Operating system

An operating system provides two things at once: abstraction and isolation. It turns a CPU into processes and threads, physical RAM into per-process virtual address spaces, disks into file systems, network interfaces into sockets and devices into uniform driver interfaces, and it multiplexes all of them among competing programs. Isolation depends on hardware support that the OS configures: privilege rings or exception levels separate kernel and user mode, and the memory-management unit translates every virtual address through page tables the kernel controls, so one process simply has no mapping for another's memory. A page fault, a timer interrupt or a system call are the only ways control returns to the kernel.

The kernel is the privileged core, but the OS as delivered is much larger: the C library and system libraries that wrap system calls, the init and service manager (systemd, Windows Service Control Manager, launchd), the dynamic loader, shells, package management, authentication stacks (PAM, the Windows Local Security Authority) and the default configuration. POSIX (IEEE 1003.1) standardises the Unix-style interface, which Linux, the BSDs and macOS largely follow; Windows exposes the Win32 API on top of the native NT API. Scheduling policy illustrates how much is policy rather than mechanism: Linux replaced its Completely Fair Scheduler with EEVDF in kernel 6.6 (2023), while Windows uses a priority-based preemptive scheduler with dynamic boosts.

From a security perspective the OS is the reference monitor for most controls: it authenticates users, labels every process with an identity (UID/GID or a Windows access token with SIDs and privileges), checks permissions on every object access, and produces audit events. Hardening therefore means configuring those mechanisms: CIS Benchmarks and Microsoft security baselines specify settings, while exploit mitigations such as ASLR, DEP/NX, stack canaries and control-flow integrity (CFG, CET shadow stacks) make memory-corruption bugs harder to exploit. Mandatory access control (SELinux, AppArmor) and sandboxing (seccomp, Windows AppContainer, the iOS and Android app sandboxes) restrict what even a compromised process can do.

Lifecycle is an under-appreciated risk. Each OS release has a support window after which it receives no security updates; Windows 10 reached end of support on 14 October 2025, with paid Extended Security Updates as a temporary bridge, and embedded or industrial systems often run long-unsupported versions because the equipment vendor has not certified a newer one. Asset inventories should therefore record the exact OS version and support status, and ISO/IEC 27001:2022 control 8.8 (management of technical vulnerabilities) treats unsupported software as a risk to be handled explicitly. Virtualisation and containers add layers: a hypervisor isolates whole OS instances, whereas containers share one host kernel and rely on namespaces and cgroups, so a kernel vulnerability can break container isolation but not, by itself, VM isolation.