Skip to content

Chapter 7 of 8

Defense Operations and Incident Response

Defenders think in terms of controls and their timing. Preventive controls stop incidents before they happen, detective controls find them when they occur, and corrective controls fix the aftermath. Security controls themselves may be technical, administrative, or physical. Threat modeling provides a structured analysis of what assets need protection, from whom, and how. Microsoft's STRIDE categorizes threats as Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. DREAD is a complementary scoring model weighing Damage, Reproducibility, Exploitability, Affected users, and Discoverability. Frameworks like the Lockheed Martin cyber kill chain describe attack stages from Reconnaissance through Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives, while MITRE ATT&CK catalogs adversary tactics, techniques, and procedures (TTPs) for threat modeling and detection engineering.

Vulnerability management is an ongoing discipline. Common Vulnerabilities and Exposures (CVE) provide unique identifiers for publicly known vulnerabilities, while the Common Vulnerability Scoring System (CVSS) rates severity on a 0-10 scale based on attack vector, complexity, and impact, and the Common Weakness Enumeration (CWE) categorizes software weakness types. A zero-day vulnerability is unknown to the vendor, meaning no patch exists when it is discovered or exploited, making it especially dangerous because defenders have zero days to prepare and traditional signature-based tools cannot detect it. Patch management is the process of identifying, testing, deploying, and verifying patches across systems, prioritizing internet-facing systems. Vulnerability scanning uses automated tools to find known weaknesses without exploiting them, while penetration testing involves authorized simulated attacks that actively exploit vulnerabilities to assess real-world impact and reveal how they can be chained. A red team exercise is a realistic adversary simulation that tests detection and response more broadly than a pentest, while a blue team is the defensive counterpart monitoring and protecting systems; a purple team combines both sides to improve attack and defense together.

The incident response lifecycle, defined in NIST SP 800-61, proceeds through Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. Preparation establishes plans and teams; identification detects the incident; containment limits the damage and prevents spread; eradication removes the threat; recovery restores systems to normal operation; and lessons learned reviews the incident to improve future response. Containment is especially critical because without rapid action an attacker could escalate privileges, exfiltrate more data, or compromise additional assets, dramatically increasing impact. A Security Operations Center (SOC) monitors, detects, and responds to events around the clock. SIEM platforms collect and correlate logs, SOAR platforms automate response, EDR and XDR provide endpoint and cross-domain telemetry, and threat intelligence supplies information about emerging threats. Indicators of Compromise (IOCs) are observable artifacts suggesting an intrusion, including file hashes, IP addresses, domains, and registry changes. A security incident is any event that threatens confidentiality, integrity, or availability and requires investigation or response. The security officer accountable for these programs is the Chief Information Security Officer (CISO), an executive who carries the responsibility for organizational security posture and risk treatment decisions.

All chapters
  1. 1Foundations of Cybersecurity
  2. 2Identity, Authentication, and Access Control
  3. 3Cryptography and Public Key Infrastructure
  4. 4Network and Infrastructure Security
  5. 5Application and Web Security
  6. 6Threats, Attacks, and Malware
  7. 7Defense Operations and Incident Response
  8. 8Governance, Risk, and Compliance

Drill it

Reading is not remembering. These come from the Cybersecurity Fundamentals deck:

Q

What are the three components of the CIA triad in cybersecurity?

Confidentiality (ensuring data is accessible only to authorized parties), Integrity (ensuring data is accurate and unaltered), and Availability (ensuring system...

Q

How does a breach of "integrity" in the CIA triad differ from a breach of "confidentiality"?

A confidentiality breach means unauthorized parties accessed the data (e.g., a data leak). An integrity breach means the data was altered or tampered with witho...

Q

Why is "availability" considered equally important as confidentiality and integrity?

Even if data remains confidential and unaltered, a system is useless if legitimate users cannot access it when needed. DDoS attacks, ransomware, and hardware fa...

Q

What is a phishing attack and what makes spear phishing more dangerous?

Phishing uses fraudulent emails or messages to trick victims into revealing sensitive information or clicking malicious links. Spear phishing targets a specific...