Overview
Defensive Security focuses on preventing, detecting, and responding to cyber threats. Unlike offensive security which focuses on finding and exploiting vulnerabilities, defensive security aims to protect systems, detect intrusions, and minimize damage when incidents occur. Core tasks include user awareness training, asset management, system patching, preventative device deployment, and logging and monitoring.
Terminology
| Term | Definition |
|---|---|
| SOC | Security Operations Center; team responsible for monitoring and responding to threats |
| Threat Intelligence | Collection and analysis of information about potential attackers to improve defenses |
| DFIR | Digital Forensics and Incident Response; scientific investigation of cyber incidents |
| Malware Analysis | Study of malicious programs to understand behavior and intent |
| Incident Response | Structured methodology for handling attacks, breaches, or misconfigurations |
| Static Analysis | Examining malware without executing it |
| Dynamic Analysis | Executing malware in a controlled environment to observe behavior |
| Threat-Informed Defense | Defensive posture shaped by knowledge of likely attackers and their techniques |
Core Concepts
Security Operations Center (SOC)
Team responsible for monitoring networks and systems to detect malicious events.
| Area of Interest | Description |
|---|---|
| Vulnerabilities | Unpatched systems and software weaknesses |
| Policy Violations | Unauthorized user or system behavior |
| Unauthorized Activity | Suspicious access patterns on the network |
| Intrusions | Active lateral movement or compromise |
Threat Intelligence
Collects and analyzes information about potential adversaries to enable a threat-informed defense.
- Identifies likely attack vectors and threat actors
- Shapes defensive priorities and controls
Digital Forensics and Incident Response (DFIR)
Applies scientific methods to investigate cyber incidents.
| Focus Area | Description |
|---|---|
| File Systems | Examining stored files and artifacts left by attackers |
| System Memory | Programs run in memory but may not be saved to disk — volatile evidence |
| System Logs | Records of system activity useful for reconstructing events |
| Network Logs | Records of network traffic and connections |
Malware Analysis
| Method | Description |
|---|---|
| Static Analysis | Examining malware code without executing it |
| Dynamic Analysis | Running malware in a controlled environment to observe its behavior |
Incident Response
Structured methodology for handling attacks, breaches, or misconfigurations.
4 Steps To Incident Response
Backlog
Document the four phases (Preparation, Detection, Containment, Recovery) when revisiting with HTB content
Related Concepts
- SOC Fundamentals
- Log Fundamentals
- Intrusion Detection Systems (IDS)
- Intro to SIEM
- Firewalls
- Vulnerability Scanners
- Security Principles
- Threat Actors
- Insider Threat
- Ransomware
- DDoS
- Social Engineering
- Security Domains
Related Techniques
References / Images
- 4 Steps To Incident Response