new LS and I'm just in the variable.
And that would allow me to go into again,
different directories and subdirectories as I see fit.
That's like
now,
it's important to understand the initial process that is
started by analytics is determined by the kernel,
which is also responsible for all other initial processes on our operating system,
older systems.
This is usually the process while newer systems,
uh they usually employ something called system MD
or the system MD process.
The system process,
this is also known as DAS
are background processes.
We utilize launch or the system utilizes launch during
the system booth or after an additional login.
This provides various services which include SD
or
should be SSH D or SSH remote access.
It can also do chronological scheduled task or system login information
for the system log.
There's also called orphan processes in a Linux box. This is where the power
process is terminated
as a subprocess isnt adopted by the initialization
process or the initial process or the system in
the process which handles cleanup and termination of
different aspects or different processes on your system.
There's also something called a zombie processes.
This occurs when the process is terminated,
but the parent process has not retrieved the termination from the information.
This process has completed and exhausted.
Uh but it's still an entry process on the table,
meaning that I uh we quit a process or I've terminated a process,
but the parent process is still there.
It's still functioning and it just hasn't gotten the point that, hey, we're,
we're stopping
and then there's foreground and background processes which is in the Linux system.
Uh This process either uh is at the front of
what you're utilizing currently or it's in the background.
Not really doing anything well, it's doing stuff but it's in the background.
It's not directly interacting with the user per se
or a foreground process is something that you're entering
with. Now, within different operating systems.
There's hardware that can be associated with those
specific operating systems to make it more secure.
This integrates hardware with the operating system,
creating a more trustworthy or secure environment.
In which the operating system can operate safely on a
shape.
For instance, there's something called a trusted platform module or T PM.
This is serves as a cryptoprocessor and enhances security by encrypting
uh or storing cryptographic keys into the device itself.
It facilitates secure hardware based key generation storage and authentication
and provides encryption to fortify against data, unauthorized access to data
and trick
that T PM on a Windows 11 system is actually required.
You can utilize a Windows 11 virtual system on a
Windows 10 and create that virtualized Windows 11 system.
But if you have a bare metal machine,
that's Windows 11 actually requires a T PM to be present on
the hardware you're utilizing to ensure a more robust or secure system.
There's also something called a hardware security module or an HSM.
This is a physical device designed for
secure cryptographic key generation storage and management.
Hsms find application high security scenarios such as
SSL or TLS DS
for large scale web servers. This is actual physical device
that is utilized in conjunction with your software to create a
secure platform
in order to store cryptographic keys on.
Uh There's a secure boot process.
This is a process that ensures only
trusted software is loaded and secure during startup
and it acts a deterrent against boot time
malware activity to seize control of the system.
It's also utilized for gamers to start anti
cheating.
Uh So we've seen secure boot processes within that process.
Um, specifically with my son, he's a big type gamer.
He loves to go on there, but he's always trying to download these different,
uh, uh extensions or these different uh addons for the system.
He asked me one time, hey, dad, can I, can I replace my secure boot process or access,
have this program access, my secure boot process.
And the answer was an emphatic. No, we don't, we don't do that. right.
But anti cheat systems will often use SBP or a secure boot
process to ensure that you are not cheating on their systems.
And finally, there is something called AC tu security extension.
This is a modern CPU
incorporate security extensions like Intel's SGX or secure
guard extension or AMD SSEB secure encryption virtualization.
And these extensions introduce added security measures such as crafting
memory areas
or
s and remain protected for the processes running at a higher
levels to ensure that something that's operating at that privilege level.
That's a higher point of view.
It doesn't have the capability of being attacked uh
nilly like we might see with lower processes.
So it just adds that layer of protection on there.
So today we discuss the different Windows systems, we discuss Linux platforms,
Windows platforms and how they
file structures are different.
We discussed Windows registry and we went across
the different hardware architectures associated with TP MS.
And then A
s
you don't need to have a specific in depth understanding
of any of these per se. But you do need to have a broad high level understanding.
You may get questions like what is A T PM and how does
it function or what's the difference between HSM and A T PM?
Now, granted these are all multiple choice questions throughout CYS A.
So it provides a little bit of detail
in there.
Don't be surprised if you see a test or quiz
question that asks you specifically about A T PM.
Such things like uh this particular
hardware architecture helps for key generation
and it is attached within the hardware of a specific system.
That would be A T Yeah.
You don't expect to see uh overly
robust questions diving into windows registry about
A which HK key provides XY or Z.
That's not something they're looking for in the CYS six.