Learn
Defensive Security
How teams watch, contain, patch, and recover. These terms show up in operations centers and incident write-ups.
- Distinguish detection, prevention, and response
- Read the roles of SIEM, EDR, and vulnerability management
- Connect backups to actual recovery goals
A detector watches traffic and raises an alert. An inline control can also drop a matching pattern. A noisy prevention rule can block legitimate work.
Security devices
- Firewall
A policy enforcement point that permits or denies traffic.
Detection
- EDR
Endpoint software that records activity and helps responders investigate.
- IDS
A detector that alerts on suspicious traffic or host activity.
- Indicator of Compromise
An observable clue that a system may already be compromised.
- IPS
An inline control that can block activity matching a prevention rule.
- SIEM
A platform that collects, correlates, and searches security logs.
- XDR
Detection that correlates endpoint, identity, email, and network telemetry.
Operations
- Incident Response
The organized process for handling a security incident from detection through lessons learned.
- Log Analysis
Examining activity records to explain what happened.
- Security Monitoring
The ongoing practice of watching security signals and alerts.
- Security Operations Center
The function that monitors security alerts and coordinates response.
- Threat Intelligence
Analyzed threat information that helps a defender make a decision.
Hygiene
- Patch Management
Testing, deploying, and confirming software updates.
- System Hardening
Reducing a system's exposure by removing what it does not need.
- Vulnerability Management
The repeating cycle of finding, prioritizing, fixing, and verifying weaknesses.
Design
- Access Control
The rules and mechanisms that decide who may use a resource.
- Allowlisting
Allowing only approved items and denying everything else.
- DMZ
A buffer zone for public-facing services, separated from the internal network.
- Network Segmentation
Dividing a network so one zone cannot freely reach the others.
Recovery
- Backup
A restorable copy of data kept for recovery after loss or corruption.
- Disaster Recovery
The plan and capability for restoring technology after a severe disruption.