Phase 05 - iOS, macOS, Windows, and Linux Security Internals
Duration: 8 weeks (Months 10-11)
Objective: assess endpoint trust boundaries and design controls and telemetry appropriate to
each operating system instead of applying one platform's assumptions to another.
Deep guides: WARMUP.md compares Linux, Windows, macOS, and iOS security models; HITCHHIKERS-GUIDE.md supplies concrete service-hardening controls and platform attack fixtures.
Required Theory
iOS and macOS
Darwin/XNU, Mach/BSD layers, app sandbox, entitlements, code signing, hardened runtime, notarization, Gatekeeper, TCC, Keychain, Secure Enclave concepts, launchd, Mach IPC, system extensions, Endpoint Security framework concepts, and mobile application assessment methodology.
Windows
Kernel/user architecture, processes/threads, SIDs, ACLs, access tokens, privileges, integrity levels, UAC, services, registry, ETW, Event Logs, Sysmon, Defender architecture, LSASS protection, PowerShell security, Active Directory, Kerberos, NTLM, and group-policy concepts.
Linux
Users/groups/mode bits/ACLs, capabilities, namespaces, cgroups, seccomp, SELinux, AppArmor, eBPF, auditd, systemd hardening, kernel attack surface, module/signing concepts, container escape classes, and hardening baselines.
Lab Sequence
| Week | Labs | Deliverable |
|---|---|---|
| 1 | Linux service baseline and privilege-boundary review | automated checker, hardening diff, rollback |
| 2 | seccomp, capabilities, AppArmor and SELinux policy | syscall/capability inventory, least policy, denial tests |
| 3 | auditd, eBPF observability, systemd sandboxing | event-to-control matrix and performance notes |
| 4 | Windows logging, Sysmon, PowerShell and service review | logging baseline, three tested detections |
| 5 | AD/Kerberos local lab | ticket-flow diagram, delegation/account policy review, event timeline |
| 6 | macOS signing, notarization, Gatekeeper and TCC | signed test app, entitlement/TCC assessment checklist |
| 7 | Keychain/Secure Enclave concepts and app sandbox review | data-protection design and entitlement minimization |
| 8 | cross-platform detection and response drill | same scenario mapped to Linux, Windows, and macOS evidence |
Runnable lab portfolio
- Cross-Platform Service Hardening Evaluator
- Cross-Platform Security Event Normalizer
- Privilege Boundary Reviewer
The portfolio joins prevention, platform telemetry, and least-privilege review across Linux, Windows, macOS, and iOS-relevant entitlement concepts.
Use benign administrative and test actions to generate telemetry. Do not implement credential dumping, persistence, stealth, or endpoint-defense evasion.
Capstone - Cross-Platform Endpoint Security Toolkit
Build:
- Linux host/service hardening checker with machine-readable results;
- Windows event-source and Sysmon coverage matrix;
- macOS entitlement, signing, TCC, and launch-item review checklist;
- platform-specific collection and containment runbooks;
- Sigma or equivalent detections backed by benign fixtures;
- secure configuration guide, limitations, and executive comparison.
Tools and Sources
Linux: auditd, systemd-analyze, capabilities tools, seccomp, AppArmor/SELinux tooling, bpftrace. Windows: Sysinternals, Event Viewer/PowerShell, Sysmon, Windows Sandbox or evaluation VM. Apple: codesign, spctl, log, launchctl, security CLI, Xcode/iOS simulator where available.
Read primary platform security documentation: Linux kernel and distribution guides, Microsoft Windows security/Sysinternals/AD/Kerberos docs, and Apple Platform Security/developer signing, sandbox, entitlement, and Endpoint Security docs.
Measures and Evaluation
-
Checker output is idempotent and distinguishes recommendation, evidence, and confidence.
-
Each detection has a benign positive fixture and at least one negative fixture.
-
Hardening changes have rollback and availability tests.
-
Kerberos flow can be reconstructed from packets/events without relying on memorized tool output.
-
Entitlements are justified against a feature and data-flow requirement.
-
Compare DAC, capabilities, LSMs, tokens/ACLs, integrity levels, sandbox profiles, and TCC.
-
Explain prevention vs detection coverage for one endpoint scenario.
-
Harden a service without silently breaking operation.
-
Identify logging blind spots and privacy tradeoffs.
-
State platform limitations and what requires vendor/MDM/EDR integration.
Common Mistakes and Interview Questions
Mistakes: copying CIS settings without workload context, enabling logs without retention/query plans, confusing UAC with a security boundary, treating all macOS entitlements as vulnerabilities, or collecting secrets and personal data unnecessarily.
Questions: investigate suspicious service creation; design Linux service isolation; explain Kerberos tickets at a high level; review a macOS entitlement set; compare ETW, auditd, and Endpoint Security telemetry; prioritize endpoint controls for a mixed fleet.
Portfolio and Stretch
Publish checks, synthetic fixtures, coverage matrices, and sanitized reports. Stretch: osquery packs, eBPF event collector, Windows event normalization, macOS Endpoint Security prototype using documented APIs, or a hardening benchmark test harness.