Security operations centers (SOCs) monitor an organization's posture around the clock. When an incident occurs, teams follow a structured incident response process: preparation, identification, containment, eradication, recovery, and lessons learned. Tabletop exercises walk through simulated incidents in a meeting to test procedures, and digital forensics with rigorous chain of custody investigates events and preserves evidence for legal proceedings. Key performance metrics include Mean Time To Detect (MTTD) and Mean Time To Respond or Recover (MTTR), while dwell time measures how long an attacker remains undetected inside a network.
Threat-informed defense requires understanding adversaries. Threat intelligence supplies information about threats that informs defensive actions, and open source intelligence (OSINT) gathers that information from public sources. Frameworks like the cyber kill chain describe stages from reconnaissance through actions on objectives, while MITRE ATT&CK catalogs adversary tactics, techniques, and procedures in much finer detail. Penetration testing authorizes simulated attacks to evaluate security; red teams play the attacker, blue teams play the defender, and purple teams collaborate to maximize learning. Bug bounty programs and responsible disclosure give external researchers a sanctioned way to report vulnerabilities, while vulnerability management is the broader process of identifying, evaluating, and remediating weaknesses, tracked through identifiers like CVE and scored using CVSS, where a score of seven or higher is considered high severity.
Detection relies on multiple techniques. Signature-based detection matches known patterns, heuristic detection flags suspicious characteristics, and behavior-based or anomaly-based detection, often supported by User and Entity Behavior Analytics (UEBA), identifies deviations from normal activity. Security Orchestration, Automation, and Response (SOAR) platforms automate parts of these workflows, and AI and machine learning increasingly help with threat hunting, detection, and triage. Comprehensive logging with defined log retention supports both real-time monitoring and later investigation.
Governance, risk, and compliance (GRC) ties security to the business. A CISO leads the security function, while a security policy and Acceptable Use Policy (AUP) set organizational rules. Independent security audits review controls, and security awareness training, including phishing simulations, turns employees into a human firewall. Data classification schemes label data by sensitivity, distinguishing data at rest, data in transit, and data in use, with full disk encryption tools like BitLocker, FileVault, and LUKS protecting stored data. Business Continuity and Disaster Recovery (BCDR) planning addresses major outages and attacks through objectives like Recovery Time Objective (RTO) and Recovery Point Objective (RPO), supported by backups following practices such as the 3-2-1 rule (three copies, two different media, one offsite), immutable backups that cannot be altered, and air-gapped backups disconnected from the network.
Compliance frameworks define external obligations. The NIST Cybersecurity Framework organizes security into five functions: identify, protect, detect, respond, and recover, while ISO 27001 provides an international standard for information security management systems, and SOC 2 audits controls at service organizations. Sector-specific rules include GDPR (an EU privacy law whose maximum fine is twenty million euros or four percent of global annual revenue, whichever is higher), HIPAA (US health information protection), and PCI DSS (for cardholder data). The broader industry context includes the cybersecurity skills gap, the high cost of data breaches, the role of cyber insurance, and a workforce that builds credibility through certifications such as Security+, CISSP, CEH, OSCP, CISM, and CISA.