Dynamic linking, compared to static linking, means:

One shared copy of a library is used across many running programs, resolved at load/run time

The library's code is copied into every executable at link time

It happens before compilation, not after

A worm differs from a virus chiefly in that a worm:

Self-replicates and spreads across a network with no user action needed

Must always attach to a host program to run

Is a hardware defect, not software

Public-key (asymmetric) cryptography, compared to secret-key (symmetric) cryptography, chiefly solves:

It is always faster than secret-key cryptography

It eliminates the need for any key at all

A type-1 (bare-metal) hypervisor, compared to a type-2 (hosted) hypervisor:

Runs directly on the hardware with no host OS beneath it, giving near-native performance

Always runs as an ordinary application inside a host operating system

Cannot run more than one virtual machine

Is only used on personal desktops

Multi-factor authentication is markedly stronger than a single factor because it combines:

Two or more DIFFERENT categories (e.g. something you know and something you have)

Two passwords, both from the same category

Which of the following are true of a firewall and a VPN? (More than one option may be correct.)

A firewall enforces a boundary policy on traffic by port, protocol or address

A VPN encrypts and tunnels traffic across an untrusted network

The two are complementary defences at different layers, not substitutes for each other

A firewall enforces a boundary policy on traffic by port, protocol or address

A VPN encrypts and tunnels traffic across an untrusted network

The two are complementary defences at different layers, not substitutes for each other

A firewall and a VPN are the exact same technology under two names

System Software, Security and Virtual Machines

The course's three Operating Systems chapters cover processes, threads and scheduling; IPC, synchronisation and deadlock; and memory, virtual memory and files. NET's Unit 5 also opens with System Software as a topic of its own — machine, assembly and high-level languages as concepts, compilers and interpreters, loading, linking and relocation, macros and debuggers: the tooling around an operating system — and separately names Security and Virtual Machines. This chapter covers all three.

System Software: Compilers, Interpreters, Loading, Linking and Debuggers

Loading, linking and relocation happen after compilation produces object code, which typically still references external symbols (library functions) and assumes addresses starting at zero. The linker resolves references between separately-compiled object modules (and libraries), combining them into one executable — STATIC linking copies a library's code into the executable at link time, while DYNAMIC linking defers this to load or run time, sharing one copy of the library across many running programs. The loader brings the executable into memory and performs relocation: adjusting every address-dependent instruction/reference to the addresses the program actually got at THIS load, since a program is rarely loaded at the same address on every run.

Macros are text-substitution templates expanded by a preprocessor/assembler BEFORE the actual translation step, similar in spirit to the preprocessor macros of the Programming-in-C chapter — a macro CALL is replaced by its full expansion at compile time, unlike a function call, which is resolved at run time and does not bloat the code with a fresh copy at every call site.
Debuggers let a programmer inspect and control a running program: setting BREAKPOINTS (pausing execution at a chosen line), single-STEPPING (executing one instruction/line at a time), and inspecting the current call stack and variable values — this is how a logic error, as distinct from a syntax error the compiler catches, is actually diagnosed.

Security: Protection, Access Control and Threats

An access matrix models protection abstractly: rows are DOMAINS (processes/users), columns are OBJECTS (files, devices, other processes), and each cell lists the operations that domain may perform on that object. Implemented directly the matrix is huge and sparse, so real systems store it column-wise (an ACCESS CONTROL LIST per object, naming which domains may do what to it — efficient when checking 'who can access this file') or row-wise (a CAPABILITY LIST per domain, naming which objects it may access and how — efficient when checking 'what can this process do'); revocation of access rights (removing a previously granted permission) is markedly harder with capabilities, since a capability, once handed out and possibly copied, may have no central record of every place it now lives.

Program versus system/network threats
Category	Examples and what makes them distinct
Program threats	A Trojan horse hides malicious behaviour inside an apparently useful program; a trap door is a hidden, undocumented entry point left (often deliberately) by a developer; a logic/time bomb triggers malicious behaviour only when a specific condition (a date, an event) is met.
System/network threats	A worm SELF-REPLICATES and spreads across a network with no user action needed, unlike a virus, which needs to attach to and be run alongside a host program; a denial-of-service attack overwhelms a system's resources so legitimate users cannot be served.

ℹ️ Cryptography as a security tool: two families, one job each

SECRET-KEY (symmetric) cryptography uses the SAME key to encrypt and decrypt — fast, but the key must somehow be shared secretly beforehand, which is the key-distribution problem. PUBLIC-KEY (asymmetric) cryptography uses a mathematically linked key PAIR — data encrypted with the public key can only be decrypted with the matching private key (confidentiality), while data signed with the private key can be verified by anyone holding the public key (a DIGITAL SIGNATURE, giving authenticity and non-repudiation) — solving the distribution problem at the cost of being computationally much slower, which is why real systems typically use public-key cryptography only to exchange a symmetric session key and then switch to secret-key encryption for the bulk data.

Virtual Machines and Virtualization

Virtualization creates one or more virtual instances of a machine's resources on top of shared physical hardware, managed by a hypervisor (virtual machine monitor). A TYPE-1 (bare-metal) hypervisor runs directly on the hardware with no host OS beneath it, giving each virtual machine near-native performance and the strongest isolation — the standard choice for server/datacentre virtualization. A TYPE-2 (hosted) hypervisor instead runs as an ordinary application ON TOP OF a conventional host operating system, which is simpler to set up (install like any program) at some performance cost — the standard choice for running a guest OS on a personal desktop for convenience.

🎯 Why virtualization is the enabling idea behind cloud computing

Virtualization decouples a virtual machine's identity (its OS, applications, resource allocation) from any specific physical server, which is exactly what lets a cloud provider run many isolated customer workloads on shared hardware, migrate a running virtual machine between physical hosts with no downtime for maintenance/load-balancing, and provision or resize a virtual machine on demand rather than physically installing new hardware — this connection to Cloud Computing (covered fully in its own unit) is one worth holding, since a NET question may test either topic through the other's vocabulary.

User Authentication and Implementing Security Defences

Authentication factors are classically grouped as SOMETHING YOU KNOW (a password), SOMETHING YOU HAVE (a hardware token, a phone receiving an OTP) and SOMETHING YOU ARE (biometrics); MULTI-FACTOR authentication combines two or more DIFFERENT categories (not two passwords, which are both 'something you know') and is markedly stronger precisely because compromising one factor does not automatically compromise the others.
Firewalls enforce a boundary policy on network traffic (allow/deny by port, protocol, source/destination address); a Virtual Private Network (VPN) instead encrypts and tunnels traffic across an untrusted network (e.g. the public internet) to give a remote host the effective security of a private, direct link — the two are complementary defences at different layers (boundary control versus in-transit confidentiality) rather than substitutes for each other.

Key takeaways

A linker resolves references between modules (static: copied at link time; dynamic: shared at load/run time); a loader relocates addresses to where the program actually loaded this run.
An access matrix is stored column-wise as access control lists (efficient per-object) or row-wise as capability lists (efficient per-domain); revocation is harder with capabilities.
A worm self-replicates and spreads with no user action; a virus needs a host program to run alongside. Secret-key crypto is fast but needs prior key sharing; public-key crypto solves distribution at a speed cost.
A type-1 (bare-metal) hypervisor runs directly on hardware with near-native performance; a type-2 (hosted) hypervisor runs atop a host OS, simpler but slower.
Multi-factor authentication combines different factor categories (know/have/are); firewalls and VPNs are complementary defences at different layers, not substitutes.

Practice questions (8)

Attempt each one before opening the answer. Every explanation names the tempting wrong option as well as the right one, because that is where marks are lost.

Dynamic linking, compared to static linking, means:
1. One shared copy of a library is used across many running programs, resolved at load/run time
2. The library's code is copied into every executable at link time
3. No linking occurs at all
4. It happens before compilation, not after
Show answer
Answer: A — One shared copy of a library is used across many running programs, resolved at load/run time
Dynamic linking defers resolving library references to load or run time and shares one in-memory copy of the library across programs, unlike static linking, which embeds a private copy in each executable at link time.
In the access matrix model, storing it row-wise (one list per domain naming what it may access) gives:
1. A capability list
2. An access control list
3. A firewall rule set
4. A digital signature
Show answer
Answer: A — A capability list
A capability list is the row-wise (per-domain) view of the access matrix; the column-wise (per-object) view is instead an access control list.
A worm differs from a virus chiefly in that a worm:
1. Self-replicates and spreads across a network with no user action needed
2. Cannot spread at all
3. Must always attach to a host program to run
4. Is a hardware defect, not software
Show answer
Answer: A — Self-replicates and spreads across a network with no user action needed
A worm is a standalone program that spreads on its own; a virus, by contrast, needs to attach itself to and run alongside a host program to propagate.
Public-key (asymmetric) cryptography, compared to secret-key (symmetric) cryptography, chiefly solves:
1. The key-distribution problem, at the cost of being computationally slower
2. Nothing; the two are identical
3. It is always faster than secret-key cryptography
4. It eliminates the need for any key at all
Show answer
Answer: A — The key-distribution problem, at the cost of being computationally slower
A public/private key pair lets two parties communicate securely without ever needing to secretly share a key beforehand, unlike symmetric cryptography — at the cost of being computationally much more expensive, which is why real systems typically use it only to exchange a symmetric session key.
A type-1 (bare-metal) hypervisor, compared to a type-2 (hosted) hypervisor:
1. Runs directly on the hardware with no host OS beneath it, giving near-native performance
2. Always runs as an ordinary application inside a host operating system
3. Cannot run more than one virtual machine
4. Is only used on personal desktops
Show answer
Answer: A — Runs directly on the hardware with no host OS beneath it, giving near-native performance
A type-1 hypervisor runs directly on hardware and is the standard choice for server/datacentre virtualization, precisely for its stronger isolation and near-native performance; a type-2 hypervisor instead runs atop a conventional host OS.
Multi-factor authentication is markedly stronger than a single factor because it combines:
1. Two or more DIFFERENT categories (e.g. something you know and something you have)
2. Two passwords, both from the same category
3. A single very long password
4. No authentication at all
Show answer
Answer: A — Two or more DIFFERENT categories (e.g. something you know and something you have)
Two passwords are both 'something you know' and are compromised together by the same class of attack (e.g. a keylogger); genuine multi-factor authentication combines different categories so that compromising one factor does not automatically compromise the other.
Which of the following are true of a firewall and a VPN? (More than one option may be correct.)
1. A firewall enforces a boundary policy on traffic by port, protocol or address
2. A VPN encrypts and tunnels traffic across an untrusted network
3. The two are complementary defences at different layers, not substitutes for each other
4. A firewall and a VPN are the exact same technology under two names
Show answer
Answer: A — A firewall enforces a boundary policy on traffic by port, protocol or address; B — A VPN encrypts and tunnels traffic across an untrusted network; C — The two are complementary defences at different layers, not substitutes for each other
A firewall controls what traffic is allowed at a boundary, while a VPN protects the confidentiality of traffic already permitted to travel across an untrusted path — genuinely different jobs that are typically deployed together rather than as alternatives.
Name the software layer (also called a virtual machine monitor) that manages and runs one or more virtual machines on shared physical hardware.
Numerical answer — type the value.
Show answer
Answer: hypervisor
A hypervisor comes in two kinds — type-1 (bare-metal), running directly on hardware, and type-2 (hosted), running atop a conventional operating system.