Windows, macOS and Linux

Almost every security job description mentions at least two operating systems. You do not need to be an expert in all three, but you do need to know where the controls live and what the command line expects.

The good news: once you understand users, processes, files and permissions, the differences become vocabulary rather than mysteries.

The shape they share

All three have:

• a kernel that talks to hardware and schedules processes;
• user accounts and groups, with a distinction between ordinary and administrative privileges;
• a file system with paths, ownership and permissions;
• services (background processes) and logs;
• a terminal that exposes the same concepts through text.

The differences are in the details, and those details are where investigations happen.

Windows

Windows dominates enterprise desktops, which makes it a frequent target and a required skill in most IT roles.

• The kernel is NT; the main file system is NTFS.
• Registry stores system and application configuration in a hierarchical database.
• Active Directory centralises accounts, groups and policy across an organisation.
• UAC prompts for elevation instead of running everything as administrator.
• PowerShell is both a shell and a scripting environment; many attacks and defences use it.
• Event Viewer and the Security log are central to investigations (event IDs 4624, 4625 and 4688 are worth knowing).

Windows permissions are expressed as ACLs (access control lists) rather than the compact rwx string you will meet on Unix-like systems.