Cybersecurity Standard and Operating System
Muhammad Nasir
Email: 2025SMSCS8@student.uet.edu.pk, nasir.anwar@live.com
Abstract
In recent years, cyber threats have grown a lot, making it very important to improve
digital security. As these threats change, we need to update system settings to stay
protected. To help keep systems and data safe, well-known groups have created
cybersecurity rules. Following these rules is crucial because security problems can
cause big financial losses, harm reputations, and damage organizations. However,
picking the right rules and using them in a company can be hard.
This article looks at research about cybersecurity rules and studies different
standards. It also shares data on cyber-attacks that affect operating systems (OS).
The article compares tools, frameworks, and software used to follow OS security
rules. It also discusses common solutions that help meet these rules. Based on the
standards reviewed, the article suggests key steps to protect OS and points out
challenges that still need to be solved.
1. Introduction
Cybersecurity is a technology designed to safeguard digital information from
unauthorized access, misuse, or theft. These threats can originate from within an
organization or from external sources, such as skilled hackers who exploit the
internet to target computer systems.
Operating systems are vulnerable to various cybersecurity threats, including
malware, ransomware, unauthorized access, and exploits that target OS
weaknesses. To mitigate these risks, cybersecurity measures are applied at the OS
level to ensure data and system resources remain confidential, intact, and
accessible. This involves securing user accounts, managing permissions, fixing
vulnerabilities through updates, and monitoring system activity for unusual behavior.
Cybersecurity standards and best practices are essential for OS protection. These
include using strong authentication, enabling firewalls, regularly updating the OS to
address security flaws, and employing encryption to protect data. Tools such as
antivirus software, intrusion detection systems, and security compliance frameworks
also play a crucial role in enhancing OS security.
2). Cybersecurity Standard
Cybersecurity standards help organizations protect their systems from cyber
threats, such as malware, unauthorized access, and data breaches, by
establishing a consistent and secure framework for OS deployment and
maintenance.
1|P a ge



NIST SP 800-53: Provides security and privacy controls for federal
information systems.
CIS Benchmarks: Detailed configuration guidelines for securing operating
systems.
ISO/IEC 27001: Focuses on information security management systems
(ISMS).
3). CyberAttack on Operating system in 2023
The cyberattacks in 2023 caused significant financial, operational, and reputational
damage to organizations and individuals worldwide. Below is a breakdown of the
estimated damage caused by some of the major cyberattacks targeting operating
systems in 2023:
Attack
Estimated
Damage
Details
Affected thousands of organizations,
including government agencies, healthcare,
Cl0p Ransomware Over $10 billion
and financial institutions. Data breaches and
(MOVEit Exploit)
globally
ransom payments contributed to the high
cost.
Compromised high-value targets, including
Apple iOS/macOS
Millions of
government officials and corporate
Zero-Day (CVEdollars
executives, leading to data theft and system
2023-32409)
compromises.
3CX Desktop App Hundreds of
Disrupted operations for over 600,000
Supply Chain
millions of
organizations using the 3CX VoIP app,
Attack
dollars
leading to downtime and recovery costs.
Linux Kernel
Significant
Exploited in targeted attacks, causing system
Vulnerability (CVE- operational
compromises and data breaches in
2023-0386)
disruptions
enterprises using Linux servers.
Compromised credentials of employees
Microsoft Teams
Millions of
across multiple organizations, leading to
Phishing Campaign dollars
unauthorized access and data theft.
Hundreds of
Caused widespread downtime for online
DDoS Attacks on
millions of
services, impacting businesses and critical
Linux Servers
dollars
infrastructure.
Targeted VMware ESXi servers, encrypting
ESXiArgs
Over $100
virtual machines and disrupting operations for
Ransomware
million
thousands of organizations.
4). CyberSecurity Practice
In theory, every organization, government, and institution should follow industry
standards and best practices to protect IT infrastructure, customer data, and other
sensitive information. This is essential for ensuring security. However, there is often
a significant gap between what is expected and what actually happens. Research
indicates that many organizations lack adequate data protection measures and fail to
2|P a ge
follow industry-recommended practices. This leaves them vulnerable to cyber
threats, which can result in data breaches, financial losses, and damage to their
reputation. Below are some key findings on the current state of cybersecurity:












A report from IANS & Artico [8] states that only 13.2% of IT budgets are
allocated to security.
The Fortinet reveals that Fortinet report [9] finds nearly 70% of Organizations
say their Employees Lack Fundamental Security Awareness.
EMA report reveals that 79% of servers still utilize TLS 1.2, leaving them
susceptible to man-in-the-middle (MiM) attacks.
Verizon reported that in 2024, only 43% of companies were fully compliant
with PCI/DSS security standards.
Analysis of HTTP Security Headers in Popular Global Websites by
Urvashi Kishnani & Sanchari Das (Oct 19, 2024) – includes analysis of 3,195
popular global websites using the Mozilla Observatory, revealing that 55.66%
received an “F” grade.
A Tech Republic study showed that while 93% of companies have password
policies, fewer than 25% enforce mandatory password changes, and only
53% require updates every quarter.
The annual report by Bullet Proof identified that 22% of critical cybersecurity
vulnerabilities stem from missing software patches and outdated programs.
Cisco reported that 68% of U.S. companies do not invest in cybersecurity
assurance.
According to NationWide, 68% of organizations lack a disaster recovery plan
(DRP), and 71% of small businesses have never considered business
interruption insurance.
Ncipher found that only 45% of organizations have a consistent encryption
strategy, and fewer than half implement encryption across their entire
enterprise.
BDO USA reported that 73% of organizations only meet the minimum-security
requirements.
Global Market Insights predicts that the cybersecurity industry will grow to
$300 billion by 2024, while the cybercrime market is currently valued at
approximately $1.5 trillion.
5). Key Cybersecurity Standards for Operating Systems
Cybersecurity
Standard
NIST
Cybersecurity
Framework
(CSF)
Usage Statistics
Operating
Systems
Supported
30-40% of U.S.
organizations (higher in
critical infrastructure
sectors)
- Provides guidelines
for secure OS
configuration.
Windows,
- Focuses on
Linux, macOS
identifying and
mitigating OS
vulnerabilities.
Key Features for OS
Security
3|P a ge
Cybersecurity
Standard
Usage Statistics
Operating
Systems
Supported
Key Features for OS
Security
- Offers OS-specific
Windows,
security configuration
Over 50% of Fortune 500 Linux,
guidelines.
CIS Benchmarks
companies
macOS,
- Widely used for
VMware ESXi hardening Windows
and Linux systems.
- Includes controls for
securing OS
Over 60,000 certified
environments.
Windows,
ISO/IEC 27001 organizations
- Focuses on access
Linux, macOS
worldwide (as of 2023)
control, patch
management, and
logging.
- Requires secure
configuration of OS
Mandatory for
Windows,
handling payment
PCI DSS
organizations handling
Linux
data.
credit card data
- Enforces encryption
and access control.
- Mandates secure
OS configurations for
protecting patient
Over 80% of U.S.
Windows,
HIPAA
data.
healthcare organizations Linux, macOS
- Focuses on access
control and
encryption.
- Requires secure OS
Mandatory for
configurations to
Windows,
GDPR
organizations handling EU
protect personal data.
Linux, macOS
citizen data
- Enforces logging
and monitoring.
- Provides OSspecific security
technical
Widely used in U.S.
Windows,
implementation
DISA STIGs
Department of Defense
Linux
guides (STIGs).
and government agencies
- Focuses on
hardening military
systems.
6). Global Adoption Trends (in Percentages) of CyberSecurity Framework
1. North America:
o NIST CSF: 30-40% of organizations.
o CIS Controls: 40-50% of public sector organizations.
o HIPAA: 80-90% of healthcare organizations.
4|P a ge
2. Europe:
o GDPR: 100% of organizations handling EU citizen data.
o ISO/IEC 27001: 20-25% of large enterprises.
3. Asia-Pacific:
o ISO/IEC 27001: 15-20% of enterprises (growing rapidly).
o NIST CSF: 5-10% of organizations (increasing adoption).
4. Emerging Markets:
o ISO/IEC 27001: 5-10% of organizations.
o CIS Controls: 10-15% of enterprises.
7). Software Tools for Cybersecurity Standards
This section talks about tools that help organizations follow cybersecurity
rules and manage risks. These tools make it easier to check if a company is meeting
security standards and provide useful information to improve security.
Acuity STREAM
Acuity STREAM is a flexible and easy-to-use tool that helps companies follow
cybersecurity rules like NIST, PCI DSS, ISO 27001, and GDPR. It also helps
manage risks. The tool works for both small and large organizations and shows how
well a company is following the rules and how much risk it has. It uses charts and
graphs to make the information easy to understand. Acuity STREAM works on both
Windows and Mac.
Nessus
Nessus is a widely used vulnerability scanning tool that helps identify security
weaknesses in systems, networks, and applications. It supports compliance with
standards like PCI DSS, NIST, and ISO 27001. Nessus provides detailed reports
and recommendations for fixing vulnerabilities. It works on Windows, Linux, and
macOS.
Vigilant Software (vs) Risk
vsRisk is a tool made for ISO/IEC 27001, but it also works with PCI-DSS, NIST, and
ISF standards. It helps track assets and assess risks. It’s available as a single-user
tool for smaller companies or a multi-user tool for larger ones. It creates reports like
Risk Treatment Plans and Statements of Applicability (SoA). The desktop version
works on Windows, but there’s also a cloud version for bigger companies.
Rapid7 InsightVM
InsightVM is a vulnerability management tool that helps organizations assess risks
and comply with cybersecurity standards. It supports standards like PCI DSS, NIST,
and ISO 27001. The tool provides actionable insights and integrates with other
security tools for better risk management.
Microsoft Baseline Security Analyzer (MBSA)
MBSA is a tool for Windows that checks for security problems like missing updates
5|P a ge
or misconfigurations. It doesn’t follow specific security standards but gives advice on
how to fix issues. It creates reports in XML format and checks things like user
accounts and unused services.
Microsoft Security Assessment Tool (MSAT)
MSAT is a Windows tool for small-to-medium businesses. It asks about 200
questions about IT infrastructure, operations, applications, and people to assess
security. It uses standards like ISO/IEC 17799 and NIST-800 to give
recommendations. It also compares current security with past assessments to show
improvements.
OpenVAS
OpenVAS (Open Vulnerability Assessment System) is an open-source tool for
vulnerability scanning and management. It helps organizations identify security
weaknesses and comply with standards like NIST and ISO 27001. It works on Linux
and provides detailed reports.
Lynis
Lynis is a tool for UNIX systems that checks for security issues and helps harden the
system. It looks for problems in software, configurations, and files. It supports
standards like ISO/IEC 27001, PCI-DSS, and HIPAA. After scanning, it gives a score
and suggests fixes for any issues found.
OpenSCAP
OpenSCAP is a Linux tool that checks if a system meets security rules. It looks for
vulnerabilities, misconfigurations, and signs of hacking. It supports standards like
SCAP and PCI DSS and creates detailed reports.
Nipper
Nipper is a network device auditing tool that checks configurations for security
issues. It helps organizations comply with standards like PCI DSS and NIST. Nipper
provides detailed reports and works on Windows and Linux.
Tiger
Tiger is a UNIX tool that checks for security problems like missing patches, file
permissions, and unused accounts. After scanning, it creates a report with
suggestions to improve security.
CIS Configuration Assessment Tool
This tool checks if a system follows CIS benchmarks, which are best practices for
security. It gives a score from 0 to 100 and suggests ways to fix any problems. A
higher score means the system is more secure.
The information above gives a detailed look at current research and security
standards for operating systems (OS). It also explains different software tools that
help with OS security and which security standards they work with.
6|P a ge
8). Conclusion
It is important to create software that checks if operating systems follow security
rules. Right now, it's hard to check this just by using general guidelines and best
practices. Existing tools are not enough. For example, Lynis only supports a few
standards and does not include the NIST standard, which is one of the most
important for operating systems. Also, Lynis does not work with Windows.
Another tool, Microsoft’s MSAT, supports only NIST and ISO 17799, but it needs a
lot of manual work, which makes it hard to use. Security standards should be
improved to include things like physical security, asset tracking, and backup plans.
The rules and exceptions for following these standards should depend on the type of
organization. The software should work with the most common systems, like Linux,
MacOS, and Windows.
Also, the tool should let IT administrators check all systems remotely at the same
time. This would help catch problems quickly and keep the systems safer.
Since no single standard fits all needs, we need to combine different standards to
better protect different types of systems. Right now, there is no clear way to rate or
compare cybersecurity standards based on how well they prevent attacks.
The requirements we have now are a good start, but more research is needed to
build a detailed way to judge and compare cybersecurity standards and how well
they work with operating systems.
Reference:
1. Zarif Bin Akhtar (2024): Securing Operating Systems (OS): A Comprehensive
Approach to Security with Best Practices and Techniques
2. ISO 27001:2022 Information Security Management System Cyber Security
Framework. Retrieved from https://www.iso.org/standard/27001
3. Taherdoost, H. (2022). Understanding Cybersecurity Frameworks and
Information Security Standards—A Review and Comprehensive
Overview. https://doi.org/10.3390/electronics11142181
4. Gonzalez, R., 2025. Comparative Analysis of Operating System Security:
Evaluating the Most Secure OS.
5. CIS. Center for Internet Security(CIS). Retrieved from
https://www.cisecurity.org/.
6. Khan, A.R.A., Khan, M.I., Arif, A., Anjum, N. and Arif, H., 2025. Intelligent
Defense: Redefining OS Security with AI. International Journal of Innovative
Research in Computer Science and Technology
7. NIST, National Institute of Standard and Technology, retrieved from
https://www.nist.gov/
8. IANS Research & Artico Search Security Budget Benchmark Report (2024–
2025), retrieved from https://www.iansresearch.com/resources/allblogs/post/security-blog/2024/09/05/2024-security-budget-benchmark-report-key-findings
7|P a ge
9. 2024 Security Awareness & Training Report (Fortinet), retrieved from
https://www.globenewswire.com/newsrelease/2024/10/23/2967831/0/en/Fortinet-Report-Finds-Nearly-70-ofOrganizations-Say-Their-Employees-Lack-Fundamental-SecurityAwareness.html?utm_source=chatgpt.com
8|P a ge