Companion-course connectionKernel Module Security
Kernel module security governs which code may extend the operating-system kernel, when modules may load, and how unsupported or unnecessary drivers are prevented from expanding privilege.
Open article →Companion-course connectionLinux Capabilities and Privilege Delegation
Linux capabilities and controlled privilege delegation split broad superuser power into narrower rights so services and administrators receive only the authority required for a task.
Open article →Companion-course connectionsystemd Service Hardening
systemd service hardening uses unit-level sandboxing, identity, filesystem, capability, namespace, and resource controls to reduce what a Linux service can do if it fails or is compromised.
Open article →Companion-course connectionFilesystem Mount Hardening
Filesystem mount hardening uses mount boundaries and options to reduce executable content, device access, privilege transitions, and unsafe write behavior on selected filesystems.
Open article →Companion-course connectionLinux Account Lifecycle
Linux account lifecycle management governs creation, modification, suspension, deletion, home directories, shells, group membership, service identities, and residual access from onboarding through deprovisioning.
Open article →Companion-course connectionPAM Authentication Policy
Pluggable Authentication Modules centralize Linux authentication decisions through ordered policy stacks that can combine passwords, lockouts, multifactor methods, directories, and session controls.
Open article →Companion-course connectionPython Dependency Isolation
Python dependency isolation separates project packages and interpreters from system components so version conflicts, unreviewed libraries, and installation side effects do not spread across workloads.
Open article →Companion-course connectionSELinux Policy Enforcement
SELinux policy enforcement uses labels, types, roles, and policy rules to confine processes and data even when conventional ownership and mode bits would permit access.
Open article →Companion-course connectionShell Script Security
Shell script security reduces command injection, unsafe expansion, silent failure, secret exposure, and destructive mistakes through disciplined quoting, input handling, error checks, permissions, and review.
Open article →Companion-course connectionAccess Control Lists on Hosts
Host access control lists extend basic owner-group-other permissions with named user and group entries, default inheritance, and more precise authorization for shared files and directories.
Open article →Companion-course connectionCloud Configuration Drift
Cloud configuration drift occurs when deployed resources no longer match approved definitions, baselines, or intended architecture.
Open article →Companion-course connectionCloud Container Security
Cloud container security protects images, registries, orchestrators, nodes, runtime configuration, network policy, secrets, identities, and workloads throughout the container lifecycle.
Open article →