Defenders think in terms of controls and their timing. Preventive controls stop incidents before they happen, detective controls find them when they occur, and corrective controls fix the aftermath. Security controls themselves may be technical, administrative, or physical. Threat modeling provides a structured analysis of what assets need protection, from whom, and how. Microsoft's STRIDE categorizes threats as Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. DREAD is a complementary scoring model weighing Damage, Reproducibility, Exploitability, Affected users, and Discoverability. Frameworks like the Lockheed Martin cyber kill chain describe attack stages from Reconnaissance through Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives, while MITRE ATT&CK catalogs adversary tactics, techniques, and procedures (TTPs) for threat modeling and detection engineering.
Vulnerability management is an ongoing discipline. Common Vulnerabilities and Exposures (CVE) provide unique identifiers for publicly known vulnerabilities, while the Common Vulnerability Scoring System (CVSS) rates severity on a 0-10 scale based on attack vector, complexity, and impact, and the Common Weakness Enumeration (CWE) categorizes software weakness types. A zero-day vulnerability is unknown to the vendor, meaning no patch exists when it is discovered or exploited, making it especially dangerous because defenders have zero days to prepare and traditional signature-based tools cannot detect it. Patch management is the process of identifying, testing, deploying, and verifying patches across systems, prioritizing internet-facing systems. Vulnerability scanning uses automated tools to find known weaknesses without exploiting them, while penetration testing involves authorized simulated attacks that actively exploit vulnerabilities to assess real-world impact and reveal how they can be chained. A red team exercise is a realistic adversary simulation that tests detection and response more broadly than a pentest, while a blue team is the defensive counterpart monitoring and protecting systems; a purple team combines both sides to improve attack and defense together.
The incident response lifecycle, defined in NIST SP 800-61, proceeds through Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. Preparation establishes plans and teams; identification detects the incident; containment limits the damage and prevents spread; eradication removes the threat; recovery restores systems to normal operation; and lessons learned reviews the incident to improve future response. Containment is especially critical because without rapid action an attacker could escalate privileges, exfiltrate more data, or compromise additional assets, dramatically increasing impact. A Security Operations Center (SOC) monitors, detects, and responds to events around the clock. SIEM platforms collect and correlate logs, SOAR platforms automate response, EDR and XDR provide endpoint and cross-domain telemetry, and threat intelligence supplies information about emerging threats. Indicators of Compromise (IOCs) are observable artifacts suggesting an intrusion, including file hashes, IP addresses, domains, and registry changes. A security incident is any event that threatens confidentiality, integrity, or availability and requires investigation or response. The security officer accountable for these programs is the Chief Information Security Officer (CISO), an executive who carries the responsibility for organizational security posture and risk treatment decisions.