An operating system controls every resource on a computer, so it is also the main line of defence. Operating system protection and security are related but different ideas. Protection is about controlling how programs and users access resources inside the system. Security is about defending the whole system against threats from outside and inside.
This guide explains the difference, the common threats, the mechanisms modern operating systems use, and practical steps to keep systems safe.
Protection vs security
| Aspect | Protection | Security |
|---|---|---|
| Focus | Internal access control between processes and users | Defence against attacks and misuse |
| Question | Who may access which resource, and how? | Can the system resist an attacker? |
| Examples | File permissions, memory isolation, user/kernel mode | Authentication, encryption, patching, malware defence |
| Scope | Inside the system | The system and its environment, including networks and people |
Protection is a building block of security. Without good protection mechanisms, security policies cannot be enforced.
Goals: the CIA triad
Security aims to protect three properties:
- Confidentiality: only authorised people can read data.
- Integrity: data and programs are not changed without permission.
- Availability: systems and data are there when needed.
Common threats
Malware
- Viruses attach to files and spread when the files run.
- Worms spread across networks on their own, such as WannaCry in 2017.
- Trojans pretend to be useful software while hiding malicious functions.
- Ransomware encrypts files and demands payment.
- Rootkits hide deep in the OS to conceal an attacker’s presence.
Trap doors (backdoors)
A trap door is a hidden way to bypass normal authentication. A developer may leave one by mistake, or an attacker may plant one. For example, malicious code inserted into a widely used library can give attackers secret access.
Logic bombs
Code that triggers harmful actions when a condition is met, such as a date or the deletion of a specific user account.
Privilege escalation
Attackers exploit bugs to move from a normal user to administrator or root. Kernel vulnerabilities are especially valuable for this.
Denial of service
Programs or attackers exhaust CPU, memory, disk or network resources, so legitimate users cannot work.
Credential attacks
Password guessing, phishing and stolen password hashes let attackers log in as real users.
How the OS protects itself
- User and kernel mode: the CPU separates privileged OS code from applications.
- Memory protection: each process has its own address space. Features such as ASLR and non-executable memory make exploits harder.
- Access control: permissions, access control lists and mandatory access control systems such as SELinux and AppArmor limit what each program can do.
- Authentication: passwords, keys, biometrics and MFA verify users.
- Least privilege: services run under dedicated, low-privilege accounts.
- Secure boot: firmware checks that the bootloader and kernel are signed and untampered.
- Encryption: BitLocker, FileVault and LUKS protect data at rest.
- Logging and auditing: the OS records security events for later review.
The AAA framework
Many OS and network security designs follow authentication, authorization and accounting (AAA):
- Authentication confirms who the user is.
- Authorization decides what they may do.
- Accounting records what they did.
Learn more in our guide to AAA in networking.
Practical steps to secure an operating system
- Install security updates promptly.
- Remove unused software and services.
- Use standard user accounts for daily work.
- Enable full-disk encryption on laptops.
- Turn on the built-in firewall.
- Use endpoint protection or EDR.
- Enforce strong authentication, ideally with MFA.
- Send logs to a central system and review alerts.
For servers, follow a hardening baseline such as the CIS Benchmarks. Our free Linux server hardening checklist is a good start.
Related guides
Sources
Running Linux servers in production? Our Linux server hardening & security audit checks configuration, patching, SSH and logging. You can also use our free Linux server hardening checklist, or contact us.
