(Pre Security) Section 2: Intro to Defensive Security

Question 1

Defensive security is somewhat the opposite of offensive security, as it is concerned with two main tasks:

Answer 1

Preventing intrusions from occurring
Detecting intrusions when they occur and responding properly

Question 2

____ are part of the defensive security landscape.

Answer 2

Blue teams

Question 3

A Security Operations Center (SOC) is…

Answer 3

A team of cyber security professionals that monitors the network and its systems to detect malicious cyber security events.

Question 4

Some of the main areas of interest for a SOC are:

Answer 4

Vulnerabilities: Whenever a system vulnerability (weakness) is discovered, it is essential to fix it by installing a proper update or patch. When a fix is not available, the necessary measures should be taken to prevent an attacker from exploiting it. Although remediating vulnerabilities is of vital interest to a SOC, it is not necessarily assigned to them.
Policy violations: We can think of a security policy as a set of rules required for the protection of the network and systems. For example, it might be a policy violation if users start uploading confidential company data to an online storage service.
Unauthorized activity: Consider the case where a user’s login name and password are stolen, and the attacker uses them to log into the network. A SOC needs to detect such an event and block it as soon as possible before further damage is done.
Network intrusions: No matter how good your security is, there is always a chance for an intrusion. An intrusion can occur when a user clicks on a malicious link or when an attacker exploits a public server. Either way, when an intrusion occurs, we must detect it as soon as possible to prevent further damage.

Question 5

In this context, intelligence refers to…
A threat is…
Threat intelligence aims to…
The purpose would be to…

Answer 5

Information you gather about actual and potential enemies.
Any action that can disrupt or adversely affect a system.
Gather information to help the company better prepare against potential adversaries.
Achieve a threat-informed defense…