Learn how to secure networks, applications, and systems against digital threats.
The operating system is the security boundary between a running program and the rest of the machine. It decides who can read, write, and execute what, and it isolates processes from each other. Hardening an operating system means locking down that boundary: restricting permissions, removing unnecessary services, keeping software patched, and logging enough to detect trouble. This lesson covers users, groups, and permissions, Linux file permissions (chmod/chown), processes and services, the concept of privilege escalation, Windows security, patch management, and a practical hardening workflow. The examples use Linux because it is the standard for security work, but the principles apply to Windows and macOS too.
Applications run on top of the OS, and the OS enforces the rules about what each process may do. A compromised process is only as dangerous as the permissions the OS gave it — which is why least privilege matters at the OS level.
Every file has an owner, a group, and a permission string like rwxr-xr-x, which grants read (r), write (w), and execute (x) to the owner, the group, and others.
A process is a running program; a service (daemon) is a process that runs in the background. Every unnecessary service increases attack surface, so hardening includes disabling what is not needed.
Privilege escalation is when an attacker with limited access gains higher access — for example, from a normal user to root/admin. It is a key goal of many attacks and a key thing hardening tries to prevent.
| Linux | Windows | |
|---|---|---|
| Permissions | rwx bits via chmod/chown | ACLs, Registry, Group Policy |
| Admin model | root vs normal user | Administrator vs standard user |
| Central control | Config files, SSH | Active Directory, GPO |
| Hardening focus | Disable services, file perms | Patching, GPO, AD |
These are safe, read-only-ish examples for a system you control. Never chmod 777 a file just to silence a permission error.
A web server should not run as root.
(least privilege reduces the blast radius of a compromise)