Operating System Security and Hardening
Why endpoints matter
Endpoint risk
Attackers often begin with an endpoint because it is where users run code, open attachments, browse the web, and store credentials. Hardening reduces the number of easy footholds.
Hardening priorities
User accounts vs service accounts
User accounts
- Used by people
- Should have interactive MFA where possible
Service accounts
- Used by applications or automation
- Should have tightly scoped permissions and secrets management
Common failure pattern
Default administrative accounts, shared passwords, and delayed patching are frequent causes of endpoint compromise.
A basic hardening workflow
-
1
Inventory the device and installed software.
-
2
Remove unused accounts, services, and software.
-
3
Apply updates and secure configuration baselines.
-
4
Enable logging, endpoint protection, and recovery options.
Which practice best supports least privilege?
Least privilege limits damage if an account is misused.
Correct answer: Assigning only the permissions required for a task
Why should unused services be disabled on a workstation?
Each running service can be a target for exploitation or misconfiguration.
Correct answer: They increase the attack surface without providing value
What is the main purpose of patch management?
Patching reduces exposure to known vulnerabilities.
Correct answer: Fix security and reliability flaws
Give one reason service accounts should be restricted.
Service accounts are high-value targets because they often have persistent access.
Correct answer: They often run automated processes with broad access and can be abused if overprivileged