As an analyst, you'll be required to understand basic operating functions and how they interact with
the different security mechanisms implemented within your own enterprise network within Cisa.
They have a basic understanding of both windows and a Linux machine, but not so much a mac.
Mac OS is, while they're more secure, really aren't utilized in an enterprise environment that often.
And so we really don't cover it in Cisa.
In fact, I have my own biases against Mac OS, being that in most enterprise environments, you'll
be challenged to find a enterprise environment that utilizes mostly Mac computers.
In fact, I estimate that about 95 to 98% of enterprise environments are solely using a combination
between majority of windows machines and then secondary as Linux machines.
Very, very, very rarely will you find a specific industry that uses Mac OS Aside from graphics interfaces
or marketing or something that has to do with specifically the utilization of audio video.
Otherwise, most enterprise environments are going to be windows based and not Mac OS based.
If you're using a mac OS, that's fine.
Just realize that you need to understand windows machines, and it might behoove you to create a virtual
environment in which you could operate a windows machine from in order to learn security functions,
as even most security programs and interfaces are now moving towards a windows environment over that
of a Linux.
We see this in the air.
We also see it in different programs and utilities, where the expectation is that a windows machine
with a GUI interface is much more user friendly than, say, a Linux box or even a mac OS.
There are different characteristics that come into play when talking about any operating system.
It doesn't matter if it's a Linux or a mac or even a windows environment.
The first one is device management.
How am I managing different devices on my operating system, and how is that interface interacting with
them?
Meaning how is the keyboard used?
How is a monitor or a mouse utilized?
But there's other access points as well, whether it's a new hard drive, or maybe a pointer or even
a webcam, that device management needs to be utilized inside the operating system.
And how is that operating system, uh, catering to that specific device?
Do I have to download new drivers?
Do I have to, uh, just plug and play it?
It really depends.
There's the user interface.
How am I interacting as a user with that specific operating system?
With a windows device, everything is double click or drag.
It's pretty easy to utilize a windows system from a user interface model.
Um, whereas a Linux box is much more derived from a command line interface, and you're having to type
in the command into the terminal in order to get the program or application to run resource management.
How do I utilize resources within my environment.
Uh, how is Ram being utilized?
How is the processing power being utilized?
All of this encompasses the resource management function of the specific operating system.
Of course, there's process management.
How is the processes being utilized within the different environments.
And then finally file system management where a windows is different from a mac versus a Linux system
in terms of how those files are derived and how are they stored on my specific hard drive or even a
USB drive.
Within a windows file structure, we utilize an NTFS system or a new technology for file system, as
opposed to a Fat or a Fat32 system, or how we store our different files and directories on our system.
Let's go over that now in a specific windows device.
All right.
Within a windows environment, you can see here that I've got a virtualized Windows 11 system.
And it's just something to kind of showcase the different directories and subdirectories that we go
through.
At the very bottom you can see the file structure or the file explorer.
I'm going to click on that.
I'm going to scroll down to my C drive.
It's only got the one operating system drive in this virtualized system.
I click on that.
And here you can see the program files x86.
It's an x86 system because it's a 64 bit system.
You can see different users.
This is where I would find the different users that are operating on this specific system.
And then here you can see the different windows within here.
Right.
So if I double click on this I can see the different aspects uh integrated within a windows file directory.
Uh if I under read edit inside the system, it'll bring up the registry editor.
It's going to ask me that I'm going to press yes.
And you can see the five registries right now.
This is a hierarchical, uh, database encompassing a wide range of settings.
Uh, this could include things from desktop colors to networking to even security configurations.
Um, it allows different access within the system.
So if I expand on to the class root, you can see a lot of different files associated with this specific
system.
Now most of them just don't make sense, right?
Let's say 386.
And if I go in there it's a reg SC you don't need to go that much in depth with the registry editor.
You just need to realize that it's there.
Now.
This registry structure comprises major entries known as hives, and each is dedicated to a specific
context or function within the operating system.
This can include settings, user configuration, items, or machine configuration, and each hive consists
of numerous associated entries called keys.
So if I expand into this, you can see a SL and 60 key and it provides virtual studio launcher as kind
of the registry associated with it.
Now this contains different data names, different data types, and of course different values associated
with the specific um hive.
So for instance, if I go to the user because we only have the one user and it's a default system,
if I go in here, you can see that value is not set or a date any brought into it.
And you can see there's really just not a lot of information here that you can read without going into
detail with it.
If I go into the local machine, you can see service last known.
And then of course the data wasn't last seen because it hasn't been associated with it.
But if I go into hardware and I expand that out, I can see Acpi.
I can see a description.
I can go into systems.
I can expand that even more.
I can go to the Bios, and I can even go to the central processor and start going through the different
functionalities of it.
Now again, you don't need to be able to read this.
You just need to realize that the different hives are associated with the different keys within the
structure, and that it's being utilized by the windows system as our hierarchical database to encompass
the different settings associated with windows specifically.
So if I press Control Alt delete on my keyboard, or if you're in a VirtualBox, you can do input control,
import keyboard control, alt delete.
Let me show you that real quick.
So we'll start from scratch.
All right.
On my virtual system, normally we would press Control Alt Delete to get to our task manager in a VirtualBox.
I'm going to go down to input keyboard.
I can do a soft keyboard right there and then just press Control alt and then delete.
Now there's other ways to do this, but this is a quick and easy version.
I'm going to go to task manager.
And then if I blow this up you can see different aspects of this uh functionality.
Right.
So the first one being processes I can see the different processes available, the different CPU that's
being utilized in terms of how much memory, uh, I can go through here.
And I can expand that and say, hey, look, Microsoft Teams is actually taking quite a bit of memory.
I can go into disk space utilization and then network utilization, and then finally power usage and
power usage, uh, over time.
Right.
So the trend of what it's utilizing right now, uh, this is all under the windows processes that we're
currently utilizing for this virtual machine and how it's interacting with the different, uh, aspects.
Now, this is important because if you're ever doing a security sweep on a specific client machine,
sometimes you'll notice something that's taking up quite a bit of CPU space.
And that can be indicative of a process ongoing.
Now again, we have to use a little bit of intelligence here, because I see a program that's using
a lot of CPU space and a lot of memory space.
Well, it could be indicative of attack.
It could also be indicative of the program running its normal processes.
So this is where that baseline really comes into play.
To find out what's going on with your system and understanding the different perplexities of that system.
We can also do Internet Explorer.
Internet explorer is utilized in a lot of different aspects of a windows machine.
For instance, if I just do edge like that, then that is the actual browser.
But when we talk about Windows Explorer, this is actually the manager of what's going on.
And that's what we're referring to here.
So for instance, if I try to open up an application or let's say that I just want to do a search for
something.
It would open it up.
So let's do settings.
Just like that.
It's actually using explorer to kind of provide that management framework between it.
Right.
So that's Windows Explorer.
I can do a client server runtime subsystem.
This is essential for the subsystem processes or operations.
Uh and then there's window log on processes which we're not showing today because we're not logging
in.
Uh it's a virtual system.
So we don't have that capability without adding a bunch of users.
Uh, and then, of course, I already showed you the task manager, so we know about that within a Linux
file structure.
It's obviously different than a windows file structure where it's point click and there is a minimal
typing going on.
And even when I did type a command, it popped up with a window that I was able to change, I could
manipulate, I could drag, drop, I could double click on it, and it would do everything I want.
While there are certain aspects about the Linux system that allow you to do that, the majority of Linux
file structure is all command line interface.
Let's explore the Linux file structure now in person within a Linux system.
You can see here that I've got a basic VirtualBox running on a Linux platform over my windows operating
system.
This Linux box is currently running Kali Linux 2020 4.1, and I'm going to access the command line interface
using this little box right here called a terminal.
I'm going to open up this terminal.
And then I'm going to press Control and plus sign to blow it up a little bit.
There we go.
You should be able to see that now and then.
I'm just going to go through some basic commands.
The first one I want to point out is the root terminal.
Now the root directory I should say I can access doing CD root with a forward slash just like that.
But it's going to deny me because I'm not logged into the system.
As a root user.
I could access the system by root user, but I caution you from doing so.
The root system or the root directory is really protected to stop you from doing something stupid that
you shouldn't be doing in the first place.
Very rarely will we, as users on a Linux system, actually want to log in with root privileges because
of that aspect of if somebody gets our access to our account, they can then change their directory.
They can make some funky settings on there.
What do you think?
Root privileges.
Think, uh, administrative control and not just a little bit of administrative control.
Full administrative control.
That's the root directory.
The next one I want to go through is the binary directory.
So we're going to do a CD forward slash binary just like that.
Or I should say Ben just like that.
And then if I do an LZ I can see all the different files are structures annotated within this basic
confines.
Right.
So we see all these little, uh, directories or subdirectories associated with our Linux box under
the binary directory.
Uh, the next one, if I want to go back I'm just going to type in CD.
And then I could do a dot dot to go back one space.
And you can see that I'm no longer in that Ben directory.
I'm now in the original directory, uh, on top of it.
So the next one I want to hit is the boot directory.
So I'm going to do the same way CD forward slash boot.
The boot directory is dedicated for files essentials.
Essentials for the booting process, i.e. when the system loads up for the first time, it needs this
directory to kind of figure out where it's going, what it's doing with those different files, and
how do I actually boot up again, I could do an LZ.
This is a list command within it and quite a bit of a difference here, right.
We don't have near as many files or directories or subdirectories going into it.
You'll phone out that we've only got one subdirectory with grub.
Now I could go into grub by typing CD grub just like that.
And then I could do another list command.
And you can see here that it provides me three more directories or four more if you count fonts and
the different aspects of that.
If I want to go back more than one, unlike the CD dot dot, I'm going to do a CD, just a backslash.
Hit enter and you'll see that I am no longer in the boot directory or the grub directory.
I'm all the way back at the beginning.
Uh, the next one I want to do is etc. so I'm going to do CD, forward slash, etc. just like so I'm
going to do another LZ command and you can see a little bit of a difference in there.
Now this directory hosts system wide configuration files and scripts.
There's also some small programs in here.
You'll notice that Python is in here.
I think I saw Wireshark in here at some point, but you can see different aspects of the Linux system
within the Isa folder.
If I want to go back again I'm just going to do that CD dot dot and go through it.
I want to also point out that I can press the up arrow to get any of those commands.
I can press the down arrow to go back where I was.
So I want to do a CD home next.
There we go.
And you can see I'm in the home directory right here.
I may see that home directory.
And I'm going to do an LZ again.
And you can see that this directory, it holds my personal directories for all my users that are associated
with this system.
So I'm logged in as Kate Kendrick.
That's the only user associated with this current operating system.
And so the home directory holds my specific user information associated with that.
If there is more than one user, I could see the different users associated in the home directory and
be able to identify the different personal directories of all the users.
Right.
So that's one other thing.
Now I'm just going to press the up arrow to go CD colon or period period to go back one directory.
And then the last one I want to show you is the variable directory.
And then we'll do CD variable or var for short.
And there you go.
This directory contains data such as logs and support logs that we just talked about that databases
websites temporary files necessary for various programs to function.
Uh and it's expected to continuously change throughout the system.
So if I do an LZ over here you can see that I've got that temporary folder right there.
I could do a CD tmp get into that, I could do another LZ.
And you can see there's different information in here as well.
Now obviously this is going to change.
If I wanted to go back one directory I could put that dot dot.
And again I could do a new LZ.
And I'm just in the variable.
And that would allow me to go into, again, different directories and subdirectories as I see fit.
That's Linux.
Now it's important to understand the initial process that is started by Linux is determined by the kernel,
which is also responsible for all other initiating processes on our operating system.
Older systems.
This is usually the init process, while newer systems they usually employ something called systemd
or the systemd process.
The system processes, also known as daemons, are background processes that we utilize at launch or
the system utilizes at launch.
During the system boot or after an initial login, this provides various services which include SSD,
or it could be SSHd or SSH remote access.
It can also do chronological schedule tasks or system login information for the system logging.
There's also called orphan processes in the Linux box.
This is where the parent process has terminated.
And they uh subprocess is an adopted by the initialization process, or the initial process, or the
system in D process, which handles clean up and termination of different aspects or different processes
on your system.
There's also something called a zombie processes.
This occurs when the process is terminated, but the parent process is not retrieved the termination
from the information.
This process has completed and exhausted, but is still an entry process on the table, meaning that
I quit a process or I terminated a process, but the parent process is still there, it's still functioning,
and it just hasn't gotten the point that, hey, we're stopping.
And then there's foreground and background processes, which is in the Linux system.
This process either is at the front of what you're utilizing currently or it's in the background not
really doing anything.
Well, it's doing stuff, but it's in the background.
It's not directly interacting with the user per se, where a foreground process is something that you're
interacting with.
Now within different operating systems, there's hardware that can be associated with those specific
operating systems to make it more secure.
This integrates hardware with the operating system, creating a more trustworthy or secure environment
in which the operating system can operate safely on a specific machine.
For instance, there's something called a Trusted Platform Module, or TPM.
This serves as a crypto processor and enhances security by encrypting, uh, or storing cryptographic
keys into the device itself.
It facilitates secure hardware based key generation, storage, and authentication, and provides encryption
to fortify against data unauthorized access to data, and tampering.
That TPM on a Windows 11 system is actually required.
You can utilize a Windows 11, uh, virtual system on a Windows 10 and create that virtualized Windows
11 system.
But if you have a bare metal machine, that's Windows 11.
It actually requires a TPM to be present on the hardware you're utilizing to ensure a more robust,
more secure system.
There's also something called a hardware security module or an HSM.
This is a physical device designed for secure cryptographic key generation, storage, and management.
HSM find application high security scenarios such as managing SSL or TLS keys for large scale web servers.
This is actual physical device that is utilized in conjunction with your software to create a secure
platform.
In order to store cryptographic keys on, there's a secure boot process.
This is a process that ensures that only trusted software is loaded and executed during startup, and
it acts as a deterrent against boot time malware attempting to seize control of the system.
It's also utilized for gamers to start Anti-cheating, so we've seen secure boot processes within that
process.
Um, specifically with my son.
He's a big time gamer.
He loves to go on there, but he's always trying to download these different, uh, extensions or these
different add ons for the system.
He asked me one time, hey, dad, can I.
Can I replace my secure boot process or access?
Have this program access my secure boot process?
And the answer was an emphatic no.
We don't we don't do that.
Right.
But anti-cheat systems will often use SBP or a secure boot process to ensure that you are not cheating
other systems.
And finally, there is something called a CPU security extension.
This is a modern CPU, often incorporates security extensions like Intel's SGX or Secure Guard Extension,
or AMD's Sev secure Encryption virtualization, and these extensions introduce added security measures
such as crafting encrypted memory areas or enclaves, and remain protected for the processes running
at a higher levels to ensure that something that's operating in that privileged level, that's a higher
point of view.
It doesn't have the capability of being attacked willy nilly like we might see with lower processes.
So it just adds that layer of protection on there.
So today we discussed the different windows systems.
We discussed Linux platforms.
We windows platforms, and how their file structures are different.
We discussed Windows Registry and we went across the different hardware architectures associated with
TPMS and then HSM.
You don't need to have a specific in-depth understanding of any of these per se, but you do need to
have a broad, high level understanding.
You may get questions like, what is a TPM and how does it function?
Or what's the difference between an HSM and a TPM.
Now, granted, these are all multiple choice questions throughout Cisa, so it provides a little bit
of detail in there.
Don't be surprised if you see a test or a quiz question that asks you specifically about a TPM.
Such things like this particular hardware architecture helps for key generation, and it is attached
within the hardware of a specific system.
That would be a TPM.
You don't expect to see overly robust questions diving into Windows Registry about hey, which HK key
provides X, Y, or Z?
That's not something they're looking for in the Cisa exam.