# [Completed] Professional Google Cybersecurity Specialization C4/8;Tools of the Trade: Linux and SQL
Hello, and welcome to Tools of the Trade: Linux and SQL, the fourth course in the Google Cybersecurity Certificate. You're on an exciting journey!
By the end of this course, you will develop a greater understanding of the basics of computing that will support your work as a security analyst. You will learn foundational concepts related to understanding operating systems, communicating with the Linux operating system through commands, and querying databases with Structured Query Language (SQL). These are key concepts in the cybersecurity field and understanding them will help you keep organizations secure.
# All things Operating System
# Introduction to Course 4
Hi! Welcome to this course on computing basics for security.
My name is Kim, and I work as a Technical Program Manager in security.
I grew up with computers and the internet but didn't really consider security as a career opportunity until I saw how it was interwoven into technology.
Before my first security job, I worked on a cloud application team and had to regularly interact with the security team.
It was my first experience working with security, but the idea of protecting information and working with others towards that goal was exciting to me.
As a result, I decided to work towards my CISSP, which led me to some new job opportunities at my company, and I was then able to move into security.
At this point, if you've been following along, you've already explored a variety of concepts useful to the security field, including security domains and networking.
I'm excited to join you during the next part of the program.
We'll take it slow so that you can understand these topics in practical ways.
The focus of this course is computing basics.
When you understand how the machines in an organization's system work, it helps you do your job as a security analyst more efficiently.
Part of your job as a security analyst is to keep systems protected from possible attacks.
You're one of the first levels of defense in protecting an organization's data.
To do this effectively, it's helpful to understand how the system you're protecting works.
In addition, you may need to investigate events to help correct errors in the system.
Being familiar with Linux operating system and its associated commands, and also being able to interact with
an organization's data through SQL, will help you with that.
In this course, you'll learn about operating systems and how they relate to applications and hardware.
Next, you'll explore the Linux operating system in more detail.
Then you'll use the Linux command line within a security context.
Finally, we'll discuss how you can use SQL to query databases while working as a security analyst.
I'm excited to explore all of these topics with you. Let's get started.
---
---
## Course 4 content
because im legally not allowed to tell you the contents of the quizzes or its answers, the contents of the self review activities or interactive plugins. i wont be sharing that stuff but if you learn whats in this book you can probs do the quizzes pretty easly. however if you suck at writing idk maybe not so easly.
Each course of this certificate program is broken into weeks. You can complete courses at your own pace, but the weekly breakdowns are designed to help you finish the entire Google Cybersecurity Certificate in about six months.
What’s to come? Here’s a quick overview of the skills you’ll learn in each week of this course.
### **Week 1: Introduction to operating systems**
You will learn about the relationship between operating systems, hardware, and software, and become familiar with the primary functions of an operating system. You'll recognize common operating systems in use today and understand how the graphical user interface (GUI) and command-line interface (CLI) both allow users to interact with the operating system.
### **Week 2: The Linux operating system**
You will be introduced to the Linux operating system and learn how it is commonly used in cybersecurity. You’ll also learn about Linux architecture and common Linux distributions. In addition, you'll be introduced to the Linux shell and learn how it allows you to communicate with the operating system.
### **Week 3: Linux commands in the Bash shell**
You will be introduced to Linux commands as entered through the Bash shell. You'll use the Bash shell to navigate and manage the file system and to authorize and authenticate users. You'll also learn where to go for help when working with new Linux commands.
### **Week 4: Databases and SQL**
You will practice using SQL to communicate with databases. You'll learn how to query a database and filter the results. You’ll also learn how SQL can join multiple tables together in a query.
## What to expect
Each course offers many types of learning opportunities:
- **Videos** led by Google instructors teach new concepts, introduce the use of relevant tools, offer career support, and provide inspirational personal stories.
- **Readings** build on the topics discussed in the videos, introduce related concepts, share useful resources, and describe case studies.
- the following are available exclusively on Coursera
- **Discussion prompts** explore course topics for better understanding and allow you to chat and exchange ideas with other learners in the [discussion forums](https://www.coursera.org/learn/linux-and-sql/discussions)
- **Self-review activities** and **labs** give you hands-on practice in applying the skills you are learning and allow you to assess your own work by comparing it to a completed example.
- **Interactive plug-ins** encourage you to practice specific tasks and help you integrate knowledge you have gained in the course.
- **In-video quizzes** help you check your comprehension as you progress through each video.
- **Practice quizzes** allow you to check your understanding of key concepts and provide valuable feedback.
- **Graded quizzes** demonstrate your understanding of the main concepts of a course. You must score 80% or higher on each graded quiz to obtain a certificate, and you can take a graded quiz multiple times to achieve a passing score.
because im legally not allowed to tell you the contents of the quizzes or its answers, the contents of the self review activities or interactive plugins. i wont be sharing that stuff but if you learn whats in this book you can probs do the quizzes pretty easily. however if you suck at writing idk maybe not so easily.
## Tips for success
- It is strongly recommended that you go through the items in each lesson in the order they appear because new information and concepts build on previous knowledge.
- Participate in all learning opportunities to gain as much knowledge and experience as possible.
- If something is confusing, don’t hesitate to replay a video, review a reading, or repeat a self-review activity.
- Use the additional resources that are referenced in this course. They are designed to support your learning. You can find all of these resources in the [Resources](https://www.coursera.org/learn/linux-and-sql/resources/y7Px8)
- tab.
- When you encounter useful links in this course, bookmark them so you can refer to the information later for study or review.
- Understand and follow the [Coursera Code of Conduct](https://www.coursera.support/s/article/208280036-Coursera-Code-of-Conduct)
to ensure that the learning community remains a welcoming, friendly, and supportive place for all members.
# Helpful resources and tips
As a learner, you can choose to complete one or multiple courses in this program. However, to obtain the Google Cybersecurity Certificate, you must complete all the courses. This reading describes what is required to obtain a certificate and best practices for you to have a good learning experience on Coursera.
## Course completion to obtain a certificate
To submit graded assignments and be eligible to receive a Google Cybersecurity Certificate, you must:
- Pay the [course certificate fee](https://www.coursera.support/s/article/209818963-Payments-on-Coursera?language=en_US)
or apply and be approved for a Coursera [scholarship](https://www.coursera.support/s/article/209819033-Apply-for-Financial-Aid-or-a-Scholarship?language=en_US)
- .
- Pass all graded quizzes in the eight courses with a score of at least 80%. Each graded quiz in a course is part of a cumulative grade for that course.
## Healthy habits for course completion
Here is a list of best practices that will help you complete the courses in the program in a timely manner:
- **Plan your time:** Setting regular study times and following them each week can help you make learning a part of your routine. Use a calendar or timetable to create a schedule, and list what you plan to do each day in order to set achievable goals. Find a space that allows you to focus when you watch the videos, review the readings, and complete the activities.
- **Work at your own pace:** Everyone learns differently, so this program has been designed to let you work at your own pace. Although your personalized deadlines start when you enroll, feel free to move through the program at the speed that works best for you. There is no penalty for late assignments; to earn your certificate, all you have to do is complete all of the work. You can extend your deadlines at any time by going to **Overview** in the navigation panel and selecting **Switch Sessions**. If you have already missed previous deadlines, select **Reset my deadlines** instead.
- **Be curious:** If you find an idea that gets you excited, act on it! Ask questions, search for more details online, explore the links that interest you, and take notes on your discoveries. The steps you take to support your learning along the way will advance your knowledge, create more opportunities in this high-growth field, and help you qualify for jobs.
- **Take notes:** Notes will help you remember important information in the future, especially as you’re preparing to enter a new job field. In addition, taking notes is an effective way to make connections between topics and gain a better understanding of those topics.
- **Review exemplars:** Exemplars are completed assignments that fully meet an activity's criteria. Many activities in this program have exemplars for you to validate your work or check for errors. Although there are often many ways to complete an assignment, exemplars offer guidance and inspiration about how to complete the activity.
- **Chat (responsibly) with other learners:** If you have a question, chances are, you’re not alone. Use the [discussion forums](https://www.coursera.org/learn/linux-and-sql/discussions)
to ask for help from other learners taking this program. You can also visit Coursera’s [Global Online Community](https://coursera.community/). Other important things to know while learning with others can be found in the [Coursera Honor Code](https://learner.coursera.help/hc/en-us/articles/209818863-Coursera-Honor-Code) and [Code of Conduct](https://learner.coursera.help/hc/en-us/articles/208280036-Coursera-Code-of-Conduct)
- .
- **Update your profile:** Consider [updating your profile](https://www.coursera.org/account/profile)
- on Coursera to include your photo, career goals, and more. When other learners find you in the discussion forums, they can click on your name to access your profile and get to know you better.
## Documents, spreadsheets, presentations, and labs for course activities
To complete certain activities in the program, you will need to use digital documents, spreadsheets, presentations, and/or labs. Security professionals use these software tools to collaborate within their teams and organizations. If you need more information about using a particular tool, refer to these resources:
- [Microsoft Word: Help and learning](https://support.microsoft.com/en-us/word)
- : Microsoft Support page for Word
- [Google Docs](https://support.google.com/docs/topic/9046002?hl=en&ref_topic=1382883)
- : Help Center page for Google Docs
- [Microsoft Excel: Help and learning](https://support.microsoft.com/en-us/excel)
- : Microsoft Support page for Excel
- [Google Sheets](https://support.google.com/docs/topic/9054603?hl=en&ref_topic=1382883)
- : Help Center page for Google Sheets
- [Microsoft PowerPoint: Help and learning](https://support.microsoft.com/en-us/powerpoint)
- : Microsoft Support page for PowerPoint
- [How to use Google Slides](https://support.google.com/docs/answer/2763168?hl=en&co=GENIE.Platform%3DDesktop)
- : Help Center page for Google Slides
- [Common problems with labs](https://support.google.com/qwiklabs/answer/9133560?hl=en&ref_topic=9134804)
- : Troubleshooting help for Qwiklabs activities
## Weekly, course, and certificate glossaries
This program covers a lot of terms and concepts, some of which you may already know and some of which may be unfamiliar to you. To review terms and help you prepare for graded quizzes, refer to the following glossaries:
- **Weekly glossaries**: At the end of each week’s content, you can review a glossary of terms from that week. Each week’s glossary builds upon the terms from the previous weeks in that course. The weekly glossaries are not downloadable; however, all of the terms and definitions are included in the course and certificate glossaries, which are downloadable.
- **Course glossaries**: At the end of each course, you can access and download a glossary that covers all of the terms in that course.
- **Certificate glossary**: The certificate glossary includes all of the terms in the entire certificate program and is a helpful resource that you can reference throughout the program or at any time in the future.
You can access and download the certificate glossaries and save them on your computer. You can always find the course and certificate glossaries through the course’s [Resources](https://www.coursera.org/learn/linux-and-sql/resources/FUN4o)
section. To access the **Cybersecurity Certificate glossary**, click the link below and select *Use Template*.
- [Cybersecurity Certificate glossary](https://docs.google.com/document/d/1Feb8pHRY-blnpaLOohds2esd6IWdCIp-ikG7G_omSj4/template/preview?usp=sharing&resourcekey=0-YHcAISkCiqGDq5KwO6yNeQ)
OR
- If you don’t have a Google account, you can download the glossary directly from the attachment below.
- [click to donwload the doc](https://d3c33hcgiwev3.cloudfront.net/Q__8HGJKSWKvlbOKLdTtkg_ad50d57e3f79455783a12f606c297af1_Google-Cybersecurity-Certificate-glossary.docx?Expires=1688601600&Signature=WFHqYgcAFHo9Q7oNKvfQ4mhd3UMdBH~VvaEnwJUxXkb9Hw4dG1Mk6TSfVPryJArjtJuJou~tzWwmHchZAkJph-zhuE9XkUtcRiyjRXX90yBGs3B335JBRpDzW9wdLZPfx7KAusM6Ye55lmrgvLPO5dW3FyQdHeXlLE4RDVMGtxM_&Key-Pair-Id=APKAJLTNE6QMUY6HBC5A)
## Course feedback
Providing feedback on videos, readings, and other materials is easy. With the resource open in your browser, you can find the thumbs-up and thumbs-down symbols.
- Click **thumbs-up** for materials that are helpful.
- Click **thumbs-down** for materials that are not helpful.
If you want to flag a specific issue with an item, click the flag icon, select a category, and enter an explanation in the text box. This feedback goes back to the course development team and isn’t visible to other learners. All feedback received helps to create even better certificate programs in the future.
For technical help, visit the [Learner Help Center](https://learner.coursera.help/hc/en-us)
.
# Welcome to week 1; Introduction to operating systems
How many times a week do you use a computer?
For some of us, the answer might be "a lot"!
They are incredible machines that let us do everything from using specialized applications when completing a task at work to sending emails to loved ones in a distant place.
Have you ever thought about how computers can do all of this?
Well, that's where opperating systems come in.
In this section, we'll learn about common operating systems, and we'll explore the main functions of an operating system.
Then, we'll learn the relationship between operating systems, applications, and hardware.
Finally, we'll compare graphical user interfaces and command-line interfaces.
The command-line interface will be an essential part of your job as a security analyst.
Understanding operating systems is an important foundation for your career in security.
There's so much to explore. Let's begin.
---
Devices like computers, smartphones, and tablets all have operating systems.
If you've used a desktop or laptop computer, you may have used the Windows or MacOs operating systems. Smartphones and tablets run on mobile operating systems like Android and iOS.
Another popular operating system is Linux.
Linux is used in the security industry, and as a security professional, it's likely that you'll interact with the Linux OS.
So what exactly is an operating system?
It's the interface between the computer hardware and the user.
The operating system, or the OS as it's commonly called, is responsible for making the computer run as efficiently as possible while also making it easy to use.
Hardware may be another new term.
Hardware refers to the physical components of a computer.
The OS interface that we now rely on every day is something that early computers didn't have.
In the 1950s the biggest challenge with early computers was the amount of time it took to run a computer program. At the time, computers could not run multiple programs simultaneously.
Instead, people had to wait for a program to finish running, reset the computer, and load up the new program.
Imagine having to turn your computer on and off each time you had to open a new application!
It would take a long time to complete a simple task like sending an email.
Since then, operating systems have evolved, and we no longer have to worry about wasting time in this way.
Thanks to operating systems and their evolution, today's computers run efficiently.
They run multiple applications at once, and they also access external devices like printers, keyboards, and mice.
Another reason why operating systems are important is that they help humans and computers communicate with each other.
Computers communicate in a language called binary, which consists of 0s and 1s.
The OS provides an interface to bridge this communication gap between the user and the computer, allowing you to interact with the computer in complex ways.
Operating systems are critical for the use of computers. Likewise, OS security is also critical for the security of a computer.
This involves securing files, data access, and user authentication to help protect and prevent against threats such as viruses, worms, and malware.
Knowing how operating systems work is essential for completing different security related tasks.
For example, as a security analyst, you may be responsible for configuring and maintaining the security of a system by managing access.
You may also be responsible for managing and configuring firewalls, setting security policies, enabling virus protection, and performing auditing, accounting, and logging to detect unusual behavior.
All these tasks require a deep understanding of operating systems, and as we continue this course, we'll explore operating systems in greater detail.
---
# Kim: My journey into computing
Hi, I'm Kim.
I'm a technical program manager at Google.
I'm currently working in the security, mergers, and acquisitions team.
Where I work with other companies that we purchase, and I help them integrate into the Google environment.
I've held multiple roles before getting into cybersecurity and even technology.
I first started working as a restaurant worker, and then I became an English Tutor for international students at my local college.
After doing multiple internships, and graduating from university, I had my first opportunity to work in technology, and that's where my interests in technology,
and eventually cybersecurity began.
I want to tell everyone with any type of background that you can get into cybersecurity.
If you're interested in protecting information, if you're interested in protecting people in the future, security is there for you.
There are so many different roles you can do, and all of the skills that you have now, and that you've gathered previously, can be applicable within security.
The skill that I use the most is connecting with people every day.
I can't get anything done unless I connect with them the right way.
So that's actually the biggest skill I lean on the most working in security.
A piece of advice I would give for someone new starting in the cybersecurity field is to keep an open mind.
I started out with a degree in business, so I didn't even feel like I was technical enough to be where I am today.
And before that, all of my experiences were either restaurant work, or marketing work, or just something that
felt like it was unrelated to technology.
But all of that helped me and motivated me to actually kind of get my feet more wet into technology, and then eventually security.
And before I knew it, that self-doubt was really replaced with more of a support from my peers and respect from other people that I've worked with.
# Compare operating systems
You previously explored why operating systems are an important part of how a computer works. In this reading, you’ll compare some popular operating systems used today. You’ll also focus on the risks of using legacy operating systems.
## Common operating systems
The following operating systems are useful to know in the security industry: Windows, macOS®, Linux, ChromeOS, Android, and iOS.
### **Windows and macOS**
Windows and macOS are both common operating systems. The Windows operating system was introduced in 1985, and macOS was introduced in 1984. Both operating systems are used in personal and enterprise computers.
Windows is a closed-source operating system, which means the source code is not shared freely with the public. macOS is partially open source. It has some open-source components, such as macOS’s kernel. macOS also has some closed-source components.
### **Linux**
The first version of Linux was released in 1991, and other major releases followed in the early 1990s. Linux is a completely open-source operating system, which means that anyone can access Linux and its source code. The open-source nature of Linux allows developers in the Linux community to collaborate.
Linux is particularly important to the security industry. There are some distributions that are specifically designed for security. Later in this course, you’ll learn about Linux and its importance to the security industry.
### **ChromeOS**
ChromeOS launched in 2011. It’s partially open source and is derived from Chromium OS, which is completely open source. ChromeOS is frequently used in the education field.
### **Android and iOS**
Android and iOS are both mobile operating systems. Unlike the other operating systems mentioned, mobile operating systems are typically used in mobile devices, such as phones, tablets, and watches. Android was introduced for public use in 2008, and iOS was introduced in 2007. Android is open source, and iOS is partially open source.
## Operating systems and vulnerabilities
Security issues are inevitable with all operating systems. An important part of protecting an operating system is keeping the system and all of its components up to date.
### **Legacy operating systems**
A **legacy operating system** is an operating system that is outdated but still being used. Some organizations continue to use legacy operating systems because software they rely on is not compatible with newer operating systems. This can be more common in industries that use a lot of equipment that requires embedded software—software that’s placed inside components of the equipment.
Legacy operating systems can be vulnerable to security issues because they’re no longer supported or updated. This means that legacy operating systems might be vulnerable to new threats.
### **Other vulnerabilities**
Even when operating systems are kept up to date, they can still become vulnerable to attack. Below are several resources that include information on operating systems and their vulnerabilities.
- [Microsoft Security Response Center (MSRC)](https://msrc.microsoft.com/update-guide/vulnerability)
- - A list of known vulnerabilities affecting Microsoft products and services
- [Apple Security Updates](https://support.apple.com/en-us/HT201222)
- A list of security updates and information for Apple® operating systems, including macOS and iOS, and other products
- [Common Vulnerabilities and Exposures (CVE) Report for Ubuntu](https://ubuntu.com/security/cves)
- A list of known vulnerabilities affecting Ubuntu, which is a specific distribution of Linux
- [Google Cloud Security Bulletin](https://cloud.google.com/support/bulletins)
- A list of known vulnerabilities affecting Google Cloud products and services
Keeping an operating system up to date is one key way to help the system stay secure. Because it can be difficult to keep all systems updated at all times, it’s important for security analysts to be knowledgeable about legacy operating systems and the risks they can create.
## Key takeaways
Windows, macOS, Linux, ChromeOS, Android, and iOS are all commonly used operating systems. Security analysts should be aware of vulnerabilities that affect operating systems. It’s especially important for security analysts to be familiar with legacy operating systems, which are systems that are outdated but still being used.
# Inside the operating system
Previously, you learned about what operating systems are.
Now, let's discuss how they work.
In this video, you'll learn what happens with an operating system, or OS, when someone uses a computer for a task.
Think about when someone drives a car.
They push the gas pedal and the car moves forward.
They don't need to pay attention to all the mechanics that allow the car to move.
Just like a car can't work without its engine, a computer can't work without its operating system.
The job of an OS is to help other computer programs run efficiently.
The OS does this by taking care of all the messy details related to controlling, the computer's hardware, so you don't have to.
First, let's see what happens when you turn on the computer.
When you press the power button, you're interacting with the hardware.
This boosts the computer and brings up the operating system.
Booting the computer means that a special microchip called a BIOS is activated.
On many computers built after 2007, the chip was replaced by the UEFI.
Both BIOS and UEFI contain booting instructions that are responsible for loading a special program called the bootloader.
Then, the bootloader is responsible for starting the operating system.
Just like that, your computer is on.
As a security analyst, understanding these processes can be helpful for you.
Vulnerabilities can occur in something like a booting process.
Often, the BIOS is not scanned by the antivirus software, so it can be vulnerable to malware infection.
Now, that you learned how to boot the operating system, let's look at how you and all users communicate with the system to complete a task.
The process starts with you, the user.
And to complete tasks, you use applications on your computer.
An application is a program that performs a specific task.
When you do this, the application sends your request to the operating system.
From there, the operating system interprets this request and directs it to the appropriate component of the computer's hardware.
In the previous video, we learned that the hardware consists of all the physical components of the computer.
The hardware will also send information back to the operating system.
And this in turn is sent back to the application.
Let's give a simple overview of how this works when you want to use the calculator on your computer.
You use your mouse to click on the calculator application on your computer.
When you type in the number you want to calculate, the application communicates with the operating system.
Your operating system then sends a calculation to a component of the hardware, the central processing unit, or CPU.
Once the hardware does the work of determining the final number, it sends the answer back to your operating system.
Then, it can be displayed in your calculator application.
Understanding this process is helpful when investigating security events.
Security analysts should be able to trace back through this process flow to analyze where a security event could have occurred.
Just like a mechanic needs to understand the inner workings of a car more than an average driver, recognizing how operating systems work is important knowledge for a security analyst.
# Requests to the operating system
Operating systems are a critical component of a computer. They make connections between applications and hardware to allow users to perform tasks. In this reading, you’ll explore this complex process further and consider it using a new analogy and a new example.
## Booting the computer
When you boot, or turn on, your computer, either a BIOS or UEFI microchip is activated. The **Basic Input/Output System (BIOS)** is a microchip that contains loading instructions for the computer and is prevalent in older systems. The **Unified Extensible Firmware Interface (UEFI)** is a microchip that contains loading instructions for the computer and replaces BIOS on more modern systems.
The BIOS and UEFI chips both perform the same function for booting the computer. BIOS was the standard chip until 2007, when UEFI chips increased in use. Now, most new computers include a UEFI chip. UEFI provides enhanced security features.
The BIOS or UEFI microchips contain a variety of loading instructions for the computer to follow. For example, one of the loading instructions is to verify the health of the computer’s hardware.
The last instruction from the BIOS or UEFI activates the bootloader. The **bootloader** is a software program that boots the operating system. Once the operating system has finished booting, your computer is ready for use.
## Completing a task
As previously discussed, operating systems help us use computers more efficiently. Once a computer has gone through the booting process, completing a task on a computer is a four-part process.
### User
The first part of the process is the user. The user initiates the process by having something they want to accomplish on the computer. Right now, you’re a user! You’ve initiated the process of accessing this reading.
### Application
The application is the software program that users interact with to complete a task. For example, if you want to calculate something, you would use the calculator application. If you want to write a report, you would use a word processing application. This is the second part of the process.
### Operating system
The operating system receives the user’s request from the application. It’s the operating system’s job to interpret the request and direct its flow. In order to complete the task, the operating system sends it on to applicable components of the hardware.
### Hardware
The hardware is where all the processing is done to complete the tasks initiated by the user. For example, when a user wants to calculate a number, the CPU figures out the answer. As another example, when a user wants to save a file, another component of the hardware, the hard drive, handles this task.
After the work is done by the hardware, it sends the output back through the operating system to the application so that it can display the results to the user.
## The OS at work behind the scenes
Consider once again how a computer is similar to a car. There are processes that someone won’t directly observe when operating a car, but they do feel it move forward when they press the gas pedal. It’s the same with a computer. Important work happens inside a computer that you don’t experience directly. This work involves the operating system.
You can explore this through another analogy. The process of using an operating system is also similar to ordering at a restaurant. At a restaurant you place an order and get your food, but you don’t see what’s happening in the kitchen when the cooks prepare the food.
Ordering food is similar to using an application on a computer. When you order your food, you make a specific request like “a small soup, very hot.” When you use an application, you also make specific requests like “print three double-sided copies of this document.”
You can compare the food you receive to what happens when the hardware sends output. You receive the food that you ordered. You receive the document that you wanted to print.
Finally, the kitchen is like the OS. You don’t know what happens in the kitchen, but it’s critical in interpreting the request and ensuring you receive what you ordered. Similarly, though the work of the OS is not directly transparent to you, it’s critical in completing your tasks.
## An example: Downloading a file from an internet browser
Previously, you explored how operating systems, applications, and hardware work together by examining a task involving a calculation. You can expand this understanding by exploring how the OS completes another task, downloading a file from an internet browser:
- First, the user decides they want to download a file that they found online, so they click on a download button near the file in the internet browser application.
- Then, the internet browser communicates this action to the OS.
- The OS sends the request to download the file to the appropriate hardware for processing.
- The hardware begins downloading the file, and the OS sends this information to the internet browser application. The internet browser then informs the user when the file has been downloaded.
## Key takeaways
Although it operates in the background, the operating system is an essential part of the process of using a computer. The operating system connects applications and hardware to allow users to complete a task.
# Resource allocation via the OS
Now we're ready to discuss a different aspect of your operating system.
Not only does the OS interact with other parts of your computer, but it's also responsible for
managing the resources of the system.
This is a big task that requires a lot of balance to make sure all the resources of
the computer are used efficiently.
Think of this like the concept of energy.
A person needs energy to complete different tasks.
Some tasks need more energy, while others require less.
For example, going for a run requires more energy than watching TV.
A computer's OS also needs to make sure that it has enough energy to function correctly for certain tasks.
Running an antivirus scan on your computer will use more energy than using the calculator application.
Imagine your computer is an orchestra.
Many different instruments like violins, drums, and trumpets are all part of the orchestra.
An orchestra also has a conductor to direct the flow of the music.
In a computer, the OS is the conductor.
The OS handles resource and memory management to ensure the limited capacity of the computer system is used where it's needed most.
A variety of programs, tasks, and processes are constantly competing for the resources of the central processing unit, or CPU.
They all have their own reasons why they need memory, storage, and input/output bandwidth.
The OS is responsible for ensuring that each program is allocating and de-allocating resources.
All this occurs in your computer at the same time so that your system functions efficiently.
Much of this is hidden from you as a user.
For example, your browser's task manager will list all of the tasks that are being processed, along with their memory and CPU usage.
As an analyst, it's helpful to know where a system's resources are used.
Understanding usage of resources can help you respond to an incident and troubleshoot applications in the system.
For example, if a computer is running slowly, an analyst might discover it's allocating resources to malware.
A basic understanding of how operating systems work will help you better understand the security skills you will learn later in this program.
# Virtualization technology
You've explored a lot about operating systems. One more aspect to consider is that operating systems can run on virtual machines. In this reading, you’ll learn about virtual machines and the general concept of virtualization. You’ll explore how virtual machines work and the benefits of using them.
## What is a virtual machine?
A **virtual machine (VM)** is a virtual version of a physical computer. Virtual machines are one example of virtualization. Virtualization is the process of using software to create virtual representations of various physical machines. The term “virtual” refers to machines that don’t exist physically, but operate like they do because their software simulates physical hardware. Virtual systems don’t use dedicated physical hardware. Instead, they use software-defined versions of the physical hardware. This means that a single virtual machine has a virtual CPU, virtual storage, and other virtual hardware. Virtual systems are just code.
You can run multiple virtual machines using the physical hardware of a single computer. This involves dividing the resources of the host computer to be shared across all physical and virtual components. For example, **Random Access Memory (RAM)** is a hardware component used for short-term memory. If a computer has 16GB of RAM, it can host three virtual machines so that the physical computer and virtual machines each have 4GB of RAM. Also, each of these virtual machines would have their own operating system and function similarly to a typical computer.
## Benefits of virtual machines
Security professionals commonly use virtualization and virtual machines. Virtualization can increase security for many tasks and can also increase efficiency.
### **Security**
One benefit is that virtualization can provide an isolated environment, or a sandbox, on the physical host machine. When a computer has multiple virtual machines, these virtual machines are “guests” of the computer. Specifically, they are isolated from the host computer and other guest virtual machines. This provides a layer of security, because virtual machines can be kept separate from the other systems. For example, if an individual virtual machine becomes infected with malware, it can be dealt with more securely because it’s isolated from the other machines. A security professional could also intentionally place malware on a virtual machine to examine it in a more secure environment.
**Note:** Although using virtual machines is useful when investigating potentially infected machines or running malware in a constrained environment, there are still some risks. For example, a malicious program can escape virtualization and access the host machine. This is why you should never completely trust virtualized systems.
### **Efficiency**
Using virtual machines can also be an efficient and convenient way to perform security tasks. You can open multiple virtual machines at once and switch easily between them. This allows you to streamline security tasks, such as testing and exploring various applications.
You can compare the efficiency of a virtual machine to a city bus. A single city bus has a lot of room and is an efficient way to transport many people simultaneously. If city buses didn’t exist, then everyone on the bus would have to drive their own cars. This uses more gas, cars, and other resources than riding the city bus.
Similar to how many people can ride one bus, many virtual machines can be hosted on the same physical machine. That way, separate physical machines aren't needed to perform certain tasks.
## Managing virtual machines
Virtual machines can be managed with a software called a hypervisor. Hypervisors help users manage multiple virtual machines and connect the virtual and physical hardware. Hypervisors also help with allocating the shared resources of the physical host machine to one or more virtual machines.
One hypervisor that is useful for you to be familiar with is the Kernel-based Virtual Machine (KVM). KVM is an open-source hypervisor that is supported by most major Linux distributions. It is built into the Linux kernel, which means it can be used to create virtual machines on any machine running a Linux operating system without the need for additional software.
## Other forms of virtualization
In addition to virtual machines, there are other forms of virtualization. Some of these virtualization technologies do not use operating systems. For example, multiple virtual servers can be created from a single physical server. Virtual networks can also be created to more efficiently use the hardware of a physical network.
## Key takeaways
Virtual machines are virtual versions of physical computers and are one example of virtualization. Virtualization is a key technology in the security industry, and it’s important for security analysts to understand the basics. There are many benefits to using virtual machines, such as isolation of malware and other security risks. However, it’s important to remember there’s still a risk of malicious software escaping their virtualized environments.
# GUI versus CLI
Now that you've learned the inner workings of computers, let's discuss how users and operating systems communicate with each other.
So far, you've learned that a computer has an operating system, hardware, and applications.
Remember, the operating system communicates with the hardware to execute tasks.
In this video, you'll learn how the user—that's you—interacts with the operating system in order to send tasks to the hardware.
The user communicates with the operating system via an interface.
A user interface is a program that allows a user to control the functions of the operating system.
Two user interfaces that we'll discuss are the graphical user interface, or GUI, and the command-line interface, or CLI.
Let's cover these interfaces in more detail.
A GUI is a user interface that uses icons on the screen to manage different tasks on the computer.
Most operating systems can be used with a graphical user interface.
If you've used a personal computer or a cell phone, you have experienced operating a GUI.
Most GUIs include these components:
a start menu with program groups, a task bar for launching programs, and a desktop with icons and shortcuts.
All these components help you communicate with the OS to execute tasks.
In addition to clicking on icons, when you use a GUI, you can also search for files or applications from the start menu.
You just have to remember the icon or name of the program to activate an application.
Now let's discuss the command-line interface.
In comparison, the command-line interface, or CLI, is a text-based user interface that uses commands to interact with the computer.
These commands communicate with the operating system and execute tasks like opening programs.
The command-line interface is a much different structure than the graphical user interface.
When you use the CLI, you'll immediately notice a difference.
There are no icons or graphics on the screen.
The command-line interface looks similar to lines of code using certain text languages.
A CLI is more flexible and more powerful than a GUI.
Think about using a CLI like creating whatever meal you'd like from ingredients bought at a grocery store.
This gives you a lot of control and customization about what you're going to eat.
In comparison, using a GUI is more like ordering food from a restaurant.
You can only order what's on the menu.
If you want both a noodle dish and pizza, but the first restaurant you go to only has pizza, you'll have to go to another restaurant
to order the noodles.
With a graphical user interface, you must do one task at a time.
But the command-line interface allows for customization, which lets you complete multiple tasks simultaneously.
For example, imagine you have a folder with hundreds of files of different file types, and you need to move only the JPEG files to a new folder.
Think about how slow and tedious this would be as you use a GUI to find each JPEG file in this folder and move it into the new one.
On the other hand, the CLI would allow you to streamline this process and move them all at once.
As you can see, there are very big differences in these two types of user interfaces.
As a security analyst, some of your work may involve the command-line interface.
When analyzing logs or authenticating and authorizing users, security analysts commonly use a CLI in their everyday work.
In this video, we discussed two types of user interfaces.
You learned that you already have experience using a graphical user interface, as most personal computers and cell phones use a GUI.
You were introduced to the command-line interface.
Later in the program, you'll learn how to use a CLI in Linux and how relevant it is to your daily work as a security analyst.
You'll get practical experience communicating through the command line. Pretty exciting, right?
# The command line in use
Previously, you explored graphical user interfaces (GUI) and command-line user interfaces (CLI). In this reading, you’ll compare these two interfaces and learn more about how they’re used in cybersecurity.
## CLI vs. GUI
A **graphical user** **interface (GUI)** is a user interface that uses icons on the screen to manage different tasks on the computer. A **command-line interface (CLI)** is a text-based user interface that uses commands to interact with the computer.
### Display
One notable difference between these two interfaces is how they appear on the screen. A GUI has graphics and icons, such as the icons on your desktop or taskbar for launching programs. In contrast, a CLI only has text. It looks similar to lines of code.
### **Function**
These two interfaces also differ in how they function. A GUI is an interface that only allows you to make one request at a time. However, a CLI allows you to make multiple requests at a time.
## Advantages of a CLI in cybersecurity
The choice between using a GUI or CLI is partly based on personal preference, but security analysts should be able to use both interfaces. Using a CLI can provide certain advantages.
### Efficiency
Some prefer the CLI because it can be used more quickly when you know how to manage this interface. For a new user, a GUI might be more efficient because they’re easier for beginners to navigate.
Because a CLI can accept multiple requests at one time, it’s more powerful when you need to perform multiple tasks efficiently. For example, if you had to create multiple new files in your system, you could quickly perform this task in a CLI. If you were using a GUI, this could take much longer, because you have to repeat the same steps for each new file.
### History file
For security analysts, using the Linux CLI is helpful because it records a history file of all the commands and actions in the CLI. If you were using a GUI, your actions are not necessarily saved in a history file.
For example, you might be in a situation where you’re responding to an incident using a playbook. The playbook’s instructions require you to run a series of different commands. If you used a CLI, you’d be able to go back to the history and ensure all of the commands were correctly used. This could be helpful if there were issues using the playbook and you had to review the steps you performed in the command line.
Additionally, if you suspect an attacker has compromised your system, you might be able to trace their actions using the history file.
## Key takeaways
GUIs and CLIs are two types of user interfaces that security analysts should be familiar with. There are multiple differences between a GUI and a CLI, including their displays and how they function. When working in cybersecurity, a CLI is often preferred over a GUI because it can handle multiple tasks simultaneously and it includes a history file.
# Ellen: My path into cybersecurity
My name is Ellen and I am a security engineering manager at Google focused in on how Google uses the cloud.
Cybersecurity wasn't a field when I got started in technology, something I came to later.
I got started in technology when I was working retail at a poster store.
And we needed to build a website and my feet hurt and I really needed to sit down.
And so I asked friends to teach me how to do HTML so I could sit down while working and I could let my blisters have a rest.
While I was at the poster store, one of our customers worked at a start up and used to get employee photos framed and they asked them for feedback on my website, and they ended up giving me an internship.
One of the specialties that I ended up having was API design or designing the interface by which a developer communicates with the machine.
As part of that, I got into a job where I was designing a miniature version of an operating system for security technology and started learning security from there.
Most of the people I know from cyber security, especially in the early days, do not have a degree at all.
Or if they do, they have a degree like I do in something like philosophy or poetry.
Almost everyone learned on their own by experimenting, by talking to people, by reading.
And so I would say no technical background is required.
And in fact, having a background where you're used to being out in the real world can sometimes make cybersecurity make more sense and help you make more balanced choices.
In almost all areas, there is a security community that you can find.
Figure out where they are, look for local conferences, start talking to people.
It's a lot more fun to learn that way than it is in a vacuum.
I've found that most people if you come to them and say, hey, you're really good at this thing, would you mind if I bought you a coffee and you showed me how to do it?
That they'll always pretty much say yes.
The advice I give to people who don't have technical backgrounds, the first one is, I wouldn't be afraid of the technology.
It can seem like only somebody with a computer science degree could ever understand things, but these concepts, these technologies are understandable by anyone.
And so never let the fact that you might not have a technical background get in the way, just pick an area that interests you and start diving in.
And as long as you're curious, and as long as you find it interesting, you'll, you'll learn the technology.
# Wrap-up; Glossary terms from week 1
We did it!
What a great section of learning!
The best thing is that we did this together and covered some very useful topics.
Let's recap this section's lessons.
As a security analyst, it's important that you understand the systems that you're working with.
Understanding computer basics will help you do your job more effectively and efficiently.
In this section, we covered common operating systems.
We also discussed the main functions of an operating system.
Importantly, you learned about the relationship between operating systems, applications, and hardware.
It was nice to learn how they flow together like an orchestra.
In addition, you learned about the differences between the graphical user interface and the command-line interface.
Understanding the command-line interface will be very important for your work.
I enjoyed exploring the world of operating systems with you.
Knowing how operating systems work is an important step in preparing for a position as a security analyst.
You're doing great!
Let's keep moving forward with this program.
In the next section, we'll focus specifically on the Linux operating system.
---
## **Terms and definitions from Course 4, Week 1**
**Application:** A program that performs a specific task
**Basic Input/Output System (BIOS):** A microchip that contains loading instructions for the computer and is prevalent in older systems
**Bootloader:** A software program that boots the operating system
**Command-line interface (CLI):** A text-based user interface that uses commands to interact with the computer
**Graphical user interface (GUI):** A user interface that uses icons on the screen to manage different tasks on the computer
**Hardware:** The physical components of a computer
**Legacy operating system:** An operating system that is outdated but still being used
**Operating system (OS)**: The interface between computer hardware and the user
**Random Access Memory (RAM):** A hardware component used for short-term memory
**Unified Extensible Firmware Interface (UEFI):** A microchip that contains loading instructions for the computer and replaces BIOS on more modern systems
**User interface:** A program that allows the user to control the functions of the operating system
**Virtual machine (VM)**: A virtual version of a physical computer
# Linux Basics
# Welcome to week 2; introduction to linux
Welcome back! We have another important topic to explore.
Previously, you learned aboutoperating systems and user interfaces.
You learned how operating systems work and how resources are allocated in computers.
We also reviewed several common operating systems.
You may already have a favorite operating system.
It's common to hear that people are fans of one over another, but in the security world,
Linux is commonly used.
In this section, you'll be learning more about the Linux operating system and how
it's used in everyday tasks in security.
First, you'll learn about the architecture of Linux.
After this, we'll compare the different distributions of Linux that are available.
Lastly, you'll explore the shell, a key Linux component that allows you to communicate with the system.
I remember when I first learned about the Linux OS, and I'm really happy to explore it with you now.
# Introduction to Linux
You might have seen or heard the name Linux in the past.
But did you know Linux is the most-used operating system in security today?
Let's start by taking a look at Linux and how it's used in security.
Linux is an open-source operating system.
It was created in two parts.
In the early 1990s, two different people were working separately on projects to improve computer engineering.
The first person was Linus Torvalds.
At the time, the UNIX operating system was already in use.
He wanted to improve it and make it open source and accessible to anyone.
What was revolutionary was his introduction of the Linux kernel.
We're going to learn what the kernel does later.
Around the same time, Richard Stallman started working on GNU.
GNU was also an operating system based on UNIX.
Stallman shared Torvalds' goal of creating software that was free and open to anyone.
After working on GNU for a few years, the missing element for the software was a kernel.
Together, Torvalds' and Stallman’s innovations made what is commonly referred to as Linux.
Now that you've learned the history behind Linux, let's take a look at what makes Linux unique.
As mentioned before, Linux is open source, meaning anyone can have access to the operating system and the source code.
Linux and many of the programs that come with Linux are licensed under the terms of the GNU Public License, which allow you to use, share, and modify them freely.
Thanks to Linux's open-source philosophy as well as a strong feature set, an entire community of developers has adopted this operating system.
These developers are able to collaborate on projects and advance computing together.
As a security analyst, you'll discover that Linux is used at different organizations.
More specifically, Linux is used in many security programs.
Another unique feature about Linux is the different distributions, or varieties, that have been developed.
Because of the large community contribution, there are over 600 distributions of Linux.
Later you'll learn more about distributions.
Finally, let's take a look at how you would use Linux in an entry-level security position.
As a security analyst, you'll use many tools and programs in everyday work.
You might examine different types of logs to identify what's going on in the system.
For example,
you might find yourself looking at an error log when investigating an issue.
Another place where you will use Linux is to verify access and authorization in an identity and access management system.
In security, managing access is key in order to ensure a secure system.
We'll take a closer look into access and authorization later.
Finally, as an analyst, you might find yourself working with specific distributions designed for a particular task.
For example, you might use a distribution that has a digital forensic tool to investigate what happened in an event alert.
You might also use a distribution that's for pen testing in offensive security to look for vulnerabilities in the system.
Distributions are created to fit the needs of their users.
I hope you're excited to learn more about Linux.
This will be a very useful skill in the security field.
# Linux architecture
Let me start with a quick question that may seem unrelated to security.
Do you have a favorite building?
And what is it about its architecture that impresses you the most?
The windows? The structure of the walls?
Just like buildings, operating systems also have an architecture and are made up of discrete components that work together to form the whole.
In this video, we're going to look at all the components that together make up Linux.
The components of Linux include the user, applications, the shell, the Filesystem Hierarchy Standard, the kernel, and the hardware.
Don't worry—we'll go into these components one by one together.
First, you are the user.
The user is the person interacting with the computer.
In Linux, you're the first element to the architecture of the operating system.
You're initiating the tasks or commands that the OS is going to execute.
Linux is a multi-user system.
This means that more than one user can use the system's resources at the same time.
The second element of the architecture is the applications within a system.
An application is a program that performs a specific task, such as a word processor or a calculator.
You might hear the word "applications" and "programs" used interchangeably.
As an example, one popular Linux application that we'll learn more about later is Nano.
Nano is a text editor.
This simple application helps you keep notes on the screen.
Linux applications are commonly distributed through package managers.
We'll learn more about this process later.
The next component in the architecture of Linux is the shell.
This is an important element because it is how you will communicate with the system.
The shell is a command line interpreter.
It processes commands and outputs the results.
This might sound familiar.
Previously, we learned about the two types of user interfaces:
the GUI and the CLI.
You can think of the shell as a CLI.
Another element of the architecture of Linux is the Filesystem Hierarchy Standard, or FHS. It's the component of the Linux OS that organizes data.
An easy way for you to think about the FHS is to think about it as a filing cabinet of data.
The FHS is how data is stored in a system.
It's a way to organize data so that it can be found when the data is accessed by the system.
That brings us to the kernel.
The kernel is a component of the Linux OS that manages processes and memory.
The kernel communicates with the hardware to execute the commands sent by the shell.
The kernel uses drivers to enable applications to execute tasks.
The Linux kernel helps ensure that the system allocates resources more efficiently and makes the system work faster.
Finally, the last component of the architecture is the hardware.
Hardware refers to the physical components of a computer.
You can compare this to software applications which can be downloaded into a system.
The hardware in your computer are things like the CPU, mouse, and keyboard.
Congratulations!
We've now covered the architecture of Linux.
An understanding of these components will help you become increasingly familiar with Linux.
# Linux architecture explained
Understanding the Linux architecture is important for a security analyst. When you understand how a system is organized, it makes it easier to understand how it functions. In this reading, you’ll learn more about the individual components in the Linux architecture. A request to complete a task starts with the user and then flows through applications, the shell, the Filesystem Hierarchy Standard, the kernel, and the hardware.
## User
The **user** is the person interacting with a computer. They initiate and manage computer tasks. Linux is a multi-user system, which means that multiple users can use the same resources at the same time.
## Applications
An **application** is a program that performs a specific task. There are many different applications on your computer. Some applications typically come pre-installed on your computer, such as calculators or calendars. Other applications might have to be installed, such as some web browsers or email clients. In Linux, you'll often use a package manager to install applications. A **package manager** is a tool that helps users install, manage, and remove packages or applications. A **package** is a piece of software that can be combined with other packages to form an application.
## Shell
The **shell** is the command-line interpreter. Everything entered into the shell is text based. The shell allows users to give commands to the kernel and receive responses from it. You can think of the shell as a translator between you and your computer. The shell translates the commands you enter so that the computer can perform the tasks you want.
## Filesystem Hierarchy Standard (FHS)
The **Filesystem Hierarchy Standard (FHS)** is the component of the Linux OS that organizes data. It specifies the location where data is stored in the operating system.
A **directory** is a file that organizes where other files are stored. Directories are sometimes called “folders,” and they can contain files or other directories. The FHS defines how directories, directory contents, and other storage is organized so the operating system knows where to find specific data.
## Kernel
The **kernel** is the component of the Linux OS that manages processes and memory. It communicates with the applications to route commands. The Linux kernel is unique to the Linux OS and is critical for allocating resources in the system. The kernel controls all major functions of the hardware, which can help get tasks expedited more efficiently.
## Hardware
The **hardware** is the physical components of a computer. You might be familiar with some hardware components, such as hard drives or CPUs. Hardware is categorized as either peripheral or internal.
### **Peripheral devices**
**Peripheral devices** are hardware components that are attached and controlled by the computer system. They are not core components needed to run the computer system. Peripheral devices can be added or removed freely. Examples of peripheral devices include monitors, printers, the keyboard, and the mouse.
### **Internal hardware**
**Internal hardware** are the components required to run the computer. Internal hardware includes a main circuit board and all components attached to it. This main circuit board is also called the motherboard. Internal hardware includes the following:
- The **Central Processing Unit (CPU)** is a computer’s main processor, which is used to perform general computing tasks on a computer. The CPU executes the instructions provided by programs, which enables these programs to run.
- **Random Access Memory (RAM)** is a hardware component used for short-term memory. It’s where data is stored temporarily as you perform tasks on your computer. For example, if you’re writing a report on your computer, the data needed for this is stored in RAM. After you’ve finished writing the report and closed down that program, this data is deleted from RAM. Information in RAM cannot be accessed once the computer has been turned off. The CPU takes the data from RAM to run programs.
- The **hard drive** is a hardware component used for long-term memory. It’s where programs and files are stored for the computer to access later. Information on the hard drive can be accessed even after a computer has been turned off and on again. A computer can have multiple hard drives.
## Key takeaways
It’s important for security analysts to understand the Linux architecture and how these components are organized. The components of the Linux architecture are the user, applications, shell, Filesystem Hierarchy Standard, kernel, and hardware. Each of these components is important in how Linux functions.
# Linux distributions
Let's learn a little bit more about Linux and what you need to know about this operating system when working as a security analyst.
Linux is a very customizable operating system.
Unlike other operating systems, there are different versions available for you to use.
These different versions of Linux are called distributions.
You might also hear them called distros or flavors of Linux.
It's essential for you to understand the distribution that you're using so you know what tools and apps are available to you.
For example, Debian is a distro that has different tools than the Ubuntu distribution.
Let's use an analogy to describe Linux distributions.
Think of the OS as a vehicle.
First, we'll start with its engine—that would be the kernel. Just as the engine makes a vehicle run, the kernel is the most important component of the Linux OS.
Because the Linux kernel is open source, anyone can take the kernel and modify it to build a new distribution.
This is comparable to a vehicle manufacturer taking an engine and creating different types of vehicles: trucks, cars, vans, convertibles, busses, airplanes, and so on.
These different types of vehicles can be compared to different Linux distributions.
A bus is used to transport lots of people.
A truck is used to transport a large number of goods across vast distances.
An aircraft transports passengers or goods by air.
Just as each vehicle serves its own purpose, different distributions are used for different reasons.
Additionally, vehicles all have different components which distinguish them from each other.
Aircrafts have control panels with buttons and knobs.
Regular cars have four tires, but trucks can have more.
Similarly, different Linux distributions contain different preinstalled programs, user interfaces, and much more.
A lot of this is based on what the Linux user needs, but some distros are also chosen based on preference—the same way a sports car might be chosen as a vehicle.
The advantage of using Linux as an OS is that you can customize it.
Distributions include the Linux kernel, utilities, a package management system, and an installer.
We learned earlier that Linux is open source, and anyone can contribute to adding to the source code.
That is how new distributions are created.
All distros are derived from another distro, but there are a few that are considered parent distributions.
Red Hat® is the parent of CentOS, and Slackware® is the parent of SUSE®.
Both Ubuntu and KALI LINUX™ are derived from Debian.
As we continue, we're going to take a look at some of the distributions most commonly used by security analysts.
The more you understand these distributions, the easier your work will be.
# KALI LINUX ™
In this section, we're going to cover a Linux distribution that's widely used in security and discuss KALI LINUX™.
KALI LINUX™ is a trademark of Offensive Security and is Debian derived.
This open-source distro was made specifically with penetration testing and digital forensics in mind.
There are many tools pre-installed into KALI LINUX™.
It's important to note that KALI LINUX™ should be used on a virtual machine.
This prevents damage to your system in the event its tools are used improperly.
An additional benefit is that using a virtual machine gives you the ability to revert to a previous state.
As security professionals advance in their careers, some specialize in penetration testing.
A penetration test is a simulated attack that helps identify vulnerabilities in systems, networks, websites, applications, and processes.
KALI LINUX™ has numerous tools that are useful during penetration testing.
Let's look at a few examples.
To begin, Metasploit can be used to look for and exploit vulnerabilities on machines.
Burp Suite is another tool that helps to test for weaknesses in web applications.
And finally, John the Ripper is a tool used to guess passwords.
As a security analyst, your work might involve digital forensics.
Digital forensics is the process of collecting and analyzing data to determine what has happened after an attack.
For example, you might take an investigative look at data related to network activity.
KALI LINUX™ is also a useful distribution for security professionals who are involved in digital forensic work.
It has a large number of tools that can be used for this. As one example, tcpdump is a command-line packet analyzer. It's used to capture network traffic.
Another tool commonly used in the security profession is Wireshark.
It has a graphical user interface that can be used to analyze live and captured network traffic.
And as a final example, Autopsy is a forensic tool used to analyze hard drives and smartphones.
These are just a few tools included with KALI LINUX™.
This distribution has many tools used to conduct pen testing and digital forensics.
We've explored how KALI LINUX™ is an important distribution that's widely used in security, but there are other distributions that security professionals use as well.
Next we'll explore a few more distributions.
quick note from the student.. the course says to use it on a VM, however you can use it as your own flavor of Linux for your desktop. its not recommended unless you know what you are doing or willing to wipe the machine :p
# More Linux distributions
Previously, you were introduced to the different distributions of Linux. This included KALI LINUX ™. (KALI LINUX ™ is a trademark of OffSec.) In addition to KALI LINUX ™, there are multiple other Linux distributions that security analysts should be familiar with. In this reading, you’ll learn about additional Linux distributions.
## KALI LINUX ™
**KALI LINUX ™** is an open-source distribution of Linux that is widely used in the security industry. This is because KALI LINUX ™, which is Debian-based, is pre-installed with many useful tools for penetration testing and digital forensics. A **penetration test** is a simulated attack that helps identify vulnerabilities in systems, networks, websites, applications, and processes. **Digital forensics** is the practice of collecting and analyzing data to determine what has happened after an attack. These are key activities in the security industry.
However, KALI LINUX ™ is not the only Linux distribution that is used in cybersecurity.
## Ubuntu
**Ubuntu** is an open-source, user-friendly distribution that is widely used in security and other industries. It has both a command-line interface (CLI) and a graphical user interface (GUI). Ubuntu is also Debian-derived and includes common applications by default. Users can also download many more applications from a package manager, including security-focused tools. Because of its wide use, Ubuntu has an especially large number of community resources to support users.
Ubuntu is also widely used for cloud computing. As organizations migrate to cloud servers, cybersecurity work may more regularly involve Ubuntu derivatives.
## Parrot
**Parrot** is an open-source distribution that is commonly used for security. Similar to KALI LINUX ™, Parrot comes with pre-installed tools related to penetration testing and digital forensics. Like both KALI LINUX ™ and Ubuntu, it is based on Debian.
Parrot is also considered to be a user-friendly Linux distribution. This is because it has a GUI that many find easy to navigate. This is in addition to Parrot’s CLI.
## Red Hat® Enterprise Linux®
**Red Hat Enterprise Linux** is a subscription-based distribution of Linux built for enterprise use. Red Hat is not free\*, which is a major difference from the previously mentioned distributions. Because it’s built and supported for enterprise use, Red Hat also offers a dedicated support team for customers to call about issues.
with my personal experience, you can use RHEL9 for personal use. also as of July of 2023, its parent company may be trying to break copyright law by limiting access to source code, and close sourcing the project. if they succeed many other distros might die or become less secure or die, like centOS. I likely wont update this but you can google it yourself to see how that went.
## CentOS
**CentOS** is an open-source distribution that is closely related to Red Hat. It uses source code published by Red Hat to provide a similar platform. However, CentOS does not offer the same enterprise support that Red Hat provides and is supported through the community.
p.s. CentOS may be dead because its parent company is trying to kill it at the time of posting this page, google it to see if it has died LOL
### Arch Linux
**Arch Linux** is an open-source distribution known for its simplicity and user-focused design. It adheres to the "Keep It Simple, Stupid" (KISS) principle, offering a minimal base system that users can customize to their needs, reducing potential security risks, provides more control over the system, rolling-release model ensures up-to-date security updates.
A key feature is the Arch User Repository (AUR), a community-driven repository that lets users compile and install packages from source using the Arch package manager, pacman.
## Key takeaways
KALI LINUX ™, Ubuntu, Parrot, Red Hat, and CentOS are all widely used Linux distributions. It’s important for security analysts to be aware of these distributions that they might encounter in their career.
# Package managers for installing applications
Previously, you learned about Linux distributions and that different distributions derive from different sources, such as Debian or Red Hat Enterprise Linux distribution. You were also introduced to package managers, and learned that Linux applications are commonly distributed through package managers. In this reading, you’ll apply this knowledge to learn more about package managers.
## Introduction to package managers
A **package** is a piece of software that can be combined with other packages to form an application. Some packages may be large enough to form applications on their own.
Packages contain the files necessary for an application to be installed. These files include dependencies, which are supplemental files used to run an application.
Package managers can help resolve any issues with dependencies and perform other management tasks. A **package manager** is a tool that helps users install, manage, and remove packages or applications. Linux uses multiple package managers.
**Note:** It’s important to use the most recent version of a package when possible. The most recent version has the most up-to-date bug fixes and security patches. These help keep your system more secure.
## Types of package managers
Many commonly used Linux distributions are derived from the same parent distribution. For example, KALI LINUX ™, Ubuntu, and Parrot all come from Debian. CentOS comes from Red Hat.
This knowledge is useful when installing applications because certain package managers work with certain distributions. For example, the Red Hat Package Manager (RPM) can be used for Linux distributions derived from Red Hat, and package managers such as dpkg can be used for Linux distributions derived from Debian.
Different package managers typically use different file extensions. For example, Red Hat Package Manager (RPM) has files which use the .rpm file extension, such as Package-Version-Release\_Architecture.rpm. Package managers for Debian-derived Linux distributions, such as dpkg, have files which use the .deb file extension, such as Package\_Version-Release\_Architecture.deb.
## Package management tools
In addition to package managers like RPM and dpkg, there are also package management tools that allow you to easily work with packages through the shell. Package management tools are sometimes utilized instead of package managers because they allow users to more easily perform basic tasks, such as installing a new package. Two notable tools are the Advanced Package Tool (APT) and Yellowdog Updater Modified (YUM).
### **Advanced Package Tool (APT)**
APT is a tool used with Debian-derived distributions. It is run from the command-line interface to manage, search, and install packages.
### **Yellowdog Updater Modified (YUM)**
YUM is a tool used with Red Hat-derived distributions. It is run from the command-line interface to manage, search, and install packages. YUM works with .rpm files.
## Key takeaways
A package is a piece of software that can be combined with other packages to form an application. Packages can be managed using a package manager. There are multiple package managers and package management tools for different Linux distributions. Package management tools allow users to easily work with packages through the shell. Debian-derived Linux distributions use package managers like dpkg as well as package management tools like Advanced Package Tool (APT). Red Hat-derived distributions use the Red Hat Package Manager (RPM) or tools like Yellowdog Updater Modified (YUM).
# Vanilla os
i came accross vanilla os in a yt video and it appears to be realy interesting. i quite like gnome as a base and im thinking this is potentially one of the best options in the future if they stick with it. also theres only two updates per year and a roling release but you have to manually enable rolling releases
tl;dr
its stable asf, and you can run any app on it!
**Vanilla OS: A Unique Solution to Distro Hopping and the Future of Software Installation**
Vanilla OS is a Linux distribution that aims to resolve the common practice of distro hopping. This term refers to the habit among Linux users of switching between different Linux distributions to find the perfect balance of stability, hardware support, and application access. Vanilla OS offers all these features within a single, highly stable base.
What sets Vanilla OS apart is its approach to software installation. It introduces 'apx', a package manager that allows software installation from any source by installing them onto distro containers. This means that Vanilla OS can run virtually any software developed for Linux, effectively addressing the issue of distro packaging fragmentation. This unique combination of features positions Vanilla OS as a potential game-changer in the Linux ecosystem.
**Intuitive User Experience**
Vanilla OS prioritizes user-friendliness in its design. The intuitive installer guides users through the necessary steps, and post-installation, users can customize their experience, choosing between dark and light mode, enabling support for Flatpak and AppImage, and selecting their preferred apps. This user-centric approach makes Vanilla OS accessible to both beginners and technically inclined users.
**Immutability and Atomicity: Enhancing Security and Stability**
One of the distinguishing features of Vanilla OS is its immutable and atomic nature. The base system is locked down, preventing both applications and users from writing to it, except for certain directories like the home folder or partition and the /etc and /var directories. This design principle significantly bolsters the system's security.
Updates in Vanilla OS are applied atomically, meaning each update either completes successfully or, if any issue arises, the entire operation is reverted, leaving the system unaltered. This ensures that any reboot will either return the system to its previous state or update it successfully.
**Is Vanilla OS the Future of Linux Distributions?**
Vanilla OS represents a promising concept that could potentially shape the future of Linux distributions. It provides access to virtually all Linux-developed software at native speeds within a highly stable base. However, it's not a one-size-fits-all solution. Users who only need software from FlatHub may not require Vanilla OS, and those unfamiliar with the command line or the concept of containers might find it challenging to use. However, with further development, such as a graphical layer on 'apx' for intuitive software installation from containers, Vanilla OS could become an optimal solution for users seeking extensive software access without compromising system stability
for anyone who cares this one was written with ai, modified by me...
# Nix OS
make page on nix os, alternative to vanilla os?
# Resources for completing Linux labs
This course features hands-on lab activities where you’ll have the opportunity to practice Linux commands in the terminal. You’ll use a platform called Qwiklabs to complete these labs. In this reading, you’ll learn how to use Qwiklabs.
This reading first provides a section on how to use Qwiklabs, which includes details on how to launch a lab, how to interact within the Qwiklabs environment, and how to end a lab. This is followed by another section on helpful navigation tips and keyboard shortcuts; these may be useful when working in the terminal.
**Note**: You will not launch Qwiklabs directly from this reading and instead will do this through lab activities and exemplars that you encounter throughout the course. Im not posting the Qwiklabs, this is just how to use Qwiklabs, and if you use Qwiklabs thats on you.
## How to use Qwiklabs
### **Launching Qwiklabs**
When you select a lab, you start from a Coursera page. You will need to click **Launch App** on that page. After you click **Launch App**, a new tab will open with a Qwiklabs page that contains instructions for that particular lab.
### **Start Lab button**
On the Qwiklabs page, you must click **Start Lab** to open a temporary terminal. The instructions for the lab will move to the right side of the screen.
Read the instructions and complete all the tasks in the lab by entering commands in the terminal.
**Note**: It may take a moment for the terminal to start.
### **Lab control dialog box**
After you click **Start Lab**, the lab control dialog box opens. It contains the **End Lab** button, the **timer**, and the **Open Linux Console** button.
You can hide or unhide the dialog box by clicking the following icon in the red box:
### **The timer**
The **timer** starts when the terminal has loaded. The timer keeps track of the amount of time you have left to complete a lab. The timer counts down until it reaches 00:00:00. When it does, your temporary terminal and resources are deleted.
You will have ample time to complete the labs. But, stay focused on completing the tasks to ensure you use your time well.
### **Open Linux Console button**
When you click the button to **Open Linux Console**, the terminal opens in a new browser window:
Use this feature if you want a full-screen view of the terminal. You can close this window at any time. Closing the window does not end your lab, and you can continue working in the terminal in the original tab.
### **Check progress**
You can check your progress by clicking **Check my progress** at the end of each task.
If you haven’t yet completed a task, you’ll receive hints on what you must do to complete it.
You can click **Check my progress** whenever you want to check the completion status of a task or receive a hint.
### **Using copy/paste commands**
The first time you try to use copy or paste keyboard shortcuts (such as **CTRL + C**), you’ll receive a pop-up requesting permission to use your device’s clipboard: “**googlecoursera.qwiklabs.com wants to see text and images copied to the clipboard.**” Please click **Allow** if you would like to be able to use these shortcuts in the Qwiklabs platform. If you choose not to allow Qwiklabs access to your clipboard, you cannot use keyboard shortcuts but you can still complete the lab.
### **Code block**
Certain steps may include a code block. Click the copy button to copy the code provided and then paste it into the terminal.
To paste code or other text content that you have copied from the instructions into the terminal, activate the terminal by clicking anywhere inside it. The terminal is active when the cursor in the terminal changes from a static empty outline to a flashing solid block.
Once the terminal is active, use the keyboard shortcut **CTRL + V** (hold down the **CTRL** key and press the **V** key) to insert the copied text into the terminal at the location of the flashing cursor.
### **Scrolling**
In certain situations, you may want to scroll within the terminal window. To do so, use the scroll wheel on your mouse or the touchpad of your computer.
### **End Lab button**
Finally, click **End Lab** when you’ve completed the tasks in the lab.
**Note**: Don't click **End Lab** until you're finished; you'll lose access to the work you've done throughout the lab.
### **Tracking progress on Coursera**
If you complete a lab but your progress hasn’t been tracked on Coursera, you may need to refresh the page for your progress to be registered. Once you complete the lab and refresh the page, the green check mark should appear.
## Helpful navigation tips and keyboard shortcuts
The following contains a list of navigation tips and keyboard shortcuts you may find useful when completing your Linux labs. Your cursor must be in the terminal window to use these navigation tips and keyboard shortcuts.
- CTRL + C: Terminates a command that is currently running; from the instructions portion of Qwiklabs, you can use CTRL + C to copy, but within the terminal, it will only terminate a command and if one isn't running, it will display ^C at the prompt
- CTRL + V: Pastes text
- clear: Clears the terminal screen; this can also be done by entering CTRL + L
- CTRL + A: Sets your cursor at the beginning of a command
- CTRL + E: Sets your cursor at the end of a command
- Left arrow **key**: Moves left within a command
- Right arrow **key**: Moves right within a command
- Up arrow **key**: Provides the last command you entered into the command line; can be entered multiple times to go through multiple commands from the command history
- Down arrow **key**: Provides the next command in the command history; must be after using the up arrow key
- Tab **key**: Provides available suggestions for completing your text
## Key takeaways
Knowing how to navigate Qwiklabs will be useful as you complete the labs throughout this course. These labs can help you practice what you’ve learned in an interactive environment.
# Introduction to the shell
Welcome back! In this video, we're going to discuss the Linux shell.
This part of the Linux architecture is where the action will happen for you as a security analyst.
We introduced the shell with other components of the Linux OS earlier, but let's take a deeper look at what the shell is and what it does.
The shell is the command-line interpreter.
That means it helps you communicate with the operating system through the command line.
Previously, we discussed a command-line interface.
This is essentially the shell.
The shell provides the command-line interface for you to interact with the OS.
To tell the OS what to do, you enter commands into this interface.
A command is an instruction telling the computer to do something.
The shell communicates with the kernel to execute these commands.
Earlier, we discussed how the operating system helps humans and computers speak with each other.
The shell is the part of the OS that allows you to do this.
Think of this as a very helpful language interpreter between you and your system.
Since you do not speak computer language or binary, you can't directly communicate with your system.
This is where the shell comes in to help you.
Your OS doesn't need the shell for most of its work, but it is an interface between you and what your system can offer.
It allows you to perform math, run tests, and execute applications.
More importantly, it allows you to combine these operations and connect applications to each other to perform complex and automated tasks.
Just as there are many Linux distributions, there are many different types of shells.
We'll primarily focus on the Bash shell in this course.
Let's continue to learn more about the shell.
# Different types of shells
Knowing how to work with Linux shells is an important skill for cybersecurity professionals. Shells can be used for many common tasks. Previously, you were introduced to shells and their functions. This reading will review shells and introduce you to different types, including the one that you'll use in this course.
## Communicate through a shell
As you explored previously, the **shell** is the command-line interpreter. You can think of a shell as a translator between you and the computer system. Shells allow you to give commands to the computer and receive responses from it. When you enter a command into a shell, the shell executes many internal processes to interpret your command, send it to the kernel, and return your results.
## Types of shells
The many different types of Linux shells include the following:
- Bourne-Again Shell (bash)
- C Shell (csh)
- Korn Shell (ksh)
- Enhanced C shell (tcsh)
- Z Shell (zsh)
- PowerShell (by microsoft also on windows)
All Linux shells use common Linux commands, but they can differ in other features. For example, ksh and bash use the dollar sign ($) to indicate where users type in their commands. Other shells, such as zsh, use the percent sign (%) for this purpose.
## Bash
**Bash** is the default shell in most Linux distributions. It’s considered a user-friendly shell. You can use bash for basic Linux commands as well as larger projects.
Bash is also the most popular shell in the cybersecurity profession. You’ll use bash throughout this course as you learn and practice Linux commands.
## Key takeaways
Shells are a fundamental part of the Linux operating system. Shells allow you to give commands to the computer and receive responses from it. They can be thought of as a translator between you and your computer system. There are many different types of shells, but the bash shell is the most commonly used shell in the cybersecurity profession. You’ll learn how to enter Linux commands through the bash shell later in this course.
# Input and output in the shell
Hello again! In this video, we're going to learn a little more about the shell and how to communicate with it.
Communicating with a computer is like having a conversation with your friend.
One person asks a question and the other person answers with a response.
If you don't know the answer, you can just say you don't know the answer.
When you communicate with the shell, the commands in the shell can take input, give output, or give error messages.
Let's explore standard input, standard output, and error messages in more detail.
Standard input consists of information received by the OS via the command line.
This is like you asking your friend a question during a conversation.
The information is input from your keyboard to the shell.
If the shell can interpret your request, it asks the kernel for the resources it needs to execute the related task.
Let's take a look at this through echo, a Linux command that outputs a specified string of text.
String data is data consisting of an ordered sequence of characters.
In our example, we'll just have it output the string of: hello.
So, as input, we'll type: echo hello into the shell.
Later, when we press enter, we'll get the output.
But before we do that, let's first discuss the concept of output in more detail.
Standard output is the information returned by the OS through the shell.
In the same way that your friend gives an answer to your question, output is a computer's response to the command you input.
Output is what you receive.
Let's pick up where we left off in our example and send the input of: echo hello to the OS by pressing enter.
Immediately, the shell returns the output of: hello.
Finally, standard error contains error messages returned by the OS through the shell.
Just like your friend might indicate that they can't answer a question, the system responds with an error message if they can't respond to your command.
Sometimes this might occur when we misspell a command or the system doesn't know the response to the command.
Other times, it might happen because we don't have the appropriate permissions to perform a command.
We'll explore another example that demonstrates standard error.
Let's input: eco hello into the shell. Notice I intentionally misspelled echo as e-c-o.
When we press enter, an error message appears.
To wrap up, we've covered the basics of communication with the shell.
Communication with the shell can only go in one of three ways: the system receives a command—this is input;
the system responds to the command and produces output;
and finally, the system doesn't know how to respond, resulting in an error.
Later, you'll become much more familiar with this as we explore commands useful for security professionals.
# Linux basics Wrap-up; Glossary terms from week 2
We've made it to the end of this section.
Great work!
Let's recap what you've just completed.
In this section, you learned about the Linux operating system.
We examined the architecture of Linux.
In our exploration of the different distributions of Linux, we discussed some of the most widely used distros in security.
You were introduced to KALI LINUX™, Ubuntu, Parrot, Red Hat, and CentOS distributions.
Finally, you learned about the shell and its role as an interpreter between the user and operating system.
Congratulations! You're doing great, and we have more useful topics to come.
In the next part of the program, you'll learn specific commands to use within the shell while working as a security analyst.
Let's continue on.
---
## Terms and definitions from Course 4, Week 2
**Application:** A program that performs a specific task
**Bash:** The default shell in most Linux distributions
**CentOS:** An open-source distribution that is closely related to Red Hat
**Central Processing Unit (CPU):** A computer’s main processor, which is used to perform general computing tasks on a computer
**Command:** An instruction telling the computer to do something
**Digital forensics:** The practice of collecting and analyzing data to determine what has happened after an attack
**Directory:** A file that organizes where other files are stored
**Distributions:** The different versions of Linux
**File path:** The location of a file or directory
**Filesystem Hierarchy Standard (FHS):** The component of the Linux OS that organizes data
**Graphical user interface (GUI):** A user interface that uses icons on the screen to manage different tasks on the computer
**Hard drive:** A hardware component used for long-term memory
**Hardware**: The physical components of a computer
**Internal hardware:** The components required to run the computer
**Kali Linux ™**: An open-source distribution of Linux that is widely used in the security industry
**Kernel:** The component of the Linux OS that manages processes and memory
**Linux:** An open source operating system
**Package:** A piece of software that can be combined with other packages to form an application
**Package manager:** A tool that helps users install, manage, and remove packages or applications
**Parrot:** An open-source distribution that is commonly used for security
**Penetration test (pen test):** A simulated attack that helps identify vulnerabilities in systems, networks, websites, applications, and processes
**Peripheral devices:** Hardware components that are attached and controlled by the computer system
**Random Access Memory (RAM):** A hardware component used for short-term memory
**Red Hat® Enterprise Linux®** (also referred to simply as Red Hat in this course)**:** A subscription-based distribution of Linux built for enterprise use
**Shell:** The command-line interpreter
**Standard error:** An error message returned by the OS through the shell
**Standard input:** Information received by the OS via the command line
**Standard output:** Information returned by the OS through the shell
**String data:** Data consisting of an ordered sequence of characters
**Ubuntu:** An open-source, user-friendly distribution that is widely used in security and other industries
**User:** The person interacting with a computer
# stories
# Phil: Learn and grow in the cybersecurity field
Hi, I'm Phil I'm the Chief Information Security Officer for Google Cloud, and a big part of that is, of course, cybersecurity.
So, in cyber you've always got to learn, you've always got to stay up to date for the simple reason that technology and business and the world of our, kind of digital lives is just always changing.
The online services that you use today are probably very different even just when what they were 12 months ago.
In the mid '90s, I worked on one of the world's first internet banking systems.
And essentially we were building and coding all of the security ourselves.
I remember working on the first web browsers, the first web servers, the first implementations of encryption on the Internet.
This was even before Google even existed.
And so this was the very beginning of the Internet and we were literally kind of assembling and building this and learning how to do it as we went along.
When you are first getting into cybersecurity, it's important to not get overwhelmed.
It's a very big space.
And all of us started off at where you are today.
And we had to learn into that.
At one point, I didn't know Linux, I didn't know how to program.
I didn't know various parts of other operating systems.
And I had to learn step-by-step, how all of that worked and gradually build up that knowledge over time.
And even now I still have to look things up occasionally because I don't keep everything in my head all at once and that's totally fine.
When you're approaching a new situation, you're always going to have a degree of anxiety about whether you're going to be
able to learn it quickly enough. And generally, with enough experience, you're gradually comfortable that you will.
But again, this is important to remember that you don't have to learn everything about everything all at once.
Most of the time you learn enough to be enough of value in the initial part of the process, then you learn as you go.
Start off by writing a few lines of simple code or looking at somebody else's code and trying to understand what it does and then change it a little bit and just incrementally work into this.
Build that foundation of knowledge that gives you the ability to learn other things, and I think things will stem from that.
# linux basics part 2; electric boogalooo
# Welcome to week 3; Linux commands via bash the bourne-again shell
Learning to communicate in a new way can be exciting.
Maybe you've learned a new language and can remember this feeling.
Perhaps a lot of us share this excitement with young children as they are expanding their vocabulary.
Others, including me, remember a sense of wonder when we first used a specialized language to communicate with their computer.
In this section, we'll continue to learn more about Linux and how to communicate with the OS through its shell.
You'll utilize the command line to communicate with the OS.
You'll learn how to input commands in the shell and learn about some of the core Linux commands that you'll use as a security analyst.
Specifically, this includes navigating and managing the file system.
You'll also focus on authenticating and authorizing users.
This means you'll be able to use a command line to add and delete users from the system and to control what they have access to.
Finally, there's always more to learn.
We'll cover accessing resources that support learning new Linux commands.
I remember when I first learned about the command line and was shocked at the capabilities it provided.
I didn't need to click through multiple screens to get tasks done.
Although it took some practice and time to get used to, it has been one of the biggest tools at my disposal.
After this section, you'll have a practical experience in an area important to the work of a security analyst: using Linux commands.
---
Welcome back. Before we get into specific Linux commands, let's explore in more detail the basics of communicating with the OS through the shell.
Being able to utilize Linux commands is a foundational skill for all security professionals.
As a security analyst, you will work with server logs and you'll need to know how to navigate, manage and analyze files
remotely without a graphical user interface.
In addition, you'll need to know how to verify and configure users and group access.
You'll also need to give authorization and set file permissions.
That means that developing skills with the command line is essential for your work as a security analyst.
When we learned about the Linux architecture, we learned that the shell is one of the main components of an operating system.
We also learned that there are different shells.
In this section, we'll utilize the Bash shell.
Bash is the default shell in most Linux distributions.
For the most part, the key Linux commands that you'll be learning in this section are the same across shells.
Now that you know what shell you'll be using, let's go into how to write in Bash.
As we discussed in a previous section, communicating with your OS is like a conversation.
You type in commands, and the OS responds with an answer to your command.
A command is an instruction telling the computer to do something.
We'll try out a command in Bash.
Notice a dollar sign before the cursor.
This is your prompt to enter a new command.
Some commands might tell the computer to find something like a specific file.
Others might tell it to launch a program.
Or, it might be to output a specific string of text.
In the last section, when we discussed input and output, we explored how the echo command did this.
Let's input the echo command again.
You may notice that the command we just input is not complete.
If we're going to use the echo command to output a specific string of texts, we need to specify what the string of text is.
This is what arguments are for.
An argument is specific information needed by a command.
Some commands take multiple arguments.
So now let's complete the echo command with an argument.
We're learning some pretty technical stuff, so how about we output the words: "You are doing great!"
We'll add this argument, and then we'll press enter to get the output.
In this example, our argument was a string of text.
Arguments can provide other types of information as well.
One thing that is really important in Linux is that all commands and arguments are case sensitive.
This includes file and directory names.
Keep that in mind as you learn more about how to use Linux in your day-to-day tasks as a security analyst.
Okay, now that we've covered the basics of entering Linux commands and arguments through the Bash shell, we're ready to learn some specific commands.
This is exciting, so let's get to our next video!
# Portfolio Activity: Use Linux commands to manage file permissions
#
Quiz30 minutes • 30 min
### Submit your assignment
DueJuly 23, 11:59 PM EDTJul 23, 11:59 PM EDT
### Receive grade
To Pass80% or higher
### Your grade
-Not available
# Portfolio Activity: Use Linux commands to manage file permissions
Graded Quiz. • 30 min. • 8 total points available.8 total points
DueJul 23, 11:59 PM EDT
To pass this course item, you must complete the activity and receive at least 80%, or 7 out of 8 points, on the questions that follow. Once you have completed the activity and questions, review the feedback provided. You can learn more about graded and practice items in the [course overview](https://www.coursera.org/learn/linux-and-sql/supplement/rUv9P/course-4-overview)
In this activity, you will create a new portfolio document to demonstrate your experience using Linux commands to manage file permissions. You can add this document to your cybersecurity portfolio, which you can share with prospective employers or recruiters. To review the importance of building a professional portfolio and options for creating your portfolio, read [Create a cybersecurity portfolio](https://www.coursera.org/learn/linux-and-sql/resources/wDFrc)
.
To create your portfolio document, you will review a scenario and follow a series of steps. This scenario is connected to [the lab](https://www.coursera.org/learn/linux-and-sql/ungradedLti/483Kl/activity-manage-authorization)
you have just completed about how to examine and manage file permissions. You will explain the commands you used in that lab, and this will help you prepare for future job interviews and other steps in the hiring process.
Be sure to complete this activity and answer the questions that follow before moving on. The next course item will provide you with a completed exemplar to compare to your own work.
## Scenario
Review the scenario below. Then, complete the step-by-step instructions.
You are a security professional at a large organization. You mainly work with their research team. Part of your job is to ensure users on this team are authorized with the appropriate permissions. This helps keep the system secure.
Your task is to examine existing permissions on the file system. You’ll need to determine if the permissions match the authorization that should be given. If they do not match, you’ll need to modify the permissions to authorize the appropriate users and remove any unauthorized access.
**Note:** This scenario involves investigating and updating the same file permissions as the ones in the [Manage authorization](https://www.coursera.org/learn/linux-and-sql/ungradedLti/483Kl/activity-manage-authorization)
lab. You can revisit the lab to get screenshots to include in your portfolio document. If you choose, it's also possible to complete this activity without revisiting the lab by typing your commands in the template.
## Step-By-Step Instructions
Follow the instructions to complete each step of the activity. Then, answer the 8 questions at the end of the activity before going to the next course item to compare your work to a completed exemplar.
### Step 1: Access the template
To use the template for this course item, click the following link and select *Use Template*. (In this step, you will just open the template. More instructions for how to use the template will be included in later steps.)
Link to template: [File permissions in Linux](https://docs.google.com/document/d/1A3xiUi9wbXf5lGvRwm8oFsXq18Q8mP7FUDNndjj89zc/template/preview?usp=sharing)
OR
If you don’t have a Google account, you can download the template directly from the following attachment.
The following supporting materials will help you complete this activity. Keep them open as you proceed to the next steps.
To use the supporting materials for this course item, click the links.
The **Instructions for including Linux commands** document provides instructions and best practices for including samples of Linux commands in your portfolio activity.
Link to supporting material: [Instructions for including Linux commands](https://docs.google.com/document/d/1t-9o-bPndpOIh9577FJobiakS10kJxgIKrB6GG7EPwA/template/preview?usp=sharing&resourcekey=0-623w2JztdmNSu3nDbsQJcQ)
The **Current file permissions** document demonstrates how the file structure is built for this portfolio activity. The file permissions for each file or directory are also provided.
Link to supporting material: [Current file permissions](https://docs.google.com/document/d/1F3-8XQZsNagSzTkJwFzOGY5OHbGbMRtlb8GbmXE_gCc/template/preview?usp=sharing&resourcekey=0-UUEu0EyFFvMf0SAipcel6w)
**Note**: It is recommended that you use the **Manage authorization** lab to complete this portfolio activity. If you’re revisiting the lab, using the **Current file permissions** document is optional because this file structure has already been created for you.
OR
If you don’t have a Google account, you can download the supporting materials directly from the following attachments.
In the **Manage authorization** lab, check the permissions set for files and subdirectories in the projects directory. Make sure you display all permissions, including hidden files. Or, use the content of [**Current file permissions**](https://docs.google.com/document/d/1F3-8XQZsNagSzTkJwFzOGY5OHbGbMRtlb8GbmXE_gCc/template/preview?usp=sharing&resourcekey=0-UUEu0EyFFvMf0SAipcel6w)
document to determine the current permissions.
Describe the command you can use to check permissions in the **Check file and directory details** section of the **File permissions in Linux** template. From the lab, take a screenshot of the Linux command you used. Or, type this command directly into the template.
Then, use either the output of this command in the lab or the content or the **Current file permissions** document to indicate the current permissions. If using the **Current file permissions** document, write these in the 10-character string that would be part of the command's output.
Choose one example from the output in the previous step. In the **Describe the permissions string** section of the **File permissions in Linux** template, write a short description that explains the 10-character string in the example. You should describe what the 10-character string is for and what each character represents.
The organization does not allow other to have write access to any files. Based on the permissions established in Step 3, identify which file needs to have its permissions modified. Use a Linux command to modify these permissions.
Describe the command you used and its output in the **Change file permissions** section of the **File permissions in Linux** template. In the **Manage authorization** lab, take a screenshot of the Linux command you used. Or, type this command directly into the template.
The research team has archived .project\_x.txt, which is why it’s a hidden file. This file should not have write permissions for anyone, but the user and group should be able to read the file. Use a Linux command to assign .project\_x.txt the appropriate authorization.
Describe the command you used and its output in the **Change file permissions on a hidden file** section of the **File permissions in Linux** template. In the **Manage authorization** lab, take a screenshot of the Linux command you used. Or, type this command directly into the template.
The files and directories in the projects directory belong to the researcher2 user. Only researcher2 should be allowed to access the drafts directory and its contents. Use a Linux command to modify the permissions accordingly.
Describe the command you used and its output in the **Change directory permissions** section of the **File permissions in Linux** template. In the **Manage authorization** lab, take a screenshot of the Linux command you used. Or, type this command directly into the template.
To finalize the document and make its purpose clear to potential employers, be sure to complete the **Project description** and **Summary** sections of the **File permissions in Linux** template.
In the Project description section, give a general overview of the scenario and what you accomplish through Linux. Write two to four sentences.
In the Summary section, provide a short summary of the previous tasks and connect them to the scenario. Write approximately two to four sentences.
## What to Include in Your Response
Be sure to include the following in your completed activity:
- Screenshots of your commands or typed versions of the commands
- Explanations of your commands
- A project description at the beginning
- A summary at the end
- Details on using chmod to update file permissions
- Details on checking file permissions with ls -la
- Details on interpreting the 10-character string that represents file permissions
- Details on hidden files and directories
The following is a self-assessment for your **Use Linux commands to manage file permissions** portfolio activity. You will use these statements to review your own work. The self-assessment process is an important part of the learning experience because it allows you to *objectively* assess your **Use Linux commands to manage file permissions** portfolio activity.
There are a total of 8 points possible for this activity and each statement is worth 1 point.
To complete the self-assessment, first open your **Use Linux commands to manage file permissions** portfolio activity. Then respond yes or no to each statement.
When you complete and submit your responses, you will receive a percentage score. This score will help you confirm whether you completed the required steps of the activity. The recommended passing grade for this project is at least 80% (or 7/8 points). If you want to increase your score, you can revise your project and then resubmit your responses to reflect any changes you made. Try to achieve at least 7 points before continuing on to the next course item.
### 1.
Question 1
Your document includes screenshots or typed versions of your commands.
1 point
Yes
No
### 2.
Question 2
Your document includes a description of the project at the beginning.
1 point
Yes
No
### 3.
Question 3
Your document includes explanations of your commands and their output.
1 point
Yes
No
### 4.
Question 4
Your document includes a summary at the end.
1 point
Yes
No
### 5.
Question 5
Your document includes details on using chmod to update file permissions.
1 point
Yes
No
### 6.
Question 6
Your document includes details on checking file permissions with ls -la.
1 point
Yes
No
### 7.
Question 7
Your document includes details on interpreting the 10-character string that represents file permissions.
1 point
Yes
No
### 8.
Question 8
Your document includes details on hidden files and directories.
1 point
Yes
No
# Core commands for navigation and reading files
Welcome back. I hope you're learning a lot about how to communicate with the Linux OS.
As we continue our journey into utilizing the Linux command line, we'll focus on how to navigate the Linux file system.
Now, I want you to imagine a tree.
What did you notice first about the tree?
Would you say the trunk or the branches?
These might definitely get your attention, but what about its roots?
Everything about a tree starts in the roots.
Something similar happens when we think about the Linux file system.
Previously, we learned about the components of the Linux architecture.
The Filesystem Hierarchy Standard, or FHS, is the component of the Linux OS that organizes data.
This file system is a very important part of Linux because everything we do in Linux is considered a file somewhere in the system's directory.
The FHS is a hierarchical system, and just like with a tree, everything grows and branches out from the root.
The root directory is the highest-level directory in Linux.
It's designated by a single slash.
Subdirectories branch off from the root directory.
The subdirectories branch out further and further away from the root directory.
When describing the directory structure in Linux, slashes are used when tracing back through these branches to the root.
For example, here, the first slash indicates the root directory.
Then it branches out a level into the home subdirectory.
Another slash indicates it is branching out again.
This time it's to the analyst subdirectory that is located within home.
When working in security, it is essential that you learn to navigate a file system to locate and analyze logs, such as log files.
You'll analyze these log files for application usage and authentication.
With that background, we're now ready to learn the commands commonly used for navigating the file system.
First, pwd prints the working directory onto the screen.
When you use this command, the output tells you which directory you're currently in.
Next, ls displays the names of files and directories in the current working directory. And finally, cd navigates between directories.
This is the command you'll use when you want to change directories.
Let's use these commands in Bash.
First, we'll type the command pwd to display the current location and then press enter.
The output is the path to the analyst directory where we're currently working.
Next, let's input ls to display the files and directories within the analyst directory.
The output is the name of four directories: logs, oldreports, projects, and reports, and one file named updates.txt.
So let's say we now want to go into the logs directory to check for unauthorized access.
We'll input: cd logs to change directories.
We won't get any output on the screen from the cd command, but if we enter pwd again, its output indicates that the working directory is logs.
Logs is a subdirectory of the analyst directory.
As a security analyst, you'll also need to know how to read file content in Linux.
For example, you may need to read files that contain configuration settings to identify potential vulnerabilities.
Or, you might look at user access reports while investigating unauthorized access.
When reading file content, there are some commands that will help you.
First, cat displays the content of a file.
This is useful, but sometimes you won't want the full contents of a large file.
In these cases, you can use the head command.
It displays just the beginning of a file, by default ten lines.
Let's try out these commands.
Imagine that we want to read the contents of access.txt, and we're already in the working directory where it's located.
First, we input the cat command and then follow it with the name of the file, access.txt.
And Bash returns the full contents of this file.
Let's compare that to the head command.
When we input the head command followed by our file name, only the first 10 lines of this file are displayed.
Wow, this section had lots of action, and it's just the beginning!
I'm glad you learned how security analysts can use essential commands to navigate the system.
Next, we'll explore how to manage the system.
# Navigate Linux and read file content
In this reading, you’ll review how to navigate the file system using Linux commands in Bash. You’ll further explore the organization of the Linux Filesystem Hierarchy Standard, review several common Linux commands for navigation and reading file content, and learn a couple of new commands.
## Filesystem Hierarchy Standard (FHS)
Previously, you learned that the **Filesystem Hierarchy Standard** **(FHS)** is the component of Linux that organizes data. The FHS is important because it defines how directories, directory contents, and other storage is organized in the operating system.
This diagram illustrates the hierarchy of relationships under the FHS:
Under the FHS, a file’s location can be described by a file path. A **file path** is the location of a file or directory. In the file path, the different levels of the hierarchy are separated by a forward slash (/).
### **Root directory**
The **root directory** is the highest-level directory in Linux, and it’s always represented with a forward slash (/). All subdirectories branch off the root directory. Subdirectories can continue branching out to as many levels as necessary.
### Standard FHS directories
Directly below the root directory, you’ll find standard FHS directories. In the diagram, home, bin, and etc are standard FHS directories. Here are a few examples of what standard directories contain:
- /home: Each user in the system gets their own home directory.
- /bin: This directory stands for “binary” and contains binary files and other executables. Executables are files that contain a series of commands a computer needs to follow to run programs and perform other functions.
- /etc: This directory stores the system’s configuration files.
- /tmp: This directory stores many temporary files. The /tmp directory is commonly used by attackers because anyone in the system can modify data in these files.
- /mnt: This directory stands for “mount” and stores media, such as USB drives and hard drives.
**Pro Tip**: You can use the man hier command to learn more about the FHS and its standard directories.
### **User-specific subdirectories**
Under home are subdirectories for specific users. In the diagram, these users are analyst and analyst2. Each user has their own personal subdirectories, such as projects, logs, or reports.
**Note:** When the path leads to a subdirectory below the user’s home directory, the user’s home directory can be represented as the tilde (~). For example, /home/analyst/logs can also be represented as ~/logs.
You can navigate to specific subdirectories using their absolute or relative file paths. The **absolute file path** is the full file path, which starts from the root. For example, /home/analyst/projects is an absolute file path. The **relative file path** is the file path that starts from a user's current directory.
**Note:** Relative file paths can use a dot (.) to represent the current directory, or two dots (..) to represent the parent of the current directory. An example of a relative file path could be ../projects.
## Key commands for navigating the file system
The following Linux commands can be used to navigate the file system: pwd, ls, and cd.
### **pwd**
The pwd command prints the working directory to the screen. Or in other words, it returns the directory that you’re currently in.
The output gives you the absolute path to this directory. For example, if you’re in your home directory and your username is analyst, entering pwd returns /home/analyst.
**Pro Tip**: To learn what your username is, use the whoami command. The whoami command returns the username of the current user. For example, if your username is analyst, entering whoami returns analyst.
### **ls**
The ls command displays the names of the files and directories in the current working directory. For example, in the video, ls returned directories such as logs, and a file called updates.txt.
**Note**: If you want to return the contents of a directory that’s not your current working directory, you can add an argument after ls with the absolute or relative file path to the desired directory. For example, if you’re in the /home/analyst directory but want to list the contents of its projects subdirectory, you can enter ls /home/analyst/projects or just ls projects.
### **cd**
The cd command navigates between directories. When you need to change directories, you should use this command.
To navigate to a subdirectory of the current directory, you can add an argument after cd with the subdirectory name. For example, if you’re in the /home/analyst directory and want to navigate to its projects subdirectory, you can enter cd projects.
You can also navigate to any specific directory by entering the absolute file path. For example, if you’re in /home/analyst/projects, entering cd /home/analyst/logs changes your current directory to /home/analyst/logs.
**Pro Tip**: You can use the relative file path and enter cd .. to go up one level in the file structure. For example, if the current directory is /home/analyst/projects, entering cd .. would change your working directory to /home/analyst.
## Common commands for reading file content
The following Linux commands are useful for reading file content: cat, head, tail, and less.
### **cat**
The cat command displays the content of a file. For example, entering cat updates.txt returns everything in the updates.txt file.
h.l.
The `cat` command in Linux is short for "concatenate", which means to link things together in a series or chain. The `cat` command is one of the most commonly used commands in Unix-like operating systems like Linux. It reads data from files and outputs their contents. It can also concatenate and display the contents of more than one file.
### **head**
The head command displays just the beginning of a file, by default 10 lines. The head command can be useful when you want to know the basic contents of a file but don’t need the full contents. Entering head updates.txt returns only the first 10 lines of the updates.txt file.
**Pro Tip**: If you want to change the number of lines returned by head, you can specify the number of lines by including -n. For example, if you only want to display the first five lines of the updates.txt file, enter head -n 5 updates.txt.
### **tail**
The tail command does the opposite of head. This command can be used to display just the end of a file, by default 10 lines. Entering tail updates.txt returns only the last 10 lines of the updates.txt file.
**Pro Tip**: You can use tail to read the most recent information in a log file.
### **less**
The less command returns the content of a file one page at a time. For example, entering less updates.txt changes the terminal window to display the contents of updates.txt one page at a time. This allows you to easily move forward and backward through the content.
Once you’ve accessed your content with the less command, you can use several keyboard controls to move through the file:
- Space bar: Move forward one page
- b: Move back one page
- Down arrow: Move forward one line
- Up arrow: Move back one line
- q: Quit and return to the previous terminal window
note to future NaruZkurai, this control scheme is ascinine, i will be ripping this command then creating one called
nzkread
## Key takeaways
It’s important for security analysts to be able to navigate Linux and the file system of the FHS. Some key commands for navigating the file system include pwd, ls, and cd. Reading file content is also an important skill in the security profession. This can be done with commands such as cat, head, tail, and less.
# Find what you need with Linux
Now that we covered: pwd, ls, and cd and are familiar with these basic commands for navigating the Linux file system, let's look at a couple of ways to find what you need within this system.
As a security analyst, your work will likely involve filtering for the information you need.
Filtering means searching your system for specific information that can help you solve complex problems.
For example, imagine that your team determines a piece of malware contains a string of characters.
You might be tasked with finding other files with the same string to determine if those files contain the same malware.
Later, we'll learn more about how you can use SQL to filter a database, but Linux is a good place to start basic filtering.
First, we'll start with grep.
The grep command searches a specified file and returns all lines in the file containing a specified string.
Here's an example of this.
Let's say we have a file called updates.txt, and we're currently looking for lines that contain the word: OS.
If the file is large, it would take a long time to visually scan for this.
Instead, after navigating to the directory that contains updates.txt, we'll type the command: grep OS updates.txt into the shell.
Notice how the grep command is followed by two arguments.
The first argument is the string we're searching for; in this case, OS.
The second argument is the name of the file we're searching through, updates.txt.
When we press enter, Bash returns all lines containing the word OS.
Now let's talk about piping.
Piping is a Linux command that can be used for a variety of purposes.
In a moment, we'll focus on how it can be used for filtering.
But first, let's talk about the general idea of piping.
The piping command sends a standard output of one command as standard input into another command for further processing.
It's represented by the vertical bar character.
In our context, we can refer to this as the pipe character.
Take a moment and imagine a physical pipe.
Physical pipes have two ends.
On one end, for example, water might enter the pipe from a hot water tank.
Then, it travels through the pipe and comes out on the other end in a sink.
Similarly, in Linux, piping also involves redirection.
Output from one command is sent through the pipe and then is used on the other side of the pipe.
Earlier in this video, I explained how grep can be used to filter for strings of characters within a file.
Grep can also be incorporated after a pipe.
Let's focus on this example.
The first command, ls, instructs the operating system to output the file and directory contents of their reports subdirectory.
But because the command is followed by the pipe, the output isn't returned to the screen.
Instead, it's sent to the next command.
As we just learned, grep searches for a specified string of characters;
in this case, it's users.
But where is it searching?
Since grep follows a pipe, the output of the previous command indicates where to search.
In this case, that output is a list of files and directories within the reports subdirectory.
It will return all files and directories that contain the word: users.
Let's explore this in Bash.
So we can better understand how the filter works, let's first output everything in the reports directory.
If we were already in the directory, we would just need to input ls.
But since we're not, we'll also specify the path to this directory.
When we press enter, the output indicates there are seven files in the reports directory.
Because we want to return only the files that contain the word users, we'll combine this ls command with piping and the grep command.
As the output demonstrates, Linux has been instructed to return only files that contain the word users.
The two files that don't contain this string no longer appear.
So now you have two different ways that you can filter in Linux while working as an analyst.
Navigating through files and filtering are just part of what you need to know.
Let's keep exploring the Linux command line.
# Filter content in Linux
In this reading, you’ll continue exploring Linux commands, which can help you filter for the information you need. You’ll learn a new Linux command, find, which can help you search files and directories for specific information.
## Filtering for information
You previously explored how filtering for information is an important skill for security analysts. **Filtering** is selecting data that match a certain condition. For example, if you had a virus in your system that only affected the .txt files, you could use filtering to find these files quickly. Filtering allows you to search based on specific criteria, such as file extension or a string of text.
## grep
The grep command searches a specified file and returns all lines in the file containing a specified string. The grep command commonly takes two arguments: a specific string to search for and a specific file to search through.
For example, entering grep OS updates.txt returns all lines containing OS in the updates.txt file. In this example, OS is the specific string to search for, and updates.txt is the specific file to search through.
## Piping
The pipe command is accessed using the pipe character (|). **Piping** sends the standard output of one command as standard input to another command for further processing. As a reminder, **standard output** is information returned by the OS through the shell, and **standard input** is information received by the OS via the command line.
The pipe character (|) is located in various places on a keyboard. On many keyboards, it’s located on the same key as the backslash character (\\). On some keyboards, the | can look different and have a small space through the middle of the line. If you can’t find the |, search online for its location on your particular keyboard.
When used with grep, the pipe can help you find directories and files containing a specific word in their names. For example, ls /home/analyst/reports | grep users returns the file and directory names in the reports directory that contain users. Before the pipe, ls indicates to list the names of the files and directories in reports. Then, it sends this output to the command after the pipe. In this case, grep users returns all of the file or directory names containing users from the input it received.
**Note:** Piping is a general form of redirection in Linux and can be used for multiple tasks other than filtering. You can think of piping as a general tool that you can use whenever you want the output of one command to become the input of another command.
## find
The find command searches for directories and files that meet specified criteria. There’s a wide range of criteria that can be specified with find. For example, you can search for files and directories that
- Contain a specific string in the name,
- Are a certain file size, or
- Were last modified within a certain time frame.
When using find, the first argument after find indicates where to start searching. For example, entering find /home/analyst/projects searches for everything starting at the projects directory.
After this first argument, you need to indicate your criteria for the search. If you don’t include a specific search criteria with your second argument, your search will likely return a lot of directories and files.
Specifying criteria involves options. **Options** modify the behavior of a command and commonly begin with a hyphen (-).
### **-name and -iname**
One key criteria analysts might use with find is to find file or directory names that contain a specific string. The specific string you’re searching for must be entered in quotes after the -name or -iname options. The difference between these two options is that -name is case-sensitive, and -iname is not.
For example, you might want to find all files in the projects directory that contain the word “log” in the file name. To do this, you’d enter find /home/analyst/projects -name "\*log\*". You could also enter find /home/analyst/projects -iname "\*log\*".
In these examples, the output would be all files in the projects directory that contain log surrounded by zero or more characters. The "\*log\*" portion of the command is the search criteria that indicates to search for the string “log”. When -name is the option, files with names that include Log or LOG, for example, wouldn’t be returned because this option is case-sensitive. However, they would be returned when -iname is the option.
**Note**: An asterisk (\*) is used as a wildcard to represent zero or more unknown characters.
### **-mtime**
Security analysts might also use find to find files or directories last modified within a certain time frame. The -mtime option can be used for this search. For example, entering find /home/analyst/projects -mtime -3 returns all files and directories in the projects directory that have been modified within the past three days.
The -mtime option search is based on days, so entering -mtime +1 indicates all files or directories last modified more than one day ago, and entering -mtime -1 indicates all files or directories last modified less than one day ago.
**Note:** The option -mmin can be used instead of -mtime if you want to base the search on minutes rather than days.
## Key takeaways
Filtering for information using Linux commands is an important skill for security analysts so that they can customize data to fit their needs. Three key Linux commands for this are grep, piping (|), and find. These commands can be used to navigate and filter for information in the file system.
# Create and modify directories and files
Let's make some branches!
What do I mean by that?
Well, in a previous video, we discussed root directories and how other subdirectories branch off of the root directory.
Let's think again about the file directory system as a tree.
The subdirectories are the branches of the tree.
They're all connected from the same root but can grow to make a complex tree.
In this video, we'll create directories and files and learn how to modify them.
When it comes to working with data in security, organization is key.
If we know where information is located, it makes it easier to detect issues and keep information safe.
In a previous video, we've already discussed navigating between directories, but let's take a moment to examine directories more closely.
It's possible you're familiar with the concept of folders for organizing information.
In Linux, we have directories.
Directories help organize files and subdirectories.
For example, within a directory for reports, an analyst may need to create two subdirectories:
one for drafts and one for final reports.
Now that we know why we need directories, et's take a look at some essential Linux commands for managing directories and files.
First, let's take note of commands for creating and removing directories.
The mkdir command creates a new directory.
In contrast, rmdir removes or deletes a directory.
A helpful feature of this command is its built-in warning that lets you know a directory is not empty.
This saves you from accidentally deleting files.
Next, you'll use other commands for creating and removing files.
The touch command creates a new file, and then the rm command removes or deletes a file.
And last, we have our commands for copying and moving files or directories.
The mv command moves a file or directory to new location, and cp copies a file or directory into a new location.
Now, we're ready to try out these commands.
First, let's use the pwd command, and then let's display the names of the files and directories in the analyst directory with the ls command.
Imagine that we no longer need the oldreports directory that appears among the file contents.
Let's take a look at how to remove it.
We input the rmdir command and follow it with the name of the directory we want to remove: oldreports.
We can use the ls command to confirm that oldreports has been deleted and no longer appears among the contents.
Now, let's make another change.
We want a new directory for drafts of reports.
We need to use the command: mkdir and specify a name for this directory: drafts.
If we input ls again, we'll notice the new directory drafts included among the contents of the analyst directory.
Let's change into this new directory by entering: cd drafts.
If we run ls, it doesn't return any output, indicating that this directory is currently empty.
But next, we'll add some files to it.
Let's say we want to draft new reports on recently installed email and OS patches.
To create these files, we input: touch email\_patches.txt
and then: touch OS\_patches.txt.
Running ls indicates that these files are now in the drafts directory.
What if we realize that we only need a new report on OS patches and we want to delete the email patches report?
To do this, we input the rm command and specify the file to delete as: email\_patches.txt.
Running ls confirms that it's been deleted.
Now, let's focus on our commands for moving and copying.
We realized that we have a file called email policy in the reports folder that is currently in draft format.
We want to move it into the newly created drafts folder.
To do this, we need to change into the directory that currently has that file.
Running ls in that directory indicates that it contains several files, including email\_policy.txt.
Then to move that file, we'll enter the mv command followed by two arguments.
The first argument after mv identifies the file to be moved.
The second argument indicates where to move it.
If we change directories into drafts and then display its contents, we'll notice that the email policy file has been moved to this directory.
We'll change back into reports.
Displaying the file contents confirms that email\_policy is no longer there.
Okay, one more thing. vulnerabilities.txt is a file that we want to keep in the reports directory.
But since it affects an upcoming project, we also want to copy it into the project's directory.
Since we're already in the directory that has this file, we'll use the cp command to copy it into the projects directory.
Notice that the first argument indicates which file to copy, and the second argument provides the path to the directory that it will be copied into.
When we press Enter, this copies the vulnerabilities file into the projects directory while also leaving the original within reports.
Isn't it cool what we can do with these commands?
Now, let's focus on one more concept related to modifying files.
In addition to using commands, you can also use applications to help you edit files.
As a security analyst, file editors are often necessary for your daily tasks, like writing or editing reports.
A popular file editor is nano.
It's good for beginners.
You can access this tool through the nano command.
Let's get familiar with nano together.
We'll add a title to our new draft report: OS\_patches.txt.
First, we change into the directory containing that file,
then we input nano followed by the name of the file we want to edit: OS\_patches.txt.
This brings up the nano file editor with that file open.
For now, we'll just enter the title OS Patches by typing this into the editor.
We need to save this before returning to the command line, and to do so, we press Ctrl+O and then enter to save it with the current file name.
Then to exit, we press Ctrl+X.
Great work!
We've covered a lot of topics here—from creating and removing directories and files to copying or moving them, and just now, we've added editing files.
You're well on your way to learning Linux commands!
# Manage directories and files
Previously, you explored how to manage the file system using Linux commands. The following commands were introduced: mkdir, rmdir, touch, rm, mv, and cp. In this reading, you’ll review these commands, the nano text editor, and learn another way to write to files.
## Creating and modifying directories
### **mkdir**
The mkdir command creates a new directory. Like all of the commands presented in this reading, you can either provide the new directory as the absolute file path, which starts from the root, or as a relative file path, which starts from your current directory.
For example, if you want to create a new directory called network in your /home/analyst/logs directory, you can enter mkdir /home/analyst/logs/network to create this new directory. If you’re already in the /home/analyst/logs directory, you can also create this new directory by entering mkdir network.
**Pro Tip**: You can use the ls command to confirm the new directory was added.
### **rmdir**
The rmdir command removes, or deletes, a directory. For example, entering rmdir /home/analyst/logs/network would remove this empty directory from the file system.
**Note**: The rmdir command cannot delete directories with files or subdirectories inside. For example, entering rmdir /home/analyst returns an error message.
## Creating and modifying files
### **touch and rm**
The touch command creates a new file. This file won’t have any content inside. If your current directory is /home/analyst/reports, entering touch permissions.txt creates a new file in the reports subdirectory called permissions.txt.
The rm command removes, or deletes, a file. This command should be used carefully because it’s not easy to recover files deleted with rm. To remove the permissions file you just created, enter rm permissions.txt.
**Pro Tip:** You can verify that permissions.txt was successfully created or removed by entering ls.
### **mv and cp**
You can also use mv and cp when working with files. The mv command moves a file or directory to a new location, and the cp command copies a file or directory into a new location. The first argument after mv or cp is the file or directory you want to move or copy, and the second argument is the location you want to move or copy it to.
To move permissions.txt into the logs subdirectory, enter mv permissions.txt /home/analyst/logs. Moving a file removes the file from its original location. However, copying a file doesn’t remove it from its original location. To copy permissions.txt into the logs subdirectory while also keeping it in its original location, enter cp permissions.txt /home/analyst/logs.
**Note**: The mv command can also be used to rename files. To rename a file, pass the new name in as the second argument instead of the new location. For example, entering mv permissions.txt perm.txt renames the permissions.txt file to perm.txt.
## nano text editor
**nano** is a command-line file editor that is available by default in many Linux distributions. Many beginners find it easy to use, and it’s widely used in the security profession. You can perform multiple basic tasks in nano, such as creating new files and modifying file contents.
To open an existing file in nano from the directory that contains it, enter nano followed by the file name. For example, entering nano permissions.txt from the /home/analyst/reports directory opens a new nano editing window with the permissions.txt file open for editing. You can also provide the absolute file path to the file if you’re not in the directory that contains it.
You can also create a new file in nano by entering nano followed by a new file name. For example, entering nano authorized\_users.txt from the /home/analyst/reports directory creates the authorized\_users.txt file within that directory and opens it in a new nano editing window.
Since there isn't an auto-saving feature in nano, it’s important to save your work before exiting. To save a file in nano, use the keyboard shortcut Ctrl + O. You’ll be prompted to confirm the file name before saving. To exit out of nano, use the keyboard shortcut Ctrl + X.
**Note**: Vim and Emacs are also popular command-line text editors.
## Standard output redirection
There’s an additional way you can write to files. Previously, you learned about standard input and standard output. **Standard input** is information received by the OS via the command line, and **standard output** is information returned by the OS through the shell.
You’ve also learned about piping. **Piping** sends the standard output of one command as standard input to another command for further processing. It uses the pipe character (|).
In addition to the pipe (|), you can also use the right angle bracket (>) and double right angle bracket (>>) operators to redirect standard output.
When used with echo, the > and >> operators can be used to send the output of echo to a specified file rather than the screen. The difference between the two is that > overwrites your existing file, and >> adds your content to the end of the existing file instead of overwriting it. The > operator should be used carefully, because it’s not easy to recover overwritten files.
When you’re inside the directory containing the permissions.txt file, entering echo "last updated date" >> permissions.txt adds the string “last updated date” to the file contents. Entering echo "time" > permissions.txt after this command overwrites the entire file contents of permissions.txt with the string “time”.
**Note:** Both the > and >> operators will create a new file if one doesn’t already exist with your specified name.
## Key takeaways
Knowing how to manage the file system in Linux is an important skill for security analysts. Useful commands for this include: mkdir, rmdir, touch, rm, mv, and cp. When security analysts need to write to files, they can use the nano text editor, or the > and >> operators.
# File permissions and ownership
Hi there. It's great to have you back!
Let's continue to learn more about how to work in Linux as a security analyst.
In this video, we'll explore file and directory permissions.
We'll learn how Linux represents permissions and how you can check for the permissions associated with files and directories.
Permissions are the type of access granted for a file or directory.
Permissions are related to authorization.
Authorization is the concept of granting access to specific resources in a system.
Authorization allows you to limit access to specified files or directories.
A good rule to follow is that data access is on a need-to-know basis.
You can imagine the security risk it would impose if anyone could access or modify
anything they wanted to on a system.
There are three types of permissions in Linux that an authorized user can have.
The first type of permission is read.
On a file, read permissions means contents on the file can be read.
On a directory, this permission means you can read all files in that directory.
Next are write permissions.
Write permissions on a file allow modifications of contents of the file.
On a directory, write permissions indicate that new files can be created in that directory.
Finally, there are also execute permissions.
Execute permissions on files mean that the file can be executed if it's an executable file.
Execute permissions on directories allow users to enter into a directory and access its files.
Permissions are granted for three different types of owners.
The first type is the user.
The user is the owner of the file.
When you create a file, you become the owner of the file, but the ownership can be changed.
Group is the next type.
Every user is a part of a certain group.
A group consists of several users, and this is one way to manage a multi-user environment.
Finally, there is other.
Other can be considered all other users on the system.
Basically, anyone else with access to the system belongs to this group.
In Linux, file permissions are represented with a 10-character string.
For a directory with full permissions for the user group, this string would be: drwxrwxrwx.
Let's examine what this means more closely.
The first character indicates the file type.
As shown in this example, d is used to indicate it is a directory.
If this character contains a hyphen instead, it would be a regular file.
The second, third, and fourth characters indicate the permissions for the user.
- In this example,
- r indicates the user has read permissions,
- w indicates the user has write permissions,
- x indicates the user has execute permissions.
If one of these permissions was missing, there would be a hyphen instead of the letter.
In the same way, the fifth, sixth, and seventh characters indicate permissions for the next owner type group.
As it shows here, the type group also has read, write, and execute permissions.
There are no hyphens to indicate that any of these permissions haven't been granted.
Finally, the eighth through tenth characters indicate permissions for the last owner type: other.
They also have read, write, and execute permissions in this example.
Ensuring files and directories are set with their appropriate access permissions is critical to protecting sensitive files and maintaining the overall security of a system.
For example, payroll departments handle sensitive information.
If someone outside of the payroll group could read this file, this would be a privacy concern.
Another example is when the user, the group, and other can all write to a file.
This type of file is considered a world-writable file.
World-writable files can pose significant security risks.
So how do we check permissions?
First, we need to understand what options are.
Options modify the behavior of the command.
The options for a command can be a single letter or a full word.
Checking permissions involves adding options to the ls command.
First, ls -l displays permissions to files and directories.
You might also want to display hidden files and identify their permissions.
Hidden files, which begin with a period before their name, don't
normally appear when you use ls to display file contents.
Entering ls -a displays hidden files.
Then you can combine these two options to do both.
Entering ls -la displays permissions to files and directories, including hidden files.
Let's get into Bash and try out these options.
Right now, we're in the project subdirectory.
First, let's use the ls command to display its contents.
The output displays the files in this directory, but we don't know anything about their permissions.
By using ls -l instead, we get expanded information on these files. Let's do this.
The file names are now on the right side of each row.
The first piece of information in each row shows the permissions in the format that we discussed earlier.
Since these are all files and not directories, notice how the first character is a hyphen.
Let's focus on one specific file: project1.txt.
The second through fourth characters of its permissions show us the user has both read and write permissions but lacks execute permissions.
In both the fifth through seventh characters and eighth through tenth characters, the sequence is r--.
This means group and other have only read privileges.
After the permissions, ls -l first displays the username.
Here, that's us, analyst.
Next comes the group name; in our case, the security group.
Now let's use ls -a
The output includes two more files—hidden files with the names: .hidden1.txt and .hidden2.txt
Finally, we can also use ls -la to show the permissions for all files, including these hidden files.
I thought that was pretty interesting. Did you?
You now know a little more about file permissions and ownership.
This will be helpful when working in security because monitoring and setting correct permissions is
essential for protecting information.
Take a small break and meet me in the next video.
# Permission commands
Previously, you explored file permissions and the commands that you can use to display and change them. In this reading, you’ll review these concepts and also focus on an example of how these commands work together when putting the principle of least privilege into practice.
## Reading permissions
In Linux, permissions are represented with a 10-character string. Permissions include:
- **read**: for files, this is the ability to read the file contents; for directories, this is the ability to read all contents in the directory including both files and subdirectories
- **write**: for files, this is the ability to make modifications on the file contents; for directories, this is the ability to create new files in the directory
- **execute**: for files, this is the ability to execute the file if it’s a program; for directories, this is the ability to enter the directory and access its files
These permissions are given to these types of owners:
- **user**: the owner of the file
- **group**: a larger group that the owner is a part of
- **other**: all other users on the system
Each character in the 10-character string conveys different information about these permissions. The following table describes the purpose of each character:
**Character**
**Example**
**Meaning**
1st
**d**rwxrwxrwx
file type
- d for directory
- - for a regular file
2nd
d**r**wxrwxrwx
read permissions for the user
- r if the user has read permissions
- - if the user lacks read permissions
3rd
dr**w**xrwxrwx
write permissions for the user
- w if the user has write permissions
- - if the user lacks write permissions
4th
drw**x**rwxrwx
execute permissions for the user
- x if the user has execute permissions
- - if the user lacks execute permissions
5th
drwx**r**wxrwx
read permissions for the group
- r if the group has read permissions
- - if the group lacks read permissions
6th
drwxr**w**xrwx
write permissions for the group
- w if the group has write permissions
- - if the group lacks write permissions
7th
drwxrw**x**rwx
execute permissions for the group
- x if the group has execute permissions
- - if the group lacks execute permissions
8th
drwxrwx**r**wx
read permissions for other
- r if the other owner type has read permissions
- - if the other owner type lacks read permissions
9th
drwxrwxr**w**x
write permissions for other
- w if the other owner type has write permissions
- - if the other owner type lacks write permissions
10th
drwxrwxrw**x**
execute permissions for other
- x if the other owner type has execute permissions
- - if the other owner type lacks execute permissions
## Exploring existing permissions
You can use the ls command to investigate who has permissions on files and directories. Previously, you learned that ls displays the names of files in directories in the current working directory.
There are additional options you can add to the ls command to make your command more specific. Some of these options provide details about permissions. Here are a few important ls options for security analysts:
- ls -a: Displays hidden files. Hidden files start with a period (.) at the beginning.
- ls -l: Displays permissions to files and directories. Also displays other additional information, including owner name, group, file size, and the time of last modification.
- ls -la: Displays permissions to files and directories, including hidden files. This is a combination of the other two options.
## Changing permissions
The **principle of least privilege** is the concept of granting only the minimal access and authorization required to complete a task or function. In other words, users should not have privileges that are beyond what is necessary. Not following the principle of least privilege can create security risks.
The chmod command can help you manage this authorization. The chmod command changes permissions on files and directories.
### **Using chmod**
The chmod command requires two arguments. The first argument indicates how to change permissions, and the second argument indicates the file or directory that you want to change permissions for. For example, the following command would add all permissions to login\_sessions.txt:
chmod u+rwx,g+rwx,o+rwx login\_sessions.txt
If you wanted to take all the permissions away, you could use
chmod u-rwx,g-rwx,o-rwx login\_sessions.txt
Another way to assign these permissions is to use the equals sign (=) in this first argument. Using = with chmod sets, or assigns, the permissions exactly as specified. For example, the following command would set read permissions for login\_sessions.txt for user, group, and other:
chmod u=r,g=r,o=r login\_sessions.txt
This command overwrites existing permissions. For instance, if the user previously had write permissions, these write permissions are removed after you specify only read permissions with =.
The following table reviews how each character is used within the first argument of chmod:
**Character**
**Description**
u
indicates changes will be made to user permissions
g
indicates changes will be made to group permissions
o
indicates changes will be made to other permissions
+
adds permissions to the user, group, or other
-
removes permissions from the user, group, or other
=
assigns permissions for the user, group, or other
**Note:** When there are permission changes to more than one owner type, commas are needed to separate changes for each owner type. You should not add spaces after those commas.
### **The principle of least privilege in action**
As a security analyst, you may encounter a situation like this one: There’s a file called bonuses.txt within a compensation directory. The owner of this file is a member of the Human Resources department with a username of hrrep1. It has been decided that hrrep1 needs access to this file. But, since this file contains confidential information, no one else in the hr group needs access.
You run ls -l to check the permissions of files in the compensation directory and discover that the permissions for bonuses.txt are -rw-rw----. The group owner type has read and write permissions that do not align with the principle of least privilege.
To remedy the situation, you input chmod g-rw bonuses.txt. Now, only the user who needs to access this file to carry out their job responsibilities can access this file.
## Key takeaways
Managing directory and file permissions may be a part of your work as a security analyst. Using ls with the -l and -la options allows you to investigate directory and file permissions. Using chmod allows you to change user permissions and ensure they are aligned with the principle of least privilege.
# File permissions and ownership
Hi there. It's great to have you back!
Let's continue to learn more about how to work in Linux as a security analyst.
In this video, we'll explore file and directory permissions.
We'll learn how Linux represents permissions and how you can check for the permissions associated with files and directories.
Permissions are the type of access granted for a file or directory.
Permissions are related to authorization.
Authorization is the concept of granting access to specific resources in a system.
Authorization allows you to limit access to specified files or directories.
A good rule to follow is that data access is on a need-to-know basis.
You can imagine the security risk it would impose if anyone could access or modify anything they wanted to on a system.
There are three types of permissions in Linux that an authorized user can have.
The first type of permission is read.
On a file, read permissions means contents on the file can be read.
On a directory, this permission means you can read all files in that directory.
Next are write permissions.
Write permissions on a file allow modifications of contents of the file.
On a directory, write permissions indicate that new files can be created in that directory.
Finally, there are also execute permissions.
Execute permissions on files mean that the file can be executed if it's an executable file.
Execute permissions on directories allow users to enter into a directory and access its files.
Permissions are granted for three different types of owners.
The first type is the user.
The user is the owner of the file.
When you create a file, you become the owner of the file, but the ownership can be changed.
Group is the next type.
Every user is a part of a certain group.
A group consists of several users, and this is one way to manage a multi-user environment.
Finally, there is other.
Other can be considered all other users on the system.
Basically, anyone else with access to the system belongs to this group.
In Linux, file permissions are represented with a 10-character string.
For a directory with full permissions for the user group, this string would be: drwxrwxrwx.
Let's examine what this means more closely.
The first character indicates the file type.
As shown in this example, d is used to indicate it is a directory.
If this character contains a hyphen instead, it would be a regular file.
The second, third, and fourth characters indicate the permissions for the user.
In this example, r indicates the user has read permissions, w indicates the user has write permissions, and x indicates the user has execute permissions.
If one of these permissions was missing, there would be a hyphen instead of the letter.
In the same way, the fifth, sixth, and seventh characters indicate permissions for the next owner type group.
As it shows here, the type group also has read, write, and execute permissions.
There are no hyphens to indicate that any of these permissions haven't been granted.
Finally, the eighth through tenth characters indicate permissions for the last owner type: other.
They also have read, write, and execute permissions in this example.
Ensuring files and directories are set with their appropriate access permissions is critical to protecting sensitive files and
maintaining the overall security of a system.
For example, payroll departments handle sensitive information.
If someone outside of the payroll group could read this file, this would be a privacy concern.
Another example is when the user,
the group, and other can all write to a file.
This type of file is considered a world-writable file.
World-writable files can pose significant security risks.
So how do we check permissions?
First, we need to understand what options are.
Options modify the behavior of the command.
The options for a command can be a single letter or a full word.
Checking permissions involves adding options to the ls command.
First, ls -l displays permissions to files and directories.
You might also want to display hidden files and identify their permissions.
Hidden files, which begin with a period before their name, don't normally appear when you use ls to display file contents.
Entering ls -a displays hidden files.
Then you can combine these two options to do both.
Entering ls -la displays permissions to files and directories, including hidden files.
Let's get into Bash and try out these options.
Right now, we're in the project subdirectory.
First, let's use the ls command to display its contents.
The output displays the files in this directory, but we don't know anything about their permissions.
By using ls -l instead, we get expanded information on these files. Let's do this.
The file names are now on the right side of each row.
The first piece of information in each row shows the permissions in the format that we discussed earlier.
Since these are all files and not directories, notice how the first character is a hyphen.
Let's focus on one specific file: project1.txt.
The second through fourth characters of its permissions show us the user has both read and write permissions but lacks execute permissions.
In both the fifth through seventh characters and eighth through tenth characters, the sequence is r--.
This means group and other have only read privileges.
After the permissions, ls -l first displays the username.
Here, that's us, analyst.
Next comes the group name; in our case, the security group.
Now let's use ls -a The output includes two more files—hidden files with the names: .hidden1.txt and .hidden2.txt
Finally, we can also use ls -la to show the permissions for all files, including these hidden files.
I thought that was pretty interesting. Did you?
You now know a little more about file permissions and ownership.
This will be helpful when working in security because monitoring and setting correct permissions is essential for protecting information.
Take a small break and meet me in the next video.
# Change permissions
Hi there! In the previous video, you learned how to check permissions for a user.
In this video, we're going to learn about changing permissions.
When working as a security analyst, there may be many reasons to change permissions for a user.
A user may have changed departments or been assigned to a different work group.
A user might simply no longer be working on a project that requires certain permissions.
These changes are necessary in order to protect system files from being accidentally or deliberately altered or deleted.
Let's explore a related command that helps control this access.
In this video, we'll learn about chmod.
chmod changes permissions on files and directories.
The command chmod stands for change mode.
There are two modes for changing permissions, but we'll focus on symbolic. The best way to learn about how chmod works is through an example.
I know this has a lot of details, but we'll break this down.
Also, please keep in mind that, like many Linux commands, you don't have to memorize the information and can always find a reference.
With chmod, you need to identify which file or directory you want to adjust permissions for.
This is the final argument, in this case, a file named: access.txt.
The first argument, added directly after the chmod command, indicates how to change permissions.
Right now, this might seem hard to interpret, but soon we'll understand why this is called symbolic mode.
Previously, we learned about the three types of owners: user, group, and other.
To identify these with chmod, we use u to represent the user, g to represent the group, and o to represent other.
In this particular example, g indicates we will make some changes to group permissions, and o to permissions for other.
These owner types are separated by a comma in this argument.
But do we want to add or take away permissions?
Well, for this, we use mathematical operators.
So, the plus sign after g means we want to add permissions for group.
The minus sign after o means we want to take them away from other.
And the last question is: what kind of changes?
We've already learned that r represents read permissions, w represents write permissions, and x represents execute permissions.
So in this case, the w indicates that we're adding write permissions to the group, and r indicates that we are taking away read permissions from other.
This is still very complex.
But now that we've broken it down, perhaps it doesn't seem quite so much like a foreign language.
And remember, you don't have to memorize this all.
Let's give this new command a try.
We'll start out in the logs sub-directory.
If we use the ls -l command, it will output the permissions for the file.
It shows the permissions for the only file in this directory: access.txt.
Previously, we learned how to read these permissions.
The second through fourth characters indicate that the user has read and write permissions.
The fifth through seventh characters show the group only has read permissions.
And the eighth to tenth characters show that other only has read permissions.
We need to adjust these permissions.
We want to ensure analysts in the security group have write permission, but takeaway read permissions from the owner-type other, so we add write permissions for group and remove read permissions for other.
Let's run ls -l again. This shows a change in the permissions for access.txt.
Notice how in the middle segment of permissions for the group, w has been added to give write permissions.
And another change is that the r has been removed in the last segment, indicating that read permissions for other have been removed.
As mentioned earlier, these hyphens indicate a lack of permissions.
Now, other is lacking all permissions.
Though it requires practice,
working in Linux becomes more natural with time.
I'm glad you're learning a little
more about how to use Linux.
# Permission commands
Previously, you explored file permissions and the commands that you can use to display and change them. In this reading, you’ll review these concepts and also focus on an example of how these commands work together when putting the principle of least privilege into practice.
## Reading permissions
In Linux, permissions are represented with a 10-character string. Permissions include:
- **read**: for files, this is the ability to read the file contents; for directories, this is the ability to read all contents in the directory including both files and subdirectories
- **write**: for files, this is the ability to make modifications on the file contents; for directories, this is the ability to create new files in the directory
- **execute**: for files, this is the ability to execute the file if it’s a program; for directories, this is the ability to enter the directory and access its files
These permissions are given to these types of owners:
- **user**: the owner of the file
- **group**: a larger group that the owner is a part of
- **other**: all other users on the system
Each character in the 10-character string conveys different information about these permissions. The following table describes the purpose of each character:
**Character**
**Example**
**Meaning**
1st
**d**rwxrwxrwx
file type
- d for directory
- - for a regular file
2nd
d**r**wxrwxrwx
read permissions for the user
- r if the user has read permissions
- - if the user lacks read permissions
3rd
dr**w**xrwxrwx
write permissions for the user
- w if the user has write permissions
- - if the user lacks write permissions
4th
drw**x**rwxrwx
execute permissions for the user
- x if the user has execute permissions
- - if the user lacks execute permissions
5th
drwx**r**wxrwx
read permissions for the group
- r if the group has read permissions
- - if the group lacks read permissions
6th
drwxr**w**xrwx
write permissions for the group
- w if the group has write permissions
- - if the group lacks write permissions
7th
drwxrw**x**rwx
execute permissions for the group
- x if the group has execute permissions
- - if the group lacks execute permissions
8th
drwxrwx**r**wx
read permissions for other
- r if the other owner type has read permissions
- - if the other owner type lacks read permissions
9th
drwxrwxr**w**x
write permissions for other
- w if the other owner type has write permissions
- - if the other owner type lacks write permissions
10th
drwxrwxrw**x**
execute permissions for other
- x if the other owner type has execute permissions
- - if the other owner type lacks execute permissions
## Exploring existing permissions
You can use the ls command to investigate who has permissions on files and directories. Previously, you learned that ls displays the names of files in directories in the current working directory.
There are additional options you can add to the ls command to make your command more specific. Some of these options provide details about permissions. Here are a few important ls options for security analysts:
- ls -a: Displays hidden files. Hidden files start with a period (.) at the beginning.
- ls -l: Displays permissions to files and directories. Also displays other additional information, including owner name, group, file size, and the time of last modification.
- ls -la: Displays permissions to files and directories, including hidden files. This is a combination of the other two options.
## Changing permissions
The **principle of least privilege** is the concept of granting only the minimal access and authorization required to complete a task or function. In other words, users should not have privileges that are beyond what is necessary. Not following the principle of least privilege can create security risks.
The chmod command can help you manage this authorization. The chmod command changes permissions on files and directories.
### **Using chmod**
The chmod command requires two arguments. The first argument indicates how to change permissions, and the second argument indicates the file or directory that you want to change permissions for. For example, the following command would add all permissions to login\_sessions.txt:
chmod u+rwx,g+rwx,o+rwx login\_sessions.txt
If you wanted to take all the permissions away, you could use
chmod u-rwx,g-rwx,o-rwx login\_sessions.txt
Another way to assign these permissions is to use the equals sign (=) in this first argument. Using = with chmod sets, or assigns, the permissions exactly as specified. For example, the following command would set read permissions for login\_sessions.txt for user, group, and other:
chmod u=r,g=r,o=r login\_sessions.txt
This command overwrites existing permissions. For instance, if the user previously had write permissions, these write permissions are removed after you specify only read permissions with =.
The following table reviews how each character is used within the first argument of chmod:
**Character**
**Description**
u
indicates changes will be made to user permissions
g
indicates changes will be made to group permissions
o
indicates changes will be made to other permissions
+
adds permissions to the user, group, or other
-
removes permissions from the user, group, or other
=
assigns permissions for the user, group, or other
**Note:** When there are permission changes to more than one owner type, commas are needed to separate changes for each owner type. You should not add spaces after those commas.
### **The principle of least privilege in action**
As a security analyst, you may encounter a situation like this one: There’s a file called bonuses.txt within a compensation directory. The owner of this file is a member of the Human Resources department with a username of hrrep1. It has been decided that hrrep1 needs access to this file. But, since this file contains confidential information, no one else in the hr group needs access.
You run ls -l to check the permissions of files in the compensation directory and discover that the permissions for bonuses.txt are -rw-rw----. The group owner type has read and write permissions that do not align with the principle of least privilege.
To remedy the situation, you input chmod g-rw bonuses.txt. Now, only the user who needs to access this file to carry out their job responsibilities can access this file.
## Key takeaways
Managing directory and file permissions may be a part of your work as a security analyst. Using ls with the -l and -la options allows you to investigate directory and file permissions. Using chmod allows you to change user permissions and ensure they are aligned with the principle of least privilege.
# Add and delete users
Welcome back! In this video, we are going to discuss adding and deleting users.
This is related to the concept of authentication.
Authentication is the process of a user proving that they are who they say they are in the system.
Just like in a physical building, not all users should be allowed in.
Not all users should get access to the system.
But we also want to make sure everyone who should have access to the system has it.
That's why we need to add users.
New users can be new to the organization or new to a group.
This could be related to a change in organizational structure or simply a directive from management to move someone.
And also, when users leave the organization, they need to be deleted.
They should no longer have access to any part of the system.
Or if they simply changed groups, they should be deleted from groups that they are no longer a part of.
Now that we've sorted out why it's important to add and delete users, let's discuss a different type of user, the root user.
A root user, or superuser, is a user with elevated privileges to modify the system.
Regular users have limitations, where the root does not.
Individuals who need to perform specific tasks can be temporarily added as root users.
Root users can create, modify, or delete any file and run any program.
Only root users or accounts with root privileges can add new users. So you may be wondering how you become a superuser.
Well, one way is logging in as the root user, but running commands as the root user is considered to be bad practice when using Linux.
Why is running commands as a root user potentially problematic?
The first problem with logging in as root is the security risks.
Malicious actors will try to breach the root account.
Since it's the most powerful account, to stay safe, the root account should have logins disabled.
Another problem is that it's very easy to make irreversible mistakes.
It's very easy to type the wrong command in the CLI, and if you're running as the root user, you run a higher risk of making an irreversible mistake, such as permanently deleting a directory.
Finally, there's the concern of accountability.
In a multi-user environment like Linux, there are many users.
If a user is running as root, there is no way to track who exactly ran a command.
One solution to help solve this problem is sudo.
sudo is a command that temporarily grants elevated permissions to specific users.
This provides more of a controlled approach compared to root, which runs every command with root privileges.
sudo solves lots of problems associated with running as root.
sudo comes from super-user-do and lets you execute commands as an elevated user without having to sign in and out of another account.
Running sudo will prompt you to enter the password for the user you're currently logged in as.
Not all users on a system can become a superuser.
Users must be granted sudo access through a configuration file called the sudoers file.
Now that we've learned about sudo, let's learn how we can use it with another command to add users.
This command is useradd.
useradd adds a user to the system.
Only root or users with sudo privileges can use a useradd command.
Let's look at a specific example in which we need to add a user.
We'll imagine a new representative is joining the sales department and will be given the username of salesrep7.
We're tasked with adding them to the system.
Let's try adding the new user.
First, we need to use the sudo command, followed by the useradd command, and then last, the username we want to add, in this case, salesrep7.
This command doesn't display anything on the screen.
But since we get a new Bash cursor and not an error message, we can feel confident that
the command worked successfully.
If it didn't, an error message would have appeared.
Sometimes an error has to do with something simple like misspelling useradd.
Or, it might be because we didn't have sudo privileges.
Now let's learn how to do the opposite.
Let's learn how to delete a user with userdel.
userdel deletes a user from the system.
Similarly, we need root permissions that we'll access through sudo to use userdel.
Let's go back to our example of the user we added.
Let's imagine two months later, the sales representative that we just added to the system leaves the company.
That user should no longer have access to the system. Let's delete that user from the system.
Again, the sudo command is used first, then we add the userdel command.
Last, we add the name of the user we want to delete.
Again, we know it ran successfully because there is a new Bash cursor and not an error message.
Now, we've covered how to add and delete users and how these actions require sudo.
When using sudo, we have to use our best judgment.
These special privileges must be used responsibly to ensure a secure system.
# Responsible use of sudo
Previously, you explored authorization, authentication, and Linux commands with sudo, useradd, and userdel. The sudo command is important for security analysts because it allows users to have elevated permissions without risking the system by running commands as the root user. You’ll continue exploring authorization, authentication, and Linux commands in this reading and learn two more commands that can be used with sudo: usermod and chown.
## Responsible use of sudo
To manage authorization and authentication, you need to be a **root user,** or a user with elevated privileges to modify the system. The root user can also be called the “super user.” You become a root user by logging in as the root user. However, running commands as the root user is not recommended in Linux because it can create security risks if malicious actors compromise that account. It’s also easy to make irreversible mistakes, and the system can’t track who ran a command. For these reasons, rather than logging in as the root user, it’s recommended you use sudo in Linux when you need elevated privileges.
The sudo command temporarily grants elevated permissions to specific users. The name of this command comes from “super user do.” Users must be given access in a configuration file to use sudo. This file is called the “sudoers file.” Although using sudo is preferable to logging in as the root user, it's important to be aware that users with the elevated permissions to use sudo might be more at risk in the event of an attack.
You can compare this to a hotel with a master key. The master key can be used to access any room in the hotel. There are some workers at the hotel who need this key to perform their work. For example, to clean all the rooms, the janitor would scan their ID badge and then use this master key. However, if someone outside the hotel’s network gained access to the janitor’s ID badge and master key, they could access any room in the hotel. In this example, the janitor with the master key represents a user using sudo for elevated privileges. Because of the dangers of sudo, only users who really need to use it should have these permissions.
Additionally, even if you need access to sudo, you should be careful about using it with only the commands you need and nothing more. Running commands with sudo allows users to bypass the typical security controls that are in place to prevent elevated access to an attacker.
**Note**: Be aware of sudo if copying commands from an online source. It’s important you don’t use sudo accidentally.
## Authentication and authorization with sudo
You can use sudo with many authentication and authorization management tasks. As a reminder, **authentication** is the process of verifying who someone is, and **authorization** is the concept of granting access to specific resources in a system. Some of the key commands used for these tasks include the following:
### **useradd**
The useradd command adds a user to the system. To add a user with the username of fgarcia with sudo, enter sudo useradd fgarcia. There are additional options you can use with useradd:
- -g: Sets the user’s default group, also called their primary group
- -G: Adds the user to additional groups, also called supplemental or secondary groups
To use the -g option, the primary group must be specified after -g. For example, entering sudo useradd -g security fgarcia adds fgarcia as a new user and assigns their primary group to be security.
To use the -G option, the supplemental group must be passed into the command after -G. You can add more than one supplemental group at a time with the -G option. Entering sudo useradd -G finance,admin fgarcia adds fgarcia as a new user and adds them to the existing finance and admin groups.
### **usermod**
The usermod command modifies existing user accounts. The same -g and -G options from the useradd command can be used with usermod if a user already exists.
To change the primary group of an existing user, you need the -g option. For example, entering sudo usermod -g executive fgarcia would change fgarcia’s primary group to the executive group.
To add a supplemental group for an existing user, you need the -G option. You also need a -a option, which appends the user to an existing group and is only used with the -G option. For example, entering sudo usermod -a -G marketing fgarcia would add the existing fgarcia user to the supplemental marketing group.
**Note:** When changing the supplemental group of an existing user, if you don't include the -a option, -G will replace any existing supplemental groups with the groups specified after usermod. Using -a with -G ensures that the new groups are added but existing groups are not replaced.
There are other options you can use with usermod to specify how you want to modify the user, including:
- -d: Changes the user’s home directory.
- -l: Changes the user’s login name.
- -L: Locks the account so the user can’t log in.
The option always goes after the usermod command. For example, to change fgarcia’s home directory to /home/garcia\_f, enter sudo usermod -d /home/garcia\_f fgarcia. The option -d directly follows the command usermod before the other two needed arguments.
### **userdel**
The userdel command deletes a user from the system. For example, entering sudo userdel fgarcia deletes fgarcia as a user. Be careful before you delete a user using this command.
The userdel command doesn’t delete the files in the user’s home directory unless you use the -r option. Entering sudo userdel -r fgarcia would delete fgarcia as a user and delete all files in their home directory. Before deleting any user files, you should ensure you have backups in case you need them later.
**Note**: Instead of deleting the user, you could consider deactivating their account with usermod -L. This prevents the user from logging in while still giving you access to their account and associated permissions. For example, if a user left an organization, this option would allow you to identify which files they have ownership over, so you could move this ownership to other users.
### **chown**
The chown command changes ownership of a file or directory. You can use chown to change user or group ownership. To change the user owner of the access.txt file to fgarcia, enter sudo chown fgarcia access.txt. To change the group owner of access.txt to security, enter sudo chown :security access.txt. You must enter a colon (:) before security to designate it as a group name.
Similar to useradd, usermod, and userdel, there are additional options that can be used with chown.
## Key takeaways
Authentication is the process of a user verifying their identity, and authorization is the process of determining what they have access to. You can use the sudo command to temporarily run commands with elevated privileges to complete authentication and authorization management tasks. Specifically, useradd, userdel,usermod, and chown can be used to manage users and file ownership.
# The Linux community
There are so many others just like you who will be using the command line.
Linux's popularity and ease of use has created a large online community that constantly publishes information to help users learn how to operate Linux.
Since Linux is open-source, it has become a global community of users that contribute frequently.
This global community is a huge resource for all Linux users because users can find answers for everyday tasks.
Just searching on the internet will provide many answers.
The easiest way to troubleshoot a task is to search and read about how someone else has done it.
Looking for resources on how to execute a task is a good way for beginners to continue learning.
So far, you've learned how to add users, but imagine if later you want to add a new group.
One way to learn how to do this is to search online.
Let's give this a try through a Google search.
The search results give us many options for adding a group in Linux.
Another reputable source is a Unix & Linux Stack Exchange.
Their answers are ranked with points to display high-quality answers.
Many questions relate to more advanced users and are geared towards troubleshooting.
Well, now you know where to get some extra support whenever in doubt about topics in Linux.
There is a lot of support just a click away.
Coming up, we'll learn how to get support from within the command line itself. Join me.
# Linux resources
Previously, you were introduced to the Linux community and some resources that exist to help Linux users. Linux has many options available to give users the information they need. This reading will review these resources. When you’re aware of the resources available to you, you can continue to learn Linux independently. You can also discover even more ways that Linux can support your work as a security analyst.
## Linux community
Linux has a large online community, and this is a huge resource for Linux users of all levels. You can likely find the answers to your questions with a simple online search. Troubleshooting issues by searching and reading online is an effective way to discover how others approached your issue. It’s also a great way for beginners to learn more about Linux.
The [UNIX and Linux Stack Exchange](https://unix.stackexchange.com/)
is a trusted resource for troubleshooting Linux issues. The Unix and Linux Stack Exchange is a question and answer website where community members can ask and answer questions about Linux. Community members vote on answers, so the higher quality answers are displayed at the top. Many of the questions are related to specific topics from advanced users, and the topics might help you troubleshoot issues as you continue using Linux.
## Integrated Linux support
Linux also has several commands that you can use for support.
### **man**
The man command displays information on other commands and how they work. It’s short for “manual.” To search for information on a command, enter the command after man. For example, entering man chown returns detailed information about chown, including the various options you can use with it. The output of the man command is also called a “man page.”
### **apropos**
The apropos command searches the man page descriptions for a specified string. aprops comes from the French phrase à *propos,* meaning *“to the purpose”.* Man pages can be lengthy and difficult to search through if you’re looking for a specific keyword. To use apropos, enter the keyword after apropos.
You can also include the -a option to search for multiple words. For example, entering apropos -a graph editor outputs man pages that contain both the words “graph" and "editor” in their descriptions.
### **whatis**
The whatis command displays a description of a command on a single line. For example, entering whatis nano outputs the description of nano. This command is useful when you don't need a detailed description, just a general idea of the command. This might be as a reminder. Or, it might be after you discover a new command through a colleague or online resource and want to know more.
## Key takeaways
There are many resources available for troubleshooting issues or getting support for Linux. Linux has a large global community of users who ask and answer questions on online resources, such as the Unix and Linux Stack Exchange. You can also use integrated support commands in Linux, such as man, apropos, and whatis.
## Resources for more information
There are many resources available online that can help you learn new Linux concepts, review topics, or ask and answer questions with the global Linux community. The [Unix and Linux Stack Exchange](https://unix.stackexchange.com/ "This resource is a great place to ask and answer questions about Linux with the online community.")is one example, and you can search online to find others.
# Wrap-up; Glossary terms from week 3
Congratulations! You completed another section in this course.
Take a minute to think about what you've achieved.
You learned a lot in this section. Let's recap what we covered.
In this section, you utilized the command line to communicate with the OS.
Part of this was using commands for navigating and managing the file system.
And you used other commands for authenticating and authorizing users.
These are all tasks that a security analyst is likely to encounter.
Finally, you learned about accessing resources that support
learning new Linux commands.
With this knowledge, you'll be able to continue learning more and
more about using the command line.
We did it! we learned how to communicate with Linux.
That's a great accomplishment, and
one that will be very useful to you in your career as a security analyst.
You should be proud of the work that you've done so far.
---
### **Terms and definitions from Course 4, Week 3**
**Absolute file path:** The full file path, which starts from the root
**Argument (Linux):** Specific information needed by a command
**Authentication:** The process of verifying who someone is
**Authorization:** The concept of granting access to specific resources in a system
**Bash:** The default shell in most Linux distributions
**Command:** An instruction telling the computer to do something
**File path:** The location of a file or directory
**Filesystem Hierarchy Standard (FHS):** The component of the Linux OS that organizes data
**Filtering:** Selecting data that match a certain condition
**nano:** A command-line file editor that is available by default in many Linux distributions
**Options:** Input that modifies the behavior of a command
**Permissions:** The type of access granted for a file or directory
**Principle of least privilege:** The concept of granting only the minimal access and authorization required to complete a task or function
**Relative file path:** A file path that starts from the user's current directory
**Root directory:** The highest-level directory in Linux
**Root user (or superuser):** A user with elevated privileges to modify the system
**Standard input:** Information received by the OS via the command line
**Standard output:** Information returned by the OS through the shell
# Damar: My journey into Linux commands
My name is Damar, I'm a security engineer here at Google.
I've always wanted to get into cybersecurity since I was a kid.
A lot of the cartoons I watched, they had like floppy disks or flash drives, and they would put that in the computer and kind of like cause havoc.
\[LAUGH\] So I always thought that was really cool.
I've had quite a bit of jobs before coming to Google.
I originally started out making smoothies at Jamba Juice.
I got my first IT technological kind of job at Geek Squad and then eventually came here and became a security engineer.
My advice to people trying to get into cybersecurity is it may be a lot easier than you think.
\[LAUGH\] It definitely was a lot easier than I thought.
Something that I learned jumping in myself is that you're not going to be able to learn everything all at once, and you're not going to need to know everything all at once.
Linux is very important because it's broadly used across pretty much every company.
You may use Linux to curate logs.
It's a very common practice you may also use Linux to set up bash jobs that will help with routine tasks within Linux.
I first got interested in learning Linux from the Jurassic Park movie.
There's a scene in the movie where they need to reactivate the electrical doors, and they have to use a UNIX operating system to do so.
So later on, I learned what UNIX was and how Linux came from it, and it inspired me to learn more about Linux.
The best advice I can give someone that's trying to learn Linux and Linux commands is, don't get discouraged by any small hiccups that come up.
Just keep with it.
Stick with it.
Think of it as when you first learned to swim, right, you probably weren't that great at it.
\[LAUGH\] It was frustrating, and you were probably a little scared, but you're stuck with it and I hope that you're able to swim now.
\[LAUGH\] There are a plethora of support resources when learning Linux.
One good example is the discussion forum in the certificate course.
Another avenue of support for learning Linux is just googling answers using Stack Overflow, maybe even making a Reddit post.
I love working in cybersecurity.
It's pretty satisfying to know that me and my team and then like all the other security teams here at Google are helping protect people online from things they may not even know about.
# SQL and Databases
# Welcome to week 4; SQL and Databases
In the world of security, diversity is important.
Diverse perspectives are often needed to find effective solutions.
This is also true of the tools we use.
Your job will often require you to use a lot of diverse tools.
In the last section, we studied the Linux command line and learned how this tool can help you search and filter through data, navigate through the Linux file system, and authenticate users.
Now, we'll learn about another tool.
In this section, we'll explore SQL and how it allows you to analyze data in a way needed for your role as a security analyst.
We're going to start off by learning about relational databases and how they're structured.
From there, we're going to introduce SQL queries and how to use them to access data from databases.
We then move on to SQL filters, which help us refine our queries to get the exact information we need.
Lastly, we'll explore SQL joins, which allow you to combine tables together.
When I'm presented with a problem or a project at work, I often have to sift through a large amount of data.
When I use SQL, I'm able to review data quickly and provide results with confidence since the queries are
consistent and easily executed.
SQL is a very powerful and flexible tool.
Throughout this section, you'll learn how to use the parts of it you need as a security analyst and gain hands-on experience.
Good luck, and I'll join you for the rest of the course!
---
# New Page
# Introduction to databases
Our modern world is filled with data and that data almost always guides us in making important decisions.
When working with large amounts of data, we need to know how to store it, so it's organized and quick to access and process.
The solution to this is through databases, and that's what we're exploring in this video!
To start us off, we can define a database as an organized collection of information or data.
Databases are often compared to spreadsheets.
Some of you may have used Google Sheets or another common spreadsheet program in the past.
While these programs are convenient ways to store data, spreadsheets are often designed for a single user or a small team to store less data.
In contrast, databases can be accessed by multiple people simultaneously and can store massive amounts of data.
Databases can also perform complex tasks while accessing data.
As a security analyst, you'll often need to access databases containing useful information.
For example, these could be databases containing information on login attempts, software and updates, or machines and their owners.
Now that we know how important databases are for us, let's talk about how they're organized and how we can interact with them.
Using databases allow us to store large amounts of data while keeping it quick and easy to access.
There are lots of different ways we can structure a database, but in this course, we'll be working with relational databases.
A relational database is a structured database containing tables that are related to each other.
Let's learn more about what makes a relational database.
We'll start by examining an individual table in a larger database of organizational information.
Each table contains fields of information.
For example, in this table on employees, these would include fields like employee\_id, device\_id, and username.
These are the columns of the tables.
In addition, tables contain rows also called records.
Rows are filled with specific data related to the columns in the table.
For example, our first row is a record for an employee whose id is 1,000 and
who works in the marketing department.
Relational databases often have multiple tables.
Consider an example where we have two tables from a larger database, one with employees of the company and another with machines given to those employees.
We can connect two tables if they share a common column.
In this example, we establish a relationship between them with a common employee\_id column.
The columns that relate two tables to each other are called keys.
There are two types of keys.
The first is called a primary key.
The primary key refers to a column where every row has a unique entry.
The primary key must not have any duplicate values, or any null or empty values.
The primary key allows us to uniquely identify every row in our table.
For the table of employees, employee\_id is a primary key.
Every employee\_id is unique and there are no employee\_ids that are duplicate or empty.
The second type of key is a foreign key.
The foreign key is a column in a table that is a primary key in another table.
Foreign keys, unlike primary keys, can have empty values and duplicates.
The foreign key allows us to connect two tables together.
In our example, we can look at the employee\_id column in the machines table.
We previously identified this as a primary key in the employees table, so we can use this to connect every machine to their corresponding employee.
It's also important to know that a table can only have one primary key, but multiple foreign keys.
With this information, we're ready to move on to the basics of SQL, the language that lets us work with databases.
Throughout this section, we'll gain hands-on experience working with the concepts we just covered!
# SQL filtering versus Linux filtering
Previously, you explored the Linux commands that allow you to filter for specific information contained within files or directories. And, more recently, you examined how SQL helps you efficiently filter for the information you need. In this reading, you'll explore differences between the two tools as they relate to filtering. You'll also learn that one way to access SQL is through the Linux command line.
## Accessing SQL
There are many interfaces for accessing SQL and many different versions of SQL. One way to access SQL is through the Linux command line.
To access SQL from Linux, you need to type in a command for the version of SQL that you want to use. For example, if you want to access SQLite, you can enter the command sqlite3 in the command line.
After this, any commands typed in the command line will be directed to SQL instead of Linux commands.
## Differences between Linux and SQL filtering
Although both Linux and SQL allow you to filter through data, there are some differences that affect which one you should choose.
### **Structure**
SQL offers a lot more structure than Linux, which is more free-form and not as tidy.
For example, if you wanted to access a log of employee log-in attempts, SQL would have each record separated into columns. Linux would print the data as a line of text without this organization. As a result, selecting a specific column to analyze would be easier and more efficient in SQL.
In terms of structure, SQL provides results that are more easily readable and that can be adjusted more quickly than when using Linux.
### **Joining tables**
Some security-related decisions require information from different tables. SQL allows the analyst to join multiple tables together when returning data. Linux doesn’t have that same functionality; it doesn’t allow data to be connected to other information on your computer. This is more restrictive for an analyst going through security logs.
### **Best uses**
As a security analyst, it’s important to understand when you can use which tool. Although SQL has a more organized structure and allows you to join tables, this doesn’t mean that there aren’t situations that would require you to filter data in Linux.
A lot of data used in cybersecurity will be stored in a database format that works with SQL. However, other logs might be in a format that is not compatible with SQL. For instance, if the data is stored in a text file, you cannot search through it with SQL. In those cases, it is useful to know how to filter in Linux.
## Key takeaways
To work with SQL, you can access it from multiple different interfaces, such as the Linux command line. Both SQL and Linux allow you to filter for specific data, but SQL offers the advantages of structuring the data and allowing you to join data from multiple tables.
# Adedayo: SQL in cybersecurity
My name is Adedayo, and I'm a Security Engineer at Google.
A lot of people think you need to have a degree in computer science, right to be able to get into cybersecurity. I don't think that's true.
Take me for an example, I started learning IT from Lagos, Nigeria where I was born and raised, and then I'm all the way here now
in Silicon Valley, working for Google.
I think that's just amazing and a dream come true.
You taking this certificate is a first step to you making a commitment to switching your career to cybersecurity. Kudos to you on that.
SQL is one of the skillset you need to have in your toolbox as a cybersecurity professional because you can very quickly make decisions, not just off the bat, but make decisions with data backing you, and be able to communicate with your team, with stakeholders about why you made a decision because it's one thing to be able to say, we need to do this, it's
another thing to say we need to do this and here's the data that I wrote my SQL statements about.
I learned SQL by, first, as a coursework in school, that was really great, but I think I forgot everything about that after school.
The next step that I took was taking online courses, such as the one you're taking right now to learn SQL and the fundamentals
about it and how to really use it.
Then the first time I used SQL practically was at Google.
You really need to practice.
I think with anything else, practice makes perfect.
Being able to, even if it's just a few hours a week, put aside time to practice writing SQL statement.
Having that skill is something that will be very applicable to your first job, and you can use that to make data-driven decisions.
I feel very fulfilled working in cybersecurity.
I feel very energized, come into work every day.
Not only because I get to work on really complex problems and try to figure out solutions for them, but I also have great teammates that we all come together and tackle the problem.
Being able to go to bed at night, knowing that the work that I do is for the better of Google users and Google employees
is a very rewarding feeling for me.
# Basic queries
In this video, we're going to be running our very first SQL query!
This query will be based on a common work task that you might encounter as a security analyst.
We're going to determine which computer has been assigned to a certain employee.
Let's say we have access to the employees table.
The employees table has five columns.
Two of them, employee\_id and device\_id, contain the information that we need.
We'll write a query to this table that returns only those two columns from the table.
The two SQL keywords we need for basic SQL queries are SELECT and FROM.
SELECT indicates which columns to return.
FROM indicates which table to query.
The use of these keywords in SQL is very similar to how we would use these words in everyday language.
For example, we can ask a friend to select apples and bananas from the big box when going out to buy fruit.
This is already very similar to SQL.
So let's go ahead and use SELECT and FROM in SQL to return the information we need on employees and the computers they use.
We start off by typing in the SQL statement.
After FROM, we've identified that the information will be pulled from the employees table.
And after SELECT, employee\_id and device\_id indicate the two columns we want to return from this table.
Notice how a comma separates the two columns that we want to return.
It's also worth mentioning a couple of key aspects related to the syntax of SQL here.
Syntax refers to the rules that determine what is correctly structured in a computing language.
In SQL, keywords are not case-sensitive, so you could also write select and from in lowercase, but we're placing them in capital letters because it makes the query easier to understand.
Another aspect of this syntax is that semicolons are placed at the end of the statement.
And now, we'll run the query by pressing Enter.
The output gives us the information we need to match employees to their computers.
We just ran our very first SQL query!
Suppose you wanted to know what department the employee using the computer is from, or their username, or the office they work in.
To do that, we can use SQL to make another statement that prints out all of the columns from the table.
We can do this by placing an asterisk after SELECT.
This is commonly referred to as select all.
Now, let's run this query to the employees table in SQL.
And now we have the full table in the output.
You just made it through a basic query in SQL, congratulations!
In the next video, we'll learn how to add filters to our queries, so I'll meet you there!
# Query a database
Previously, you explored how SQL is an important tool in the world of cybersecurity and is essential when querying databases. You examined a few basic SQL queries and keywords used to extract needed information from a database. In this reading, you’ll review those basic SQL queries and learn a new keyword that will help you organize your output. You'll also learn about the Chinook database, which this course uses for queries in readings and quizzes.
## Basic SQL query
There are two essential keywords in any SQL query: SELECT and FROM. You will use these keywords every time you want to query a SQL database. Using them together helps SQL identify what data you need from a database and the table you are returning it from.
The video demonstrated this SQL query:
SELECT employee\_id, device\_idFROM employees;
In readings and quizzes, this course uses a sample database called the Chinook database to run queries. The Chinook database includes data that might be created at a digital media company. A security analyst employed by this company might need to query this data. For example, the database contains eleven tables, including an employees table, a customers table, and an invoices table. These tables include data such as names and addresses.
As an example, you can run this query to return data from the customers table of the Chinook database:
SELECT customerid, city, country
FROM customers;
```
+------------+---------------------+----------------+
| CustomerId | City | Country |
+------------+---------------------+----------------+
| 1 | São José dos Campos | Brazil |
| 2 | Stuttgart | Germany |
| 3 | Montréal | Canada |
| 4 | Oslo | Norway |
| 5 | Prague | Czech Republic |
| 6 | Prague | Czech Republic |
| 7 | Vienne | Austria |
| 8 | Brussels | Belgium |
| 9 | Copenhagen | Denmark |
| 10 | São Paulo | Brazil |
| 11 | São Paulo | Brazil |
| 12 | Rio de Janeiro | Brazil |
| 13 | Brasília | Brazil |
| 14 | Edmonton | Canada |
| 15 | Vancouver | Canada |
| 16 | Mountain View | USA |
| 17 | Redmond | USA |
| 18 | New York | USA |
| 19 | Cupertino | USA |
| 20 | Mountain View | USA |
| 21 | Reno | USA |
| 22 | Orlando | USA |
| 23 | Boston | USA |
| 24 | Chicago | USA |
| 25 | Madison | USA |
+------------+---------------------+----------------+
(Output limit exceeded, 25 of 59 total rows shown)
```
The SELECT keyword indicates which columns to return. For example, you can return the customerid column from the Chinook database with
SELECT customerid
You can also select multiple columns by separating them with a comma. For example, if you want to return both the customerid and city columns, you should write SELECT customerid, city.
If you want to return all columns in a table, you can follow the SELECT keyword with an asterisk (\*). The first line in the query will be SELECT \*.
**Note:** Although the tables you're querying in this course are relatively small, using SELECT \* may not be advisable when working with large databases and tables; in those cases, the final output may be difficult to understand and might be slow to run.
### **FROM**
The SELECT keyword always comes with the FROM keyword. FROM indicates which table to query. To use the FROM keyword, you should write it after the SELECT keyword, often on a new line, and follow it with the name of the table you’re querying. If you want to return all columns from the customers table, you can write:
SELECT \*FROM customers;
When you want to end the query here, you put a semicolon (;) at the end to tell SQL that this is the entire query.
**Note:** Line breaks are not necessary in SQL queries, but are often used to make the query easier to understand. If you prefer, you can also write the previous query on one line as
SELECT \* FROM customers;
and here would be the databases answer for
SELECT \* FROM customers ORDER BY country, city;
```
+------------+-----------+-------------+--------------------------------------------------+--------------------------------------+---------------------+-------+----------------+------------+---------------------+--------------------+-------------------------------+--------------+
| CustomerId | FirstName | LastName | Company | Address | City | State | Country | PostalCode | Phone | Fax | Email | SupportRepId |
+------------+-----------+-------------+--------------------------------------------------+--------------------------------------+---------------------+-------+----------------+------------+---------------------+--------------------+-------------------------------+--------------+
| 56 | Diego | Gutiérrez | None | 307 Macacha Güemes | Buenos Aires | None | Argentina | 1106 | +54 (0)11 4311 4333 | None | diego.gutierrez@yahoo.ar | 4 |
| 55 | Mark | Taylor | None | 421 Bourke Street | Sidney | NSW | Australia | 2010 | +61 (02) 9332 3633 | None | mark.taylor@yahoo.au | 4 |
| 7 | Astrid | Gruber | None | Rotenturmstraße 4, 1010 Innere Stadt | Vienne | None | Austria | 1010 | +43 01 5134505 | None | astrid.gruber@apple.at | 5 |
| 8 | Daan | Peeters | None | Grétrystraat 63 | Brussels | None | Belgium | 1000 | +32 02 219 03 03 | None | daan_peeters@apple.be | 4 |
| 13 | Fernanda | Ramos | None | Qe 7 Bloco G | Brasília | DF | Brazil | 71020-677 | +55 (61) 3363-5547 | +55 (61) 3363-7855 | fernadaramos4@uol.com.br | 4 |
| 12 | Roberto | Almeida | Riotur | Praça Pio X, 119 | Rio de Janeiro | RJ | Brazil | 20040-020 | +55 (21) 2271-7000 | +55 (21) 2271-7070 | roberto.almeida@riotur.gov.br | 3 |
| 1 | Luís | Gonçalves | Embraer - Empresa Brasileira de Aeronáutica S.A. | Av. Brigadeiro Faria Lima, 2170 | São José dos Campos | SP | Brazil | 12227-000 | +55 (12) 3923-5555 | +55 (12) 3923-5566 | luisg@embraer.com.br | 3 |
| 10 | Eduardo | Martins | Woodstock Discos | Rua Dr. Falcão Filho, 155 | São Paulo | SP | Brazil | 01007-010 | +55 (11) 3033-5446 | +55 (11) 3033-4564 | eduardo@woodstock.com.br | 4 |
| 11 | Alexandre | Rocha | Banco do Brasil S.A. | Av. Paulista, 2022 | São Paulo | SP | Brazil | 01310-200 | +55 (11) 3055-3278 | +55 (11) 3055-8131 | alero@uol.com.br | 5 |
| 14 | Mark | Philips | Telus | 8210 111 ST NW | Edmonton | AB | Canada | T6G 2C7 | +1 (780) 434-4554 | +1 (780) 434-5565 | mphilips12@shaw.ca | 5 |
| 31 | Martha | Silk | None | 194A Chain Lake Drive | Halifax | NS | Canada | B3S 1C5 | +1 (902) 450-0450 | None | marthasilk@gmail.com | 5 |
| 3 | François | Tremblay | None | 1498 rue Bélanger | Montréal | QC | Canada | H2G 1A7 | +1 (514) 721-4711 | None | ftremblay@gmail.com | 3 |
| 30 | Edward | Francis | None | 230 Elgin Street | Ottawa | ON | Canada | K2P 1L7 | +1 (613) 234-3322 | None | edfrancis@yachoo.ca | 3 |
| 29 | Robert | Brown | None | 796 Dundas Street West | Toronto | ON | Canada | M6J 1V1 | +1 (416) 363-8888 | None | robbrown@shaw.ca | 3 |
| 15 | Jennifer | Peterson | Rogers Canada | 700 W Pender Street | Vancouver | BC | Canada | V6C 1G8 | +1 (604) 688-2255 | +1 (604) 688-8756 | jenniferp@rogers.ca | 3 |
| 32 | Aaron | Mitchell | None | 696 Osborne Street | Winnipeg | MB | Canada | R3L 2B9 | +1 (204) 452-6452 | None | aaronmitchell@yahoo.ca | 4 |
| 33 | Ellie | Sullivan | None | 5112 48 Street | Yellowknife | NT | Canada | X1A 1N6 | +1 (867) 920-2233 | None | ellie.sullivan@shaw.ca | 3 |
| 57 | Luis | Rojas | None | Calle Lira, 198 | Santiago | None | Chile | None | +56 (0)2 635 4444 | None | luisrojas@yahoo.cl | 5 |
| 5 | František | Wichterlová | JetBrains s.r.o. | Klanova 9/506 | Prague | None | Czech Republic | 14700 | +420 2 4172 5555 | +420 2 4172 5555 | frantisekw@jetbrains.com | 4 |
| 6 | Helena | Holý | None | Rilská 3174/6 | Prague | None | Czech Republic | 14300 | +420 2 4177 0449 | None | hholy@gmail.com | 5 |
| 9 | Kara | Nielsen | None | Sønder Boulevard 51 | Copenhagen | None | Denmark | 1720 | +453 3331 9991 | None | kara.nielsen@jubii.dk | 4 |
| 44 | Terhi | Hämäläinen | None | Porthaninkatu 9 | Helsinki | None | Finland | 00530 | +358 09 870 2000 | None | terhi.hamalainen@apple.fi | 3 |
| 42 | Wyatt | Girard | None | 9, Place Louis Barthou | Bordeaux | None | France | 33000 | +33 05 56 96 96 96 | None | wyatt.girard@yahoo.fr | 3 |
| 43 | Isabelle | Mercier | None | 68, Rue Jouvence | Dijon | None | France | 21000 | +33 03 80 73 66 99 | None | isabelle_mercier@apple.fr | 3 |
| 41 | Marc | Dubois | None | 11, Place Bellecour | Lyon | None | France | 69002 | +33 04 78 30 30 30 | None | marc.dubois@hotmail.com | 5 |
+------------+-----------+-------------+--------------------------------------------------+--------------------------------------+---------------------+-------+----------------+------------+---------------------+--------------------+-------------------------------+--------------+
(Output limit exceeded, 25 of 59 total rows shown)
```
## ORDER BY
Database tables are often very complicated, and this is where other SQL keywords come in handy. ORDER BY is an important keyword for organizing the data you extract from a table.
ORDER BY sequences the records returned by a query based on a specified column or columns. This can be in either ascending or descending order.
### **Sorting in ascending order**
To use the ORDER BY keyword, write it at the end of the query and specify a column to base the sort on. In this example, SQL will return the customerid, city, and country columns from the customers table, and the records will be sequenced by the city column:
SELECT customerid, city, country
FROM customers
ORDER BY city;
```
+------------+--------------+----------------+
| CustomerId | City | Country |
+------------+--------------+----------------+
| 48 | Amsterdam | Netherlands |
| 59 | Bangalore | India |
| 36 | Berlin | Germany |
| 38 | Berlin | Germany |
| 42 | Bordeaux | France |
| 23 | Boston | USA |
| 13 | Brasília | Brazil |
| 8 | Brussels | Belgium |
| 45 | Budapest | Hungary |
| 56 | Buenos Aires | Argentina |
| 24 | Chicago | USA |
| 9 | Copenhagen | Denmark |
| 19 | Cupertino | USA |
| 58 | Delhi | India |
| 43 | Dijon | France |
| 46 | Dublin | Ireland |
| 54 | Edinburgh | United Kingdom |
| 14 | Edmonton | Canada |
| 26 | Fort Worth | USA |
| 37 | Frankfurt | Germany |
| 31 | Halifax | Canada |
| 44 | Helsinki | Finland |
| 34 | Lisbon | Portugal |
| 52 | London | United Kingdom |
| 53 | London | United Kingdom |
+------------+--------------+----------------+
(Output limit exceeded, 25 of 59 total rows shown)
```
The ORDER BY keyword sorts the records based on the column specified after this keyword. By default, as shown in this example, the sequence will be in ascending order. This means
- if you choose a column containing numeric data, it sorts the output from the smallest to largest. For example, if sorting on customerid, the ID numbers are sorted from smallest to largest.
- if the column contains alphabetic characters, such as in the example with the city column, it orders the records from the beginning of the alphabet to the end.
### **Sorting in descending order**
You can also use the ORDER BY with the DESC keyword to sort in descending order. The DESC keyword is short for "descending" and tells SQL to sort numbers from largest to smallest, or alphabetically from Z to A. This can be done by following ORDER BY with the DESC keyword. For example, you can run this query to examine how the results differ when DESC is applied:
SELECT customerid, city, country
FROM customers
ORDER BY city DESC;
```
+------------+---------------------+----------------+
| CustomerId | City | Country |
+------------+---------------------+----------------+
| 33 | Yellowknife | Canada |
| 32 | Winnipeg | Canada |
| 49 | Warsaw | Poland |
| 7 | Vienne | Austria |
| 15 | Vancouver | Canada |
| 27 | Tucson | USA |
| 29 | Toronto | Canada |
| 10 | São Paulo | Brazil |
| 11 | São Paulo | Brazil |
| 1 | São José dos Campos | Brazil |
| 2 | Stuttgart | Germany |
| 51 | Stockholm | Sweden |
| 55 | Sidney | Australia |
| 57 | Santiago | Chile |
| 28 | Salt Lake City | USA |
| 47 | Rome | Italy |
| 12 | Rio de Janeiro | Brazil |
| 21 | Reno | USA |
| 17 | Redmond | USA |
| 5 | Prague | Czech Republic |
| 6 | Prague | Czech Republic |
| 35 | Porto | Portugal |
| 39 | Paris | France |
| 40 | Paris | France |
| 30 | Ottawa | Canada |
+------------+---------------------+----------------+
(Output limit exceeded, 25 of 59 total rows shown)
```
Now, cities at the end of the alphabet are listed first.
### **Sorting based on multiple columns**
You can also choose multiple columns to order by. For example, you might first choose the country and then the city column. SQL then sorts the output by country, and for rows with the same country, it sorts them based on city. You can run this to explore how SQL displays this:
SELECT customerid, city, country
FROM customers
ORDER BY country, city;
```
+------------+---------------------+----------------+
| CustomerId | City | Country |
+------------+---------------------+----------------+
| 56 | Buenos Aires | Argentina |
| 55 | Sidney | Australia |
| 7 | Vienne | Austria |
| 8 | Brussels | Belgium |
| 13 | Brasília | Brazil |
| 12 | Rio de Janeiro | Brazil |
| 1 | São José dos Campos | Brazil |
| 10 | São Paulo | Brazil |
| 11 | São Paulo | Brazil |
| 14 | Edmonton | Canada |
| 31 | Halifax | Canada |
| 3 | Montréal | Canada |
| 30 | Ottawa | Canada |
| 29 | Toronto | Canada |
| 15 | Vancouver | Canada |
| 32 | Winnipeg | Canada |
| 33 | Yellowknife | Canada |
| 57 | Santiago | Chile |
| 5 | Prague | Czech Republic |
| 6 | Prague | Czech Republic |
| 9 | Copenhagen | Denmark |
| 44 | Helsinki | Finland |
| 42 | Bordeaux | France |
| 43 | Dijon | France |
| 41 | Lyon | France |
+------------+---------------------+----------------+
(Output limit exceeded, 25 of 59 total rows shown)
```
## Key takeaways
SELECT and FROM are important keywords in SQL queries. You use SELECT to indicate which columns to return and FROM to indicate which table to query. You can also include ORDER BY in your query to organize the output. These foundational SQL skills will support you as you move into more advanced queries.
# find table name and comumns definintion for SQL and variences
**Standard SQL:**
For databases that support the ANSI SQL standard and have the `INFORMATION_SCHEMA` views available, you can use the following query:
```sql
SELECT table_name, column_name
FROM information_schema.columns;
```
you can append if you want to specify where
```sql
WHERE table_schema = 'your_database_name';
```
if you want **Database-specific Queries:** If you are working with a specific database system and the standard SQL approach doesn't work, you can try the following methods:
**MySQL/MariaDB:**
```mysql
SELECT table_name, column_name
FROM information_schema.columns;
```
**or**
```mysql
SHOW TABLES;
DESCRIBE table_name;
```
**PostgreSQL:**
```sql
SELECT table_name, column_name
FROM information_schema.columns;
```
**SQLite:**
```sqlite
SELECT name AS table_name, sql AS column_definition
FROM sqlite_master
WHERE type = 'table';
```
You would run this SQLite command when you want to list all the tables in your SQLite database along with their SQL schema.
SQLite keeps a system table, `sqlite_master`, where it stores metadata about the database. Each row of `sqlite_master` represents an object (table, index, etc.) in the database.
The columns are:
- type: the type of the database object, such as 'table' or 'index'.
- name: the name of the object.
- tbl\_name: the name of the table to which the object is associated. For a table, it's the same as `name`.
- rootpage: the page number in the database file where the root B-tree page for the object is stored.
- sql: the SQL statement that created the object.
This command specifies `type = 'table'` in the `WHERE` clause, so it only selects tables, not other types of objects like indices. For each table, it selects the name (renamed as `table_name` for clarity) and the SQL statement that created the table (as `column_definition`).
So this command is useful when you need to know the structure of all tables in your SQLite database, such as the table names and their corresponding column definitions. It's a handy tool for exploring a database when you don't have the schema in front of you or when you've inherited a database and need to understand its structure.
# Basic filters on SQL queries
One of the most powerful features of SQL is its ability to filter.
In this video, we're going to learn how this helps us make better queries and select more specific pieces of data from a database.
Filtering is selecting data that match a certain condition.
Think of filtering as a way of only choosing the data we want.
Let's say we wanted to select apples from a fruit cart.
Filtering allows us to specify what kind of apples we want to choose.
When we go buy apples, we might explicitly say, "Choose only apples that are fresh."
This removes apples that aren't fresh from the selection.
This is a filter!
As a security analyst, you might filter a log-in attempts table to find all attempts from a specific country.
This could be done by applying a filter on the country column.
For example, you could filter to just return records containing Canada.
Before we get started, we need to focus on an important part of the syntax of SQL.
Let's learn about operators.
An operator is a symbol or keyword that represents an operation.
An example of an operator would be the equal to operator.
For example, if we wanted to find all records that have USA in the country column, we use country = 'USA'
To filter a query in SQL, we simply add an extra line to the SELECT and FROM statement we used before.
This extra line will use a WHERE clause.
In SQL, WHERE indicates the condition for a filter.
After the keyword WHERE, the specific condition is listed using operators.
So if we wanted to find all of the login attempts made in the United States, we would create this filter.
In this particular condition, we're indicating to return all records that have a value in the country column that is equal to USA.
Let's try putting it all together in SQL.
We're going to start with selecting all the columns from the log\_in\_attempts table. And then add the WHERE filter.
Don't forget the semicolon!
This tells us we finished the SQL statement.
Now, let's run this query! Because of our filter, only the rows where the country of the log-in attempt was USA are returned.
In the previous example, the condition for our filter was based simply on returning records that are equal to a particular value.
We can also make our conditions more complex by searching for a pattern instead of an exact word.
For example, in the employees table, we have a column for office.
We could search for records in this column that match a certain pattern.
Perhaps we might want all offices in the East building.
To search for a pattern, we used the percentage sign to act as a wildcard for unspecified characters.
If we ran a filter for 'East%', this would return all records that start with East --
for example, the offices East-120, East-290, and East-435.
When searching for patterns with the percentage sign, we cannot use the equals operator.
Instead, we use another operator, LIKE.
LIKE is an operator used with WHERE to search for a pattern in a column.
Since LIKE is an operator, similar to the equal sign, we use it instead of the equal sign.
So, when our goal is to return all values in the office column that start with the word East, LIKE would appear in a WHERE clause.
Let's go back to the example in which we wanted to filter for log-in attempts made in the United States.
Imagine that we realize that our database contains inconsistencies with how the United States is represented.
Some entries use US while others use USA.
Let's get into SQL and apply this new type of filter with LIKE.
We're going to start with the same first two lines of code because we want to select all columns from the log-in attempts table.
And we're going to add a filter with LIKE so that records will be returned if they contain a value in the country column beginning with the characters US.
This includes both US and USA.
Let's run this query to check if the output changes. This returns all the entries where the user location was in the United States.
And now we can use the LIKE clause to filter columns based on a pattern!
Wow, we've already learned how to get very precise with our database and get exactly the data we need with one single query.
I'm excited for what's next!
# The WHERE clause and basic operators
Previously, you focused on how to refine your SQL queries by using the WHERE clause to filter results. In this reading, you’ll further explore how to use the WHERE clause, the LIKE operator and the percentage sign (%) wildcard. You’ll also be introduced to the underscore (\_), another wildcard that can help you filter queries.
## How filtering helps
As a security analyst, you'll often be responsible for working with very large and complicated security logs. To find the information you need, you'll often need to use SQL to filter the logs.
In a cybersecurity context, you might use filters to find the login attempts of a specific user or all login attempts made at the time of a security issue. As another example, you might filter to find the devices that are running a specific version of an application.
## WHERE
To create a filter in SQL, you need to use the keyword WHERE. WHERE indicates the condition for a filter.
If you needed to email employees with a title of IT Staff, you might use a query like the one in the following example. You can run this example to examine what it returns:
---
```sql
SELECT firstname, lastname, title, email
FROM employees
WHERE title = 'IT Staff';
```
---
```
+-----------+----------+----------+------------------------+
| FirstName | LastName | Title | Email |
+-----------+----------+----------+------------------------+
| Robert | King | IT Staff | robert@chinookcorp.com |
| Laura | Callahan | IT Staff | laura@chinookcorp.com |
+-----------+----------+----------+------------------------+
```
---
Rather than returning all records in the employees table, this WHERE clause instructs SQL to return only those that contain 'IT Staff' in the title column. It uses the equals sign (=) operator to set this condition.
**Note:** You should place the semicolon (;) where the query ends. When you add a filter to a basic query, the semicolon is after the filter.
## Filtering for patterns
You can also filter based on a pattern. For example, you can identify entries that start or end with a certain character or characters. Filtering for a pattern requires incorporating two more elements into your WHERE clause:
- a wildcard
- the LIKE operator
### **Wildcards**
A **wildcard** is a special character that can be substituted with any other character. Two of the most useful wildcards are the percentage sign (%) and the underscore (\_):
- The percentage sign substitutes for any number of other characters.
- The underscore symbol only substitutes for one other character.
These wildcards can be placed after a string, before a string, or in both locations depending on the pattern you’re filtering for.
The following table includes these wildcards applied to the string 'a' and examples of what each pattern would return.
**Pattern**
**Results that could be returned**
'a%'
apple123, art, a
'a\_'
as, an, a7
'a\_\_'
ant, add, a1c
'%a'
pizza, Z6ra, a
'\_a'
ma, 1a, Ha
'%a%'
Again, back, a
'\_a\_'
Car, ban, ea7
### **LIKE**
To apply wildcards to the filter, you need to use the LIKE operator instead of an equals sign (=). LIKE is used with WHERE to search for a pattern in a column.
For instance, if you want to email employees with a title of either 'IT Staff' or 'IT Manager', you can use LIKE operator combined with the % wildcard:
---
```sql
SELECT lastname, firstname, title, email
FROM employees
WHERE title LIKE 'IT%';
```
---
```
+----------+-----------+------------+-------------------------+
| LastName | FirstName | Title | Email |
+----------+-----------+------------+-------------------------+
| Mitchell | Michael | IT Manager | michael@chinookcorp.com |
| King | Robert | IT Staff | robert@chinookcorp.com |
| Callahan | Laura | IT Staff | laura@chinookcorp.com |
+----------+-----------+------------+-------------------------+
```
---
This query returns all records with values in the title column that start with the pattern of 'IT'. This means both 'IT Staff' and 'IT Manager' are returned.
As another example, if you want to search through the invoices table to find all customers located in states with an abbreviation of 'NY', 'NV', 'NS' or 'NT', you can use the 'N\_' pattern on the state column:
---
```sql
SELECT firstname,lastname, state, country
FROM customers
WHERE state LIKE 'N_';
```
---
```
+-----------+----------+-------+---------+
| FirstName | LastName | State | Country |
+-----------+----------+-------+---------+
| Michelle | Brooks | NY | USA |
| Kathy | Chase | NV | USA |
| Martha | Silk | NS | Canada |
| Ellie | Sullivan | NT | Canada |
+-----------+----------+-------+---------+
```
---
This returns all the records with state abbreviations that follow this pattern.
## Key takeaways
Filters are important when refining what your query returns. WHERE is an essential keyword for adding a filter to your query. You can also filter for patterns by combining the LIKE operator with the percentage sign (%) and the underscore (\_) wildcards.
# Filter dates and numbers
In this video, we're going to continue using SQL queries and filters, but now we're going to apply them to new data types.
First, let's explore the three common data types that you will find in databases:
string, numeric, and date and time.
String data is data consisting of an ordered sequence of characters.
These characters could be numbers, letters, or symbols.
For example, you'll encounter string data in user names, such as a user name: analyst10.
Numeric data is data consisting of numbers, such as a count of log-in attempts.
Unlike strings, mathematical operations can be used on numeric data, like multiplication or addition.
Date and time data refers to data representing a date and/or time.
Previously, we applied filters using string data, but now let's work with numeric and date and time data.
As a security analyst, you'll often need to query numbers and dates.
For example, we could filter patch dates to find machines that need an update, or we could filter log-in attempts to return only
those made in a certain period of time.
We learned about operators in the last video, and we're going to use them again for numbers and dates.
Common operators for working with numeric or date and time data types include: equals, greater than, less than, not equal to, greater than or equal to, and less than or equal to.
Let's say you want to find the log-in attempts made after 6 pm.
Because this is past normal business hours, you want to look for suspicious patterns.
You can identify these attempts by using the greater than operator in your filter.
We'll start writing our query in SQL.
We begin by indicating that we want to select all columns FROM the log\_in\_attempts table.
Then we'll add our filter with WHERE.
Our condition indicates that the value in the time column must be greater than, or for dates and times, later than '18:00', which is how 6 pm is written in SQL.
Let's run this and examine the output.
Perfect! Now we have a list of log-in attempts made after 6 pm.
We can also filter for numbers and dates by using the BETWEEN operator.
BETWEEN is an operator that filters for numbers or dates within a range.
An example of this would be when looking for all patches installed within a certain range.
Let's do this! Let's find all the patches installed between March 1st, 2021 and September 1st, 2021.
In our query, we start with selecting all records FROM the machines table.
And we add the BETWEEN operator in the WHERE statement.
Let's break down the statement.
First, after WHERE, we indicate which column to filter, in our case, OS\_patch\_date.
Next, comes our operator BETWEEN.
We then add the beginning of our range, type AND, then finish by adding the end of our range and a semicolon.
Now, let's run this and explore the output.
And now we have a list of all machines patched between those two dates!
Before we wrap up, an important thing to note is that when we filter for strings,
dates, and times, we use quotation marks to specify what we're looking for.
However, for numbers, we don't use quotation marks.
With this new knowledge, you're now ready to work on all sorts of interesting filters for numbers and dates.
In the next video, we'll be able to expand our filtering even further by using multiple conditions in one query.
# Operators for filtering dates and numbers
Previously, you examined operators like less than (<) or greater than (>) and explored how they can be used in filtering numeric and date and time data types. This reading summarizes what you learned and provides new examples of using operators in filters.
## Numbers, dates, and times in cybersecurity
Security analysts work with more than just **string data**, or data consisting of an ordered sequence of characters.
They also frequently work with **numeric data**, or data consisting of numbers. A few examples of numeric data that you might encounter in your work as a security analyst include:
- the number of login attempts
- the count of a specific type of log entry
- the volume of data being sent from a source
- the volume of data being sent to a destination
You'll also encounter **date and time data**, or data representing a date and/or time. As a first example, logs will generally timestamp every record. Other time and date data might include:
- login dates
- login times
- dates for patches
- the duration of a connection
## Comparison operators
In SQL, filtering numeric and date and time data often involves operators. You can use the following operators in your filters to make sure you return only the rows you need:
**operator**
**use**
<
less than
>
greater than
=
equal to
<=
less than or equal to
>=
greater than or equal to
<>
not equal to
**Note:** You can also use != as an alternative operator for not equal to.
### Incorporating operators into filters
These comparison operators are used in the WHERE clause at the end of a query. The following query uses the > operator to filter the birthdate column. You can run this query to explore its output:
---
```sqlite
SELECT firstname, lastname, birthdate
FROM employees
WHERE birthdate > '1970-01-01';
```
---
```
+-----------+----------+---------------------+
| FirstName | LastName | BirthDate |
+-----------+----------+---------------------+
| Jane | Peacock | 1973-08-29 00:00:00 |
| Michael | Mitchell | 1973-07-01 00:00:00 |
| Robert | King | 1970-05-29 00:00:00 |
+-----------+----------+---------------------+
```
---
This query returns the first and last names of employees born after, but not on, '1970-01-01' (or January 1, 1970). If you were to use the >= operator instead, the results would also include results on exactly '1970-01-01'.
In other words, the > operator is exclusive and the >= operator is inclusive. An **exclusive operator** is an operator that does not include the value of comparison. An **inclusive operator** is an operator that includes the value of comparison.
### **BETWEEN**
Another operator used for numeric data as well as date and time data is the BETWEEN operator. BETWEEN filters for numbers or dates within a range. For example, if you want to find the first and last names of all employees hired between January 1, 2002 and January 1, 2003, you can use the BETWEEN operator as follows:
---
```
SELECT firstname, lastname, hiredate
FROM employees
WHERE hiredate BETWEEN '2002-01-01' AND '2003-01-01';
```
---
```
+-----------+----------+---------------------+
| FirstName | LastName | HireDate |
+-----------+----------+---------------------+
| Andrew | Adams | 2002-08-14 00:00:00 |
| Nancy | Edwards | 2002-05-01 00:00:00 |
| Jane | Peacock | 2002-04-01 00:00:00 |
+-----------+----------+---------------------+
```
---
**Note:** The BETWEEN operator is inclusive. This means records with a hiredate of January 1, 2002 or January 1, 2003 are included in the results of the previous query.
## Key takeaways
Operators are important when filtering numeric and date and time data. These include exclusive operators such as < and inclusive operators such as <=. The BETWEEN operator, another inclusive operator, helps you return the data you need within a range.
# Filters with AND, OR, and NOT
In the previous lesson, we learned about even more ways to filter queries in SQL to work with some typical security analyst tasks.
However, when working with real security questions, we often have to filter for multiple conditions.
Vulnerabilities, for instance, might depend on more than one factor.
For example, a security vulnerability might be related to machines using a specific email client on a specific operating system.
So, to find the possible vulnerabilities, we need to find machines using both the email client and the operating system.
To make a query with multiple conditions that must be met, we use the AND operator between two separate conditions.
AND is an operator that specifies that both conditions must be met simultaneously.
Bringing this back to our fruit and vegetable analogy, this is the same as asking someone to select apples from the big box where the apples are large and fresh.
This means our results won't include any small apples even if they're fresh, or any rotten apples even if they're large.
They'll only include large fresh apples.
The apples must meet both conditions.
Going back to our database, the machines table lists all operating systems and email clients.
We want a list of machines running Operating System 1 and a list of machines using Email Client 1.
We'll use the left and right circles in the Venn diagram to represent these groups.
We need SQL to select the machines that have both OS 1 and Email Client 1.
The filled-in area at the intersection of these circles represents this condition.
Let's take this and implement it in SQL.
First, we're going to start by building the first lines of the query, telling SQL to SELECT\* all columns FROM the machines table.
Then, we'll add the WHERE clause.
Let's examine this more closely.
First, we indicate the first condition that it must meet, that the operating system column has a value of '0S 1'
Then, we use AND to join this to another condition.
And finally, we enter the other condition, in this case that the email client column should have a value of 'Email Client 1'
And this is how you use the AND operator in SQL!
Let's run this to get the query results.
Perfect! All the results match both our conditions!
Let's keep going and explore more ways to combine different conditions by working with the OR operator.
The OR operator is an operator that specifies that either condition can be met.
In a Venn diagram, let's say each circle represents a condition.
When they are joined with OR,
SQL would select all rows that satisfy one of the conditions.
And it's also ok if it meets both conditions.
Let's run another query and use the OR operator.
Let's say that we wanted the filter to identify machines that have either OS 1 or OS 3 because both types need a patch.
We'll type in these conditions.
Let's examine this more closely.
After WHERE, our first condition indicates we want to filter, so that the query selects machines with 'OS 1'
We use the OR operator because we also want to find records that match another condition.
This additional condition is placed after OR and indicates to also select machines running 'OS 3'
Executing the query, our results now include records that have a value of either OS 1 or OS 3 in the operating system column.
Good job, we're running some complex queries.
The last operator we're going to go into is the NOT operator.
NOT negates a condition.
In a diagram, we can show this by selecting every entry that does not match our condition.
The condition is represented by the circle.
The filled-in portion outside the circle represents what gets returned.
This is all data that does not match the condition.
For example, when picking out fruit, you can be looking for any fruit that is not an apple.
That is a lot more efficient than telling your friend you want a banana or an orange or a lime, and so on.
Suppose you wanted to update all of the devices in your company except for the ones using OS 3.
Bringing this into SQL, we can write this query.
We place NOT after WHERE and before the condition of the filter.
Executing these queries gives us the list of all the machines that aren't running OS 3, and now we know which machines to update.
That was a lot of new content that we just looked into, but you're learning more and more SQL that you can use on your journey to become an analyst!
In the next video, we'll be learning how to combine and join two tables together to expand the kinds of queries we can run. I'll meet you there!
# More on filters with AND, OR, and NOT
Previously, you explored how to add filters containing the AND, OR, and NOT operators to your SQL queries. In this reading, you'll continue to explore how these operators can help you refine your queries.
## Logical operators
AND, OR, and NOT allow you to filter your queries to return the specific information that will help you in your work as a security analyst. They are all considered logical operators.
### AND
First, AND is used to filter on two conditions. AND specifies that both conditions must be met simultaneously.
As an example, a cybersecurity concern might affect only those customer accounts that meet both the condition of being handled by a support representative with an ID of 5 and the condition of being located in the USA. To find the names and emails of those specific customers, you should place the two conditions on either side of the AND operator in the WHERE clause:
---
```sqlite
SELECT firstname, lastname, email, country, supportrepid
FROM customers
WHERE supportrepid = 5 AND country = 'USA';
```
---
```
+-----------+----------+-------------------------+---------+--------------+
| FirstName | LastName | Email | Country | SupportRepId |
+-----------+----------+-------------------------+---------+--------------+
| Jack | Smith | jacksmith@microsoft.com | USA | 5 |
| Kathy | Chase | kachase@hotmail.com | USA | 5 |
| Victor | Stevens | vstevens@yahoo.com | USA | 5 |
| Julia | Barnett | jubarnett@gmail.com | USA | 5 |
+-----------+----------+-------------------------+---------+--------------+
```
---
Running this query returns four rows of information about the customers. You can use this information to contact them about the security concern.
### OR
The OR operator also connects two conditions, but OR specifies that either condition can be met. It returns results where the first condition, the second condition, or both are met.
For example, if you are responsible for finding all customers who are either in the USA or Canada so that you can communicate information about a security update, you can use an OR operator to find all the needed records. As the following query demonstrates, you should place the two conditions on either side of the OR operator in the WHERE clause:
---
```mysql
SELECT firstname, lastname, email, country
FROM customers
WHERE country = 'Canada' OR country = 'USA';
```
---
```
+-----------+----------+-------------------------+---------+--------------+
| FirstName | LastName | Email | Country | SupportRepId |
+-----------+----------+-------------------------+---------+--------------+
| Jack | Smith | jacksmith@microsoft.com | USA | 5 |
| Kathy | Chase | kachase@hotmail.com | USA | 5 |
| Victor | Stevens | vstevens@yahoo.com | USA | 5 |
| Julia | Barnett | jubarnett@gmail.com | USA | 5 |
+-----------+----------+-------------------------+---------+--------------+
```
---
The query returns all customers in either the US or Canada.
**Note:** Even if both conditions are based on the same column, you need to write out both full conditions. For instance, the query in the previous example contains the filter WHERE country = 'Canada' OR country = 'USA'.
### NOT
Unlike the previous two operators, the NOT operator only works on a single condition, and not on multiple ones. The NOT operator negates a condition. This means that SQL returns all records that don’t match the condition specified in the query.
For example, if a cybersecurity issue doesn't affect customers in the USA but might affect those in other countries, you can return all customers who are not in the USA. This would be more efficient than creating individual conditions for all of the other countries. To use the NOT operator for this task, write the following query and place NOT directly after WHERE:
---
```sqlite
SELECT firstname, lastname, email, country
FROM customers
WHERE NOT country = 'USA';
```
---
```
+-----------+-------------+-------------------------------+----------------+
| FirstName | LastName | Email | Country |
+-----------+-------------+-------------------------------+----------------+
| Luís | Gonçalves | luisg@embraer.com.br | Brazil |
| Leonie | Köhler | leonekohler@surfeu.de | Germany |
| François | Tremblay | ftremblay@gmail.com | Canada |
| Bjørn | Hansen | bjorn.hansen@yahoo.no | Norway |
| František | Wichterlová | frantisekw@jetbrains.com | Czech Republic |
| Helena | Holý | hholy@gmail.com | Czech Republic |
| Astrid | Gruber | astrid.gruber@apple.at | Austria |
| Daan | Peeters | daan_peeters@apple.be | Belgium |
| Kara | Nielsen | kara.nielsen@jubii.dk | Denmark |
| Eduardo | Martins | eduardo@woodstock.com.br | Brazil |
| Alexandre | Rocha | alero@uol.com.br | Brazil |
| Roberto | Almeida | roberto.almeida@riotur.gov.br | Brazil |
| Fernanda | Ramos | fernadaramos4@uol.com.br | Brazil |
| Mark | Philips | mphilips12@shaw.ca | Canada |
| Jennifer | Peterson | jenniferp@rogers.ca | Canada |
| Robert | Brown | robbrown@shaw.ca | Canada |
| Edward | Francis | edfrancis@yachoo.ca | Canada |
| Martha | Silk | marthasilk@gmail.com | Canada |
| Aaron | Mitchell | aaronmitchell@yahoo.ca | Canada |
| Ellie | Sullivan | ellie.sullivan@shaw.ca | Canada |
| João | Fernandes | jfernandes@yahoo.pt | Portugal |
| Madalena | Sampaio | masampaio@sapo.pt | Portugal |
| Hannah | Schneider | hannah.schneider@yahoo.de | Germany |
| Fynn | Zimmermann | fzimmermann@yahoo.de | Germany |
| Niklas | Schröder | nschroder@surfeu.de | Germany |
+-----------+-------------+-------------------------------+----------------+
(Output limit exceeded, 25 of 46 total rows shown)
```
---
SQL returns every entry where the customers are not from the USA.
**Pro tip:** Another way of finding values that are not equal to a certain value is by using the <> operator or the != operator. For example, WHERE country <> 'USA' and WHERE country != 'USA' are the same filters as WHERE NOT country = 'USA'.
## Combining logical operators
Logical operators can be combined in filters. For example, if you know that both the USA and Canada are not affected by a cybersecurity issue, you can combine operators to return customers in all countries besides these two. In the following query, NOT is placed before the first condition, it's joined to a second condition with AND, and then NOT is also placed before that second condition. You can run it to explore what it returns:
---
```sqlite
SELECT firstname, lastname, email, country
FROM customers
WHERE NOT country = 'Canada' AND NOT country = 'USA';
```
---
```
+-----------+-------------+-------------------------------+----------------+
| FirstName | LastName | Email | Country |
+-----------+-------------+-------------------------------+----------------+
| Luís | Gonçalves | luisg@embraer.com.br | Brazil |
| Leonie | Köhler | leonekohler@surfeu.de | Germany |
| Bjørn | Hansen | bjorn.hansen@yahoo.no | Norway |
| František | Wichterlová | frantisekw@jetbrains.com | Czech Republic |
| Helena | Holý | hholy@gmail.com | Czech Republic |
| Astrid | Gruber | astrid.gruber@apple.at | Austria |
| Daan | Peeters | daan_peeters@apple.be | Belgium |
| Kara | Nielsen | kara.nielsen@jubii.dk | Denmark |
| Eduardo | Martins | eduardo@woodstock.com.br | Brazil |
| Alexandre | Rocha | alero@uol.com.br | Brazil |
| Roberto | Almeida | roberto.almeida@riotur.gov.br | Brazil |
| Fernanda | Ramos | fernadaramos4@uol.com.br | Brazil |
| João | Fernandes | jfernandes@yahoo.pt | Portugal |
| Madalena | Sampaio | masampaio@sapo.pt | Portugal |
| Hannah | Schneider | hannah.schneider@yahoo.de | Germany |
| Fynn | Zimmermann | fzimmermann@yahoo.de | Germany |
| Niklas | Schröder | nschroder@surfeu.de | Germany |
| Camille | Bernard | camille.bernard@yahoo.fr | France |
| Dominique | Lefebvre | dominiquelefebvre@gmail.com | France |
| Marc | Dubois | marc.dubois@hotmail.com | France |
| Wyatt | Girard | wyatt.girard@yahoo.fr | France |
| Isabelle | Mercier | isabelle_mercier@apple.fr | France |
| Terhi | Hämäläinen | terhi.hamalainen@apple.fi | Finland |
| Ladislav | Kovács | ladislav_kovacs@apple.hu | Hungary |
| Hugh | O'Reilly | hughoreilly@apple.ie | Ireland |
+-----------+-------------+-------------------------------+----------------+
(Output limit exceeded, 25 of 38 total rows shown)
```
---
## Key takeaways
Logical operators allow you to create more specific filters that target the security-related information you need. The AND operator requires two conditions to be true simultaneously, the OR operator requires either one or both conditions to be true, and the NOT operator negates a condition. Logical operators can be combined together to create even more specific queries.
# Join tables in SQL
You've already learned a lot about SQL queries and filters. Nice work!
The last concept we're introducing in this section is joining tables when querying a database.
This is helpful when you need information from two different tables in a database.
Let's say we have two tables: one that tells us about security vulnerabilities of different operating systems, and one about different machines in our company, including their operating systems.
Having the ability to combine them gives us a list of vulnerable machines.
That's pretty cool, right?
First, let's start talking about the syntax of joins.
Since we're working with two tables now, we need a way to tell SQL what table we're picking columns from.
In our example database, we have an employee\_id column in both the employees table and the machines table.
In SQL statements that contain two columns, SQL needs to know which column we're referring to.
The way to resolve this is by writing the name of the table first, then a period, and then the name of a column.
So, we would have employees followed by a period, followed by the column name.
This is the employee\_id column for the employees table.
Similarly, this is the employee\_id column for the machines table.
Now that we understand this syntax, let's apply it to a join!
Imagine that we want to get a deeper understanding of the employees accessing the machines in our company.
By joining the employees and the machines tables, we can do this!
We first need to identify the shared column that we'll use to connect the two tables.
In this case, we'll use a primary key and one table to connect to another table where it's a foreign key.
The primary key of the employees table is employee\_id, which is a foreign key in the machines table.
employee\_id is a primary key in the employees table because it has a unique value for every row in
the employees table, and no empty values.
We don't have a guarantee that the employee\_id column in the machines table follows the same criteria since it's
a foreign key and not a primary key.
Next, we'll use a type of join called an INNER JOIN.
An INNER JOIN returns rows matching on a specified column that exists in more than one table.
Tables usually contain many more rows, but to further explain what we mean by INNER JOIN, let's focus on just four rows from the employees table and four rows from the machines table.
We'll also look at just a few columns of each table for this example.
Let's say we choose employee\_id in both tables to perform an INNER JOIN.
Let's look at the two rows where there is a match.
Both tables have 1188 and 1189 in their respective employee\_id columns, so they are considered a match.
The results of the join is the two rows that have 1188 and 1189 and all columns from both tables.
Before we move on to the queries, we have to talk about the NULL values in the tables.
In SQL, NULL represents a missing value due to any reason.
In this case, this might be machines that are not assigned to any employee.
Now, let's bring this into SQL and do an INNER JOIN on the full tables.
Let's imagine we want to join these tables in order to get a list of users and their office location that also shows
what operating system they use on their machines.
employee\_id is a common column between these tables, and we can use this to join them.
But we won't need to show this column in the results.
First, let's start with a basic query that indicates we want to select the username, office, and operating\_system columns.
We want employees to be our first or left table, so we'll use that in our FROM statement.
Now, we write the part of the query that tells SQL to join the machines table with the employees table.
Let's break down this query.
INNER JOIN tells SQL to perform the INNER JOIN.
Then, we name the second table we want to combine with the first.
This is called the right table.
In this case, we want to join machines with the employees table that was already identified after FROM.
Lastly, we tell SQL what column to base the join on.
In our case, we're using the employee\_id column.
Since we're using two tables, we have to identify the table and follow that with the column name.
So, we have employees.employee\_id. And machines.employee\_id.
Let's review the output.
Perfect! We have now joined two tables.
The results of our query displays the records that match on the employee\_id column.
Notice that these records contain columns from both tables, but only the ones we've indicated through our SELECT statement.
There are other types of joins that don't require a match to join two tables, and we're going to discuss those in
the next video. I'll meet you there!
# Types of joins
Welcome back. I hope you enjoyed working on inner joins.
In the previous video and exercises, we saw how inner joins can be useful by only returning records that share a value in specify columns.
However, in some situations, we might need all of the entries from one or both of our tables.
This is where we need to use outer joins.
There are three types of outer joins: LEFT JOIN, RIGHT JOIN, and FULL OUTER JOIN.
Similar to inner joins, outer joins combine two tables together; however, they don't necessarily need a match between columns to return a row.
Which rows are returned depends on the type of join.
LEFT JOIN returns all of the records of the first table, but only returns rows of the second table that match on a specified column.
Like we did in the previous video, let's examine this type of join by looking at just four rows of two tables with a small number of columns.
Employees is the left table, or the first table, and machines is the right table, or the second table.
Let's join on employee\_id.
There's a matching value in this column for two of the four records.
When we execute the join, SQL returns these rows with the matching value, all other rows from the left table, and all columns from both tables.
Records from the employees table that didn't match but were returned through the LEFT JOIN contain NULL values
in columns that came from the machines table.
Next, let's talk about right joins.
RIGHT JOIN returns all of the records of the second table but only returns rows from the first table that match on a specified column.
With a RIGHT JOIN on the previous example, the full result returns matching rows from both, all the rows from the second table, and all the columns in both tables.
For the values that don't exist in either table, we are left with a NULL value.
Last, we'll discuss full outer joins.
FULL OUTER JOIN returns all records from both tables. Using our same example, a FULL OUTER JOIN returns all columns from all tables.
If a row doesn't have a value for a particular column, it returns NULL.
For example, the machines table do not have any rows with employee\_id 1190, so the values for that row and the
columns that came from the machines table is NULL.
To implement left joins, right joins, and full outer joins in SQL, you use the same syntax structure as the INNER JOIN but use these keywords:
LEFT JOIN, RIGHT JOIN, and FULL OUTER JOIN.
As a security analyst,
you're not required to know all of these from memory.
Once you understand the type of join you need,
you can quickly search and find
all the information you need to execute these queries.
With this information on joins,
we've now covered some very important information
you'll need as a security analyst using SQL.
Thank you for joining me in this video.
# Compare types of joins
Previously, you explored SQL joins and how to use them to join data from multiple tables when these tables share a common column. You also examined how there are different types of joins, and each of them returns different rows from the tables being joined. In this reading, you'll review these concepts and more closely analyze the syntax needed for each type of join.
## Inner joins
The first type of join that you might perform is an inner join. INNER JOIN returns rows matching on a specified column that exists in more than one table.
It only returns the rows where there is a match, but like other types of joins, it returns all specified columns from all joined tables. For example, if the query joins two tables with SELECT \*, all columns in both of the tables are returned.
**Note:** If a column exists in both of the tables, it is returned twice when SELECT \* is used.
### The syntax of an inner join
To write a query using INNER JOIN, you can use the following syntax:
SELECT \*FROM employeesINNER JOIN machines ON employees.device\_id = machines.device\_id;
SELECT thing1, thing2, thingX FROM table1 inner join table2 ON table1.commun\_colomn = table2.common\_colomn;
You must specify the two tables to join by including the first or left table after FROM and the second or right table after INNER JOIN.
After the name of the right table, use the ON keyword and the = operator to indicate the column you are joining the tables on. It's important that you specify both the table and column names in this portion of the join by placing a period (.) between the table and the column.
In addition to selecting all columns, you can select only certain columns. For example, if you only want the join to return the username, operating\_system and device\_id columns, you can write this query:
SELECT username, operating\_system, employees.device\_idFROM employeesINNER JOIN machines ON employees.device\_id = machines.device\_id;
it makes more sense for it to be all in one row for me so heres an explanation of each part how it works
SELECT thing\_1, thing\_2, thing\_X FROM table1 INNER JOIN table2 ON table1.common\_column = table2.common\_column;
**Note**: In the example query, username and operating\_system only appear in one of the two tables, so they are written with just the column name. On the other hand, because device\_id appears in both tables, it's necessary to indicate which one to return by specifying both the table and column name (employees.device\_id).
## Outer joins
Outer joins expand what is returned from a join. Each type of outer join returns all rows from either one table or both tables.
### Left joins
When joining two tables, LEFT JOIN returns all the records of the first table, but only returns rows of the second table that match on a specified column.
The syntax for using LEFT JOIN is demonstrated in the following query:
SELECT \*FROM employeesLEFT JOIN machines ON employees.device\_id = machines.device\_id;
As with all joins, you should specify the first or left table as the table that comes after FROM and the second or right table as the table that comes after LEFT JOIN. In the example query, because employees is the left table, all of its records are returned. Only records that match on the device\_id column are returned from the right table, machines.
### Right joins
When joining two tables, RIGHT JOIN returns all of the records of the second table, but only returns rows from the first table that match on a specified column.
The following query demonstrates the syntax for RIGHT JOIN:
SELECT \*FROM employeesRIGHT JOIN machines ON employees.device\_id = machines.device\_id;RIGHT JOIN has the same syntax as LEFT JOIN, with the only difference being the keyword RIGHT JOIN instructs SQL to produce different output. The query returns all records from machines, which is the second or right table. Only matching records are returned from employees, which is the first or left table.
**Note:** You can use LEFT JOIN and RIGHT JOIN and return the exact same results if you use the tables in reverse order. The following RIGHT JOIN query returns the exact same result as the LEFT JOIN query demonstrated in the previous section:
SELECT \*FROM machinesRIGHT JOIN employees ON employees.device\_id = machines.device\_id;
All that you have to do is switch the order of the tables that appear before and after the keyword used for the join, and you will have swapped the left and right tables.
### Full outer joins
FULL OUTER JOIN returns all records from both tables. You can think of it as a way of completely merging two tables.
You can review the syntax for using FULL OUTER JOIN in the following query:
SELECT \*FROM employeesFULL OUTER JOIN machines ON employees.device\_id = machines.device\_id;
The results of a FULL OUTER JOIN query include all records from both tables. Similar to INNER JOIN, the order of tables does not change the results of the query.
## Key takeaways
When working in SQL, there are multiple ways to join tables. All joins return the records that match on a specified column. INNER JOIN will return only these records. Outer joins also return all other records from one or both of the tables. LEFT JOIN returns all records from the first or left table, RIGHT JOIN returns all records from the second or right table, and FULL OUTER JOIN returns all records from both tables.
# Continuous learning in SQL
You've explored a lot about SQL, including applying filters to SQL queries and joining multiple tables together in a query. There's still more that you can do with SQL. This reading will explore an example of something new you can add to your SQL toolbox: aggregate functions. You'll then focus on how you can continue learning about this and other SQL topics on your own.
## Aggregate functions
In SQL, **aggregate functions** are functions that perform a calculation over multiple data points and return the result of the calculation. The actual data is not returned.
There are various aggregate functions that perform different calculations:
- COUNT returns a single number that represents the number of rows returned from your query.
- AVG returns a single number that represents the average of the numerical data in a column.
- SUM returns a single number that represents the sum of the numerical data in a column.
### **Aggregate function syntax**
To use an aggregate function, place the keyword for it after the SELECT keyword, and then in parentheses, indicate the column you want to perform the calculation on.
For example, when working with the customers table, you can use aggregate functions to summarize important information about the table. If you want to find out how many customers there are in total, you can use the COUNT function on any column, and SQL will return the total number of records, excluding NULL values. You can run this query and explore its output:
---
```
SELECT COUNT(firstname)
FROM customers;
```
---
```
+------------------+
| COUNT(firstname) |
+------------------+
| 59 |
+------------------+
```
---
The result is a table with one column titled COUNT(firstname) and one row that indicates the count.
If you want to find the number of customers from a specific country, you can add a filter to your query:
---
```
SELECT COUNT(firstname)
FROM customers
WHERE country = 'USA';
```
---
```
+------------------+
| COUNT(firstname) |
+------------------+
| 13 |
+------------------+
```
---
With this filter, the count is lower because it only includes the records where the country column contains a value of 'USA'.
There are a lot of other aggregate functions in SQL. The syntax of placing them after SELECT is exactly the same as the COUNT function.
## Continuing to learn SQL
SQL is a widely used querying language, with many more keywords and applications. You can continue to learn more about aggregate functions and other aspects of using SQL on your own.
Most importantly, approach new tasks with curiosity and a willingness to find new ways to apply SQL to your work as a security analyst. Identify the data results that you need and try to use SQL to obtain these results.
Fortunately, SQL is one of the most important tools for working with databases and analyzing data, so you'll find a lot of support in trying to learn SQL online. First, try searching for the concepts you've already learned and practiced to find resources that have accurate easy-to-follow explanations. When you identify these resources, you can use them to extend your knowledge.
Continuing your practical experience with SQL is also important. You can also search for new databases that allow you to perform SQL queries using what you've learned.
## Key takeaways
Aggregate functions like COUNT, SUM, and AVG allow you to work with SQL in new ways. There are many other additional aspects of SQL that could be useful to you as an analyst. By continuing to explore SQL on your own, you can expand the ways you can apply SQL in a cybersecurity context.
# Wrap-up; Glossary terms from week 4
Congratulations! We've made it together through the end of our focus on SQL.
You've put in a lot of work and learned an important tool that will help you on your journey as a security analyst.
Let's take a moment to go through all of the topics you learned in this section.
We started by learning about the structure of relational databases and how we can access them by using the query language SQL.
We then got hands-on practice with writing our own SQL queries.
We used SQL to bring up information you might need on the job when working as an analyst.
We then focused on SQL filters.
We started with simple conditions with strings, and by the end, we learned how to use multiple filters in one query.
We concluded the unit with SQL joins and learned how to join multiple tables, giving us even more information at once.
By completing this course, you just took a very big step in your future career as a security analyst.
You have been introduced to a powerful tool that can help you in your work.
Whenever you need to, I encourage you to revisit the materials in this course.
Learning a querying language like SQL takes time.
Thank you again for joining me in this journey.
I hope you'll enjoy using SQL as much as I do.
### **Terms and definitions from Course 4, Week 4**
**Database**: An organized collection of information or data
**Date and time data:** Data representing a date and/or time
**Exclusive operator**: An operator that does not include the value of comparison
**Filtering:** Selecting data that match a certain condition
**Foreign key:** A column in a table that is a primary key in another table
**Inclusive operator:** An operator that includes the value of comparison
**Log:** A record of events that occur within an organization's systems
**Numeric data:** Data consisting of numbers
**Operator:** A symbol or keyword that represents an operation
**Primary key:** A column where every row has a unique entry
**Query:** A request for data from a database table or a combination of tables
**Relational database:** A structured database containing tables that are related to each other
**String data**: Data consisting of an ordered sequence of characters
**SQL (Structured Query Language):** A programming language used to create, interact with, and request information from a database
**Syntax:** The rules that determine what is correctly structured in a computing language
**Wildcard**: A special character that can be substituted with any other character
# Course wrap-up
You made it to the end of this course!
Congratulations—you did it!
I hope you are proud of all you learned.
The focus of this course was computing basics.
Understanding the basics of
computing is a valuable skill as
you transition into your career as a security analyst.
Let's recap what you learned in this course.
We first focused on operating systems
and how they relate to applications and hardware.
Understanding how the system you're protecting
works is essential for doing your job effectively.
That brings us to the Linux operating system.
When working in the security profession,
familiarity with Linux is important.
We first discussed this architecture
and various distributions.
Then, we used a Linux command line to carry
out tasks you might encounter as a security analyst.
Finally, we looked at
another useful tool and used SQL to query databases.
After this course, I
hope you have a better understanding of
how these foundations of computing support
a security analyst in their daily work.
I also hope you continue your path with this program.
There are a lot of other useful
and exciting topics ahead.
Once again, congratulations.
You've finished another course.
Building skills is something you should be proud of.
Keep it up as you progress through this program.
## Terms and definitions from Course 4
AAbsolute file path: The full file path, which starts from the rootApplication: A program that performs a specific taskArgument (Linux): Specific information needed by a commandAuthentication: The process of verifying who someone isAuthorization: The concept of granting access to specific resources in a systemBBash: The default shell in most Linux distributionsBasic Input/Output System (BIOS): A microchip that contains loading instructions for the computer and is prevalent in older systems Bootloader: A software program that boots the operating systemCCentOS: An open-source distribution that is closely related to Red HatCentral Processing Unit (CPU): A computer’s main processor, which is used to perform general computing tasks on a computerCommand: An instruction telling the computer to do somethingCommand-line interface (CLI): A text-based user interface that uses commands to interact with the computerDDatabase: An organized collection of information or dataDate and time data: Data representing a date and/or timeDigital forensics: The practice of collecting and analyzing data to determine what has happened after an attackDirectory: A file that organizes where other files are storedDistributions: The different versions of LinuxEExclusive operator: An operator that does not include the value of comparisonFFile path: The location of a file or directoryFilesystem Hierarchy Standard (FHS): The component of the Linux OS that organizes dataFiltering: Selecting data that match a certain conditionForeign key: A column in a table that is a primary key in another table GGraphical user interface (GUI):A user interface that uses icons on the screen to manage different tasks on the computerHHard drive: A hardware component used for long-term memoryHardware: The physical components of a computerIInclusive operator: An operator that includes the value of comparisonInternal hardware: The components required to run the computerKKali Linux ™: An open-source distribution of Linux that is widely used in the security industryKernel: The component of the Linux OS that manages processes and memoryLLegacy operating system: An operating system that is outdated but still being usedLinux: An open-source operating systemLog: A record of events that occur within an organization's systemsNnano: A command-line file editor that is available by default in many Linux distributionsNumeric data: Data consisting of numbersOOperating system (OS):The interface between computer hardware and the userOperator: A symbol or keyword that represents an operationOptions: Input that modifies the behavior of a commandPPackage: A piece of software that can be combined with other packages to form an applicationPackage manager: A tool that helps users install, manage, and remove packages or applicationsParrot: An open-source distribution that is commonly used for securityPenetration test (pen test): A simulated attack that helps identify vulnerabilities in systems, networks, websites, applications, and processesPeripheral devices: Hardware components that are attached and controlled by the computer systemPermissions: The type of access granted for a file or directoryPrimary key: A column where every row has a unique entryPrinciple of least privilege: The concept of granting only the minimal access and authorization required to complete a task or function
QQuery: A request for data from a database table or a combination of tablesRRandom Access Memory (RAM): A hardware component used for short-term memoryRed Hat® Enterprise Linux® (also referred to simply as Red Hat in this course): A subscription-based distribution of Linux built for enterprise useRelational database: A structured database containing tables that are related to each otherRelative file path: A file path that starts from the user's current directoryRoot directory: The highest-level directory in LinuxRoot user (or superuser): A user with elevated privileges to modify the systemSShell: The command-line interpreter SQL (Structured Query Language): A programming language used to create, interact with, and request information from a databaseStandard error: An error message returned by the OS through the shellStandard input: Information received by the OS via the command lineStandard output: Information returned by the OS through the shellString data: Data consisting of an ordered sequence of charactersSyntax: The rules that determine what is correctly structured in a computing languageUUbuntu: An open-source, user-friendly distribution that is widely used in security and other industriesUnified Extensible Firmware Interface (UEFI): A microchip that contains loading instructions for the computer and replaces BIOS on more modern systemsUser: The person interacting with a computer User interface: A program that allows the user to control the functions of the operating systemVVirtual machine (VM):A virtual version of a physical computerWWildcard: A special character that can be substituted with any other character