Host and operating-system security
This domain tests the hardening baseline of the hosts that hold the data, plus the operational discipline that keeps them hardened. Expect questions on permissions, services, patching and endpoint detection.
Baseline hardening
Build from a documented image: minimal OS install, only required services and ports, vendor guidance and CIS benchmarks as the baseline, host firewall with default-deny inbound, secure boot, full-disk encryption on mobile endpoints, and a managed patch cycle. Remove or rename default accounts, disable SMBv 1, restrict RDP behind a jump host, and disable LLMNR/NetBIOS where it is not needed.
Accounts and permissions
Least privilege and separation of duties apply at the host level. On Linux, permissions are owner/group/other with read-write-execute bits; with conventional requested modes 0666 for files and 0777 for directories, umask 027 yields 0640 and 0750 respectively. A umask removes requested permission bits rather than granting permissions. SUID/SGID binaries are privilege-escalation surfaces and should be inventoried. Logged sudo beats a shared root password. On Windows, use Group Policy to enforce password length, lockout, audit policy and restricted groups; keep Domain Admins small and follow the tiered administration model.
Endpoint protection
Signature antivirus is necessary but insufficient. EDR adds behavioural detection, telemetry and response actions such as host isolation and process termination. Application allowlisting blocks unapproved executables. Patch the OS and third-party software - browsers, Java and PDF readers are the usual gaps. Forward security events to a central collector; local logs are lost when a host is rebuilt.
Worked example
A Linux web server must be reachable only by SSH from the admin subnet. Set PermitRootLogin no, PasswordAuthentication no with key-based authentication, allow SSH only from the admin CIDR at the host firewall, enable auditd, and subscribe to the distribution's security repository. Each control addresses a different threat: credential theft, network scanning, and unlogged tampering.
Traps
- Assuming antivirus equals endpoint security.
- Patching production directly with no test ring.
- Leaving a service enabled because it might be needed later.
- Forgetting that configuration files and backups need the same protection as data.