Cybersecurity Analyst Pt 1 - SOC100 - Windows OS, Architecture, Kernel & User Space, Desktop & GUI

Main ideas / lessons conveyed

• Course purpose & progression

  • The stream/course aims to take learners from basic operating system knowledge to functioning as a Tier 1 SOC (Security Operations Center) analyst.
  • The learning path spans multiple “SOC” courses (e.g., SOC 100-1, 100-2, then later SOC 100-3/4/5, and onward to more advanced content such as SOC 200 / CDA, detection engineering, etc.).
  • The presenter frames it as a multi-month, weekend-based live training experience with recorded playback.

• Why fundamentals matter (especially for Windows)

  • Security work depends on strong IT fundamentals, particularly OS internals and user/kernel behavior.
  • Windows is described as non-negotiable because most enterprise endpoints are Windows and many vulnerabilities/operations involve Windows systems.
  • Linux is strongly recommended because it will be used in supporting roles (servers, networking, cloud, lab work), even if learners primarily need to master Windows first.

• Learning philosophy & mental models

  • Learners should expect discomfort while learning (“uncomfort” as a normal sign of growth).
  • The course heavily encourages “see once, do once, teach once” (teach to reveal gaps).
  • Pace varies: learners should focus on incremental personal improvement, not comparison.
  • Impostor syndrome is addressed with guidance:
    • Compare less to others; evaluate your own foundations.
    • If content doesn’t make sense, likely fundamentals/gaps exist behind it.
    • Balance study time to avoid burnout.
  • Emphasis on immersion: gradually tolerate/absorb technical jargon and definitions instead of translating everything into plain English.

• Practical/assessment philosophy

  • Certifications require hands-on demonstrations and practical work, including presenting/reporting findings—not only multiple-choice testing.
  • The presenter criticizes programs that can graduate students with minimal practical capability (e.g., not being able to triage or interpret network activity), arguing that security credentials should verify real skills.

• Value proposition & platform

  • VMs are provided inside the platform; learners connect via browser-based remote desktop (RDP).
  • Learners are advised to stop VMs when not in use to avoid wasting credits.
  • Support is offered via Discord and course chat.

---

Methodologies / structured instructions (detailed)

A) How to learn effectively (course learning model)

• See once

  • Watch the explanation/lecture and labs (exposure to concepts and terminology).

• Do once

  • Perform the lab activities yourself (kinesthetic/practical practice).

• Teach once

  • Explain the concept to others (especially non-technical people) to identify knowledge gaps.

• Immersion rule

  • Stay in the technical environment to normalize jargon and acronym usage.

• Personal pacing

  • Start where you are (some may begin later), but always measure incremental gains.

B) How to avoid being derailed by impostor syndrome

• Step 1: Accept that your current knowledge level is valid.
• Step 2: Identify why you don’t understand:
  • Usually means missing prerequisite fundamentals/definitions.
  • Step back to locate the knowledge gap and fill it.
• Step 3: Keep balance:
  • Overstressing/studying too much or too little can cause burnout.
  • Don’t rush cybersecurity for a job in a few days; it’s not sustainable.

C) How to use the VM platform efficiently (operational steps)

• Accessing VMs

  • Find the VMs panel in the platform sidebar.
  • Click Connect to open a new browser session (remote desktop).

• First boot expectations

  • Initial startup may take 1–3 minutes; later boots are faster.

• If something breaks

  • Power cycle (stop then restart) as a first troubleshooting step.
  • Reset returns the VM to its original state and wipes progress (use as last resort).
  • Seek help in Discord if issues persist.

• Credits management

  • Turn VMs off when not using them to avoid wasting credits.
  • Additional lab time can be purchased if needed.

• Windows login/admin

  • By default, the user is an administrator in the lab environment.
  • A password expired reminder may appear; it’s expected due to licensing setup.

• Configuration prompts

  • A network sharing prompt may appear; choosing “yes” is recommended but missing it is usually not fatal.

D) Windows desktop navigation (lab-oriented guidance)

• Start menu

  • Bottom-left Start button (gateway to apps, settings, documents).

• Taskbar

  • Right-click taskbar for customization options (search visibility, size, locking, arrangement).
  • Use options to show windows stacked/cascaded/side-by-side.

• File Explorer (“Explorer”)

  • Open from pinned icon or via Start menu search.
  • Quick Access provides bookmarks-like shortcuts (Desktop, Documents, Downloads, Pictures).
  • C: drive is referenced as a filesystem root label; navigation uses folder paths.

• Control Panel vs Settings

  • Control Panel is described as legacy but still present for compatibility.
  • Power options show interactions with the OS/“kernel” via system-level configuration.

• Action Center

  • Bottom-right (notifications and quick system controls like network and Night Light).

E) File system basics taught as security-relevant concepts

• What files “are”

  • File Explorer shows representations of structured data stored as binary on disk.

• Path/addressing

  • Windows uses drive letters (e.g., C:) and folder separation via path formatting (backslash conventions were discussed).

• Copy, cut, paste

  • Copy keeps the original; cut moves/removes from the source.

• Recycle Bin behavior

  • Deleting a file does not instantly erase the underlying data.
  • Instead, deletion changes flags/metadata so the OS stops referencing the file through normal means.
  • Empty Recycle Bin changes state again, but data recovery concepts remain relevant for forensics.

F) User/account management instructions (Windows lab)

• Using GUI (Computer Management)

  • Open Computer Management and navigate:
    • Local Users and Groups → Users to create users.
    • Groups to manage group membership/permissions.

• User creation fields

  • Set username, optional description/full name.
  • Choose password policy behavior (e.g., “must change at logon,” disable/expiry options).
  • Create user and then assign group membership.

• Group membership logic

  • Adding a user to Administrators is shown as possible (with the caution that it’s not recommended generally).

• Command-line equivalent (preview)

  • Use net user to create/modify/disable/delete users (commands demonstrated at a high level).
  • Use net user /? or similar help to view supported options.

---

Key technical concepts introduced (OS & kernel/user space)

• What an operating system is

  • A mediator layer between hardware and applications/software.
  • Provides:
    • Hardware management (power, device behavior)
    • User interface/window management
    • Process management (multi-tasking)
    • File system access
    • Security/access control
    • Networking support (for connected systems)

• History / evolution

  • Progression from wires/punch cards → command line (CLI) → graphical user interface (GUI).
  • Increasing abstraction reduces how much end users must understand.

• Kernel vs user space

  • The OS is described as layers:
    • Kernel space (“kernel mode”): reserved/low-level, not directly writable by user processes.
    • User space: where applications run (processes/threads and user-accessible components).
  • Kernel space is loaded into memory (RAM) at boot and remains a protected foundation.
  • End-user actions interact with kernel through controlled interfaces.

• System calls and APIs

  • User-mode actions request kernel services via:
    • System calls / Windows native API
  • The kernel then performs hardware-related actions safely within guardrails.

• Driver model & device configuration

  • Drivers store configuration/state and inform the kernel how to communicate with hardware.
  • Example: power options and device behaviors are tied to how the kernel/driver layers control hardware.

• Why EDR/AV can be effective

  • They operate at lower levels (close to kernel/system call pathways).
  • This also explains why incorrect patches/updates can cause severe failures (e.g., blue screens / boot failure).

---

Speakers / sources featured

• Main speaker / instructor (unidentified name in subtitles):

  • The host of the SOC100-1 live stream (referred to by chat as KSJ at times, but the precise identity is not clearly established in the subtitle text).

• Participants in chat (spoken by or addressed as speakers in subtitles):

  • KSJ
  • Anthony
  • Cash (SOC analyst / course attendee)
  • Frank
  • Karina
  • Drew
  • CI doc
  • Kim
  • Yarden
  • Abe
  • Pr / PR
  • Starlight
  • Bearded Ruckus
  • Ayo/179 (as referenced)
  • Mr Mees
  • Jazzy fizzle
  • Crossa
  • Frank Herbert (source of a quote referenced in-stream)

• External written sources

  • No external written sources were directly cited beyond course platform references and quote attribution (Frank Herbert).