3.1Operating system security concepts

No matter how well you harden the network edge, the endpoint (PC, server, phone) is where data finally rests and people operate. That is exactly why attackers target endpoints and defenders must use the mechanisms built into the OS correctly. This section covers the defensive ideas common to the major operating systems—Windows, macOS, and Linux—namely the built-in anti-malware Windows Defender and the host-based firewall, the CLI and PowerShell as the basis of operation, the permissions (file/directory access control) that decide who can do what, and the privilege escalation by which attackers try to seize administrator rights—learned not as rote facts but through the lens of "is this PC properly protected?"

3.1.1Major operating systems and their built-in security features

• Windows is the mainstream corporate client, shipping with the built-in anti-malware Windows Defender (Microsoft Defender Antivirus) and the host-based Windows Defender Firewall. UAC (User Account Control) prompts for consent before actions that need administrator rights.
• macOS is Unix-based, with Gatekeeper to verify app signatures and FileVault for disk encryption. Linux is also Unix-based, widely used on servers, offering host firewalls like iptables/firewalld and access controls like SELinux/AppArmor. Even across different OSes, the defensive elements are common: anti-malware, host firewall, access control, and encryption.
• A host-based firewall permits or denies traffic on the endpoint itself. If the network-edge firewall is the "gate at the entrance," the host firewall is the "lock on each room"—a layer of defense-in-depth that curbs lateral spread even after an intruder gets inside.

3.1.2The CLI, PowerShell, and permissions

• The CLI (command-line interface) operates the OS through text and suits automation, remote operation, and auditing better than a GUI. Windows ships the powerful PowerShell, while Linux/macOS use shells such as bash. Administrators use these to check settings and collect logs, but the same tools can be used by attackers too.
• File/directory permissions are the access control that decides "who can read/write/execute." Windows uses NTFS ACLs, while Linux/macOS express read (r)/write (w)/execute (x) for owner/group/others (e.g., rwxr-xr--). The principle of least privilege (only what each person needs) is fundamental; loose settings that let everyone write become a breeding ground for tampering.
• Privilege escalation is when an attacker holding only ordinary-user rights exploits a vulnerability or misconfiguration to seize administrator rights (Windows Administrator, Linux root). Once escalated, they can change settings, wipe logs, create other accounts—anything—so operating as a standard user and tightly limiting administrator rights is the strongest defense.

Suppose a user tells you, the support staffer, that "a file in the shared folder was altered by someone without permission." Rushing to run only a virus scan is premature. The first thing to check is the permissions—whether that folder is set to "writable by everyone" (a loose setting like rwxrwxrwx on Linux). If anyone can write, the cause may not be malware but simply that least privilege was not enforced, and the proper fix is to narrow write access to the correct owner/group only (e.g., rwxr-x---). Next, if there are signs like "an unfamiliar administrator account has appeared on that PC" or "there are traces of PowerShell running in the middle of the night," it is time to suspect privilege escalation. A plausible scenario: an attacker entered as an ordinary user, exploited a vulnerability to seize administrator rights, and created a new administrator with net user. In that case, review the built-in Windows Defender scan results together with the Windows logs to surface any rogue accounts or auto-run entries. The key posture: do not jump to "tampering = malware"; isolate from both sides—permission settings (was it writable in the first place?) and privilege escalation (was administrator seized illicitly?). At the introductory level you need not go into deep intrusion analysis, but this basic habit of verifying that least privilege and the host's built-in features (Defender, host firewall) are used correctly is the foundation of endpoint defense.

3.1.3Section summary

• Across the major OSes (Windows/macOS/Linux), the defensive elements are common: anti-malware, host firewall, access control, and encryption
• The CLI, including PowerShell, is the basis of management and automation; file permissions (NTFS ACLs on Windows, rwx on Linux) follow least privilege
• Privilege escalation is an attack that illicitly seizes administrator/root rights; running as a standard user and limiting administrator rights is the strongest defense