Summary (3.4)
In this chapter, you learned how the Linux operation system is used in a SOC environment, including:
Linux tools that are used for security monitoring and investigation
How to use the Linux shell to work with directory and files and how to create, modify, copy, and move text files
The difference between server and client applications
In this chapter, you also learned how to perform basic Linux administration tasks, including:
How to view service configuration files
What features need to be hardened on Linux devices
The types and location of services logs used for monitoring purposes
You also learned about the various Linux file system types, including:
ext2, ext3, and ext4
NFS
CDFS
Swap file system
HFS+
Master boot record
You learned how roles and file permissions dictate which users or groups can access which files and whether those users or groups have Read, Write, or Execute permissions. You also learned how the root user or owner of a file can change permissions. These files can have hard links or symbolic links. A hard link is another file that points to the same location as the original file. A symbolic link, sometimes called a symlink or soft link, is similar to a hard link in that applying changes to the symbolic link will also change the original file.
Finally, in this chapter you learned how to perform basic security-related tasks on a Linux host, including:
Installing and running applications from the command line
Keeping the system up to date with apt-get update and apt-get upgrade
Viewing the current processes and forks running in memory
Using chkrootkit to check the computer for known rootkits
Using piping to chain commands together, feeding one command output into the input of another command
As a cybersecurity analyst, you need a basic understanding of the features and characteristics of the Linux operating system and how Linux is used in a SOC environment.