Cybersecurity Foundations (Grades 6–8) · lesson 17 of 48 · 12 min
The Operating System You Never See — But Always Use
When most people think of computers, they think of Windows or macOS. But there is a third operating system that runs more of the world’s technology than either of them — and most people have never heard of it. It is called Linux.
Linux runs the servers that power Google, Amazon, Facebook, and Netflix. It runs Android phones (over 3 billion of them). It runs the International Space Station, the Large Hadron Collider, and most of the world’s supercomputers. It runs the routers and switches that carry internet traffic. And it is the operating system of choice for cybersecurity professionals worldwide.
Understanding Linux is not optional for anyone serious about cybersecurity. Nearly every penetration testing tool, security scanner, and forensics platform runs on Linux. The most widely used cybersecurity operating systems — Kali Linux and Parrot OS — are Linux distributions. If you want to work in security, you need to be comfortable in Linux.
Linux by the numbers
96.3% of the world’s top 1 million web servers run Linux. 100% of the world’s top 500 supercomputers run Linux. Over 3 billion Android devices run a Linux kernel. The International Space Station switched from Windows to Linux in 2013 for reliability and security. Linux powers the majority of cloud infrastructure at AWS, Google Cloud, and Azure.
What Makes Linux Different
Linux is not just another operating system. It has fundamental differences from Windows and macOS that explain why it dominates servers and security work.
The most important difference for cybersecurity is the command line interface (CLI). While Linux has graphical interfaces, its real power comes from the terminal — a text-based interface where you type commands. Security tools, automation scripts, and system administration all happen primarily through the terminal. Learning the terminal is learning Linux.
Linux Distributions — Which One?
Unlike Windows (one product from Microsoft), Linux comes in hundreds of distributions (distros) — different versions built on the same Linux kernel but with different software, interfaces, and purposes.
Kali Linux — the security professional’s toolkit
Kali Linux is the most widely used operating system in cybersecurity. It comes pre-installed with over 600 security tools including Nmap (port scanner), Metasploit (exploitation framework), Wireshark (packet analyser), Burp Suite (web app testing), and Aircrack-ng (wireless security). CyberPatriot competitions, CTF challenges, and professional penetration testing all commonly use Kali. You will encounter it throughout this curriculum.
Activity 1 — Linux vs. Windows vs. macOS Matching
Operating System Characteristics
The Linux File System — How It Is Organised
Linux organises files differently from Windows. Instead of drive letters (C:, D:), Linux uses a single unified directory tree starting from the root directory, written as /.
The most important directories for cybersecurity work are /etc (configuration files — attackers look here for credentials and settings), /var/log (log files — defenders look here for evidence of attacks), and /home (user files — both attackers and defenders examine these).
Activity 2 — Linux Directory Scenarios
Linux File System Navigation
Activity 3 — Sort the Linux Facts
True or False: Linux Facts
Linux is free and open source. true Linux is released under the GPL licence — free to use, modify, and distribute. Anyone can read the source code. Linux uses drive letters like C: and D: to organise files. false Linux uses a single unified directory tree starting from / (root). Drive letters are a Windows convention. Kali Linux comes pre-installed with over 600 security tools. true Kali Linux is specifically designed for cybersecurity work and includes tools like Nmap, Metasploit, Wireshark, and hundreds more. Linux runs on fewer than 10% of the world’s web servers. false Linux runs on over 96% of the world’s top web servers. It dominates server infrastructure. System log files on Linux are typically stored in /var/log. true /var/log is the standard location for log files on Linux systems, including authentication logs and system events. Linux only has one version, like Windows. false Linux comes in hundreds of distributions (distros) — Ubuntu, Kali, Debian, Fedora, and many more, each with different purposes.
Activity 4 — Flashcard Review
What is Linux? — Key Terms
Linux A free, open-source operating system kernel created by Linus Torvalds in 1991. Runs the majority of the world’s servers, Android phones, supercomputers, and is the primary OS for cybersecurity professionals.
- Core
- Open Source
Software whose source code is publicly available for anyone to read, modify, and distribute. Linux is open source — this allows security researchers to audit the code for vulnerabilities and anyone to contribute improvements.
- Concept
- Linux Distribution (Distro)
A version of Linux packaged with specific software, tools, and a desktop environment. Examples: Ubuntu (general use), Kali Linux (cybersecurity), Debian (servers), Fedora (developers). All share the same Linux kernel.
- Concept
- Kali Linux
A Linux distribution designed for cybersecurity and penetration testing. Pre-installed with 600+ security tools including Nmap, Metasploit, Wireshark, and Burp Suite. The most widely used OS in professional security work.
- Distro
- Root Directory (/)
The top of the Linux file system hierarchy. Everything on the system is under /. Unlike Windows (which uses drive letters), Linux has one unified tree starting from /.
- File System
- /etc
The Linux directory containing system configuration files. SSH config (/etc/ssh/sshd_config), user accounts (/etc/passwd), network settings, and service configurations all live here. A critical directory for both administrators and attackers.
- File System
- /var/log
The Linux directory containing log files. Authentication logs (/var/log/auth.log), system events (/var/log/syslog), and application logs are stored here. The first place a security analyst looks when investigating an incident. File System
Activity 5 — Linux in Cybersecurity Quiz
What is Linux? — Knowledge Check
Why do cybersecurity professionals predominantly use Linux rather than Windows?
- Linux is easier to use than Windows
- Linux has more games available
- Linux provides direct system access, powerful command-line tools, open-source transparency, and is the OS running most servers being tested
- Linux is required by law for security work
Answer: Linux provides direct system access, powerful command-line tools, open-source transparency, and is the OS running most servers being tested
Security professionals need to understand and interact with systems at a deep level. Linux’s command line, open-source nature, and the fact that most internet servers run Linux makes it the natural choice. Kali Linux comes pre-installed with 600+ security tools.
Where would you find authentication logs on a Linux system?
- /home/logs
- /etc/logs
- /var/log/auth.log
- /bin/auth
Answer: /var/log/auth.log
/var/log is where Linux stores log files. /var/log/auth.log specifically records authentication events — login attempts, sudo usage, and SSH connections. This is the first file a security analyst checks when investigating a potential intrusion.
Linux is only used by advanced programmers and has no relevance to everyday cybersecurity work.
- True
- False
Answer: False
Linux runs over 96% of the world’s top web servers, all Android phones, most cloud infrastructure, and is the primary OS for cybersecurity professionals. Understanding Linux is essential for anyone pursuing a career in cybersecurity, cloud computing, or software development.
Previous lesson: Ports and protocols
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: The Linux terminal