# Security from Zero — Topic 03 workbook

Goal: explain users, files, permissions, processes and services using your own observations.
Lesson: https://secopsnomad.si/blog/security-from-zero-03-operating-systems/

## Environment

Windows version / shell:
Linux distribution and version / shell (or not executed):
Date, time and time zone:
Public device and account labels:

## Windows track

Unique practice-folder path (keep the original private):
Current location / filename / file contents:
Current account:
Owner from Get-Acl:
One access entry and what it means:
Was the entry inherited?
What did you actually read or write successfully?
Why is this not a complete effective-access check?

Notepad PID, process name and observation time:
Path / StartTime (or unavailable and why):
EventLog service name and observed status:
What does this service status fail to prove?

## Optional Linux track

Executed / not executed:
Distribution and environment (native / VM / WSL):
Current UID and groups (verify the account is not root):
Practice directory:
Initial file mode and owner/group:

| Step | Actual outcome | Explanation |
| --- | --- | --- |
| chmod 400, then attempt append | | |
| chmod 600, then attempt append | | |
| cat and stat after the append | | |

Shell PID / PPID / user / command:
PID 1 command:
systemd-journald status (or step skipped and why):
What could affect results beyond basic mode bits?
Why does file write permission not settle every deletion question?

## One-page system-observation report

Question:
Environment and commands:
Three annotated observations, with times:
What they support:
Unknowns and commands not executed:
Next check and why:

## Before sharing

- [ ] I changed only my new test file and used a normal account.
- [ ] Windows and Linux results are kept separate.
- [ ] I marked unexecuted work and unavailable properties honestly.
- [ ] I redacted account names and personal paths consistently.
- [ ] I can explain absolute/relative paths, inherited permissions, mode 600, process vs program, and process vs service.
- [ ] My project description claims only work I completed.