Defensive Security Intro

This task will explore defensive security in more depth. You will also meet some of the experts within a defensive security team to learn more about their day-to-day responsibilities.

Let's start by focusing on some key areas of defensive security:

What's more, a defensive security team is made up of a mixture of roles and responsibilities. Below, let's meet some of the highly-skilled individuals you would find within a defensive security team:

 

Bob, SOC Analyst

Bob monitors events on the organisation's network and systems to identify suspicious or expected behaviour.

 

He is at the frontline of protecting the organisation.

 

Aaliyah, Incident Responder

Aaliyah is responsible for investigating and responding to ongoing security incidents within the organisation.

 

She will monitor and prevent attackers in real time and share lessons learned during the attack to prevent future incidents.

 

Zoe, Security Engineer

Zoe develops and maintains the essential tools and systems that support the defensive security team.

 

 

These systems enable the team to monitor, investigate, and explore events within an organisation.

 

Bill, Digital Forensics

Bill will utilise their expertise to understand what occurred during an incident.

 

They will gather, preserve, and analyse evidence from the network and systems to uncover vital information about the attackers and their methods.

Now that you’ve been introduced to defensive security and met some key individuals, let's understand how it is applied.

Organisations don’t rely on a single tool or method to stay secure — they build layers of defence, much like an onion or many layers to a castle. We call this "Defence in Depth," meaning that if one security measure fails, we have others to rely upon at various stages.

 Examples of these defensive measures include:

This means that even if an employee clicks on a dangerous attachment in an email, other protections are in place to prevent the malicious attachment from harming the organisation.

Defensive security teams rely on a wide range of tools and technologies. These tools allow professionals to analyse information and investigate threats more effectively. This section will look at some key technologies commonly used by defensive security teams worldwide.

Exploring the Security Operations Centre (SOC)

Think of a SOC as the defensive security centre for an organisation's technology. This busy centre is the frontline of protecting an organisation, often operating around the clock, 365 days a year, and employs a variety of security professionals who monitor and protect the organisation's networks, systems, and data.

A typical day in the SOC could look like:

• Reviewing alerts triggered by security tooling
• Investigating anomalies
• Responding to incidents

These professionals are often the eyes and ears on the frontline for protecting an organisation.

SIEMs: The Defensive Security Radar

Much like a control centre in the real world, SIEMs (Security Information and Event Management) systems are the central place for all data and information collected from security devices, workstations, servers, and more within an organisation.

Much like radar sweeping the digital environment, these systems are an absolutely critical part of any organisation's defensive security, as they offer insight into what is happening within the organisation's IT.

The systems inside an organisation produce a large amount of information. This information needs to be brought together in one central and easy-to-access place to understand what's happening quickly and clearly. This way, several people can review and analyse it quickly.

Phew, well done for progressing this far. Now, you will complete a hands-on exercise within a defensive security team to investigate an active attack.

Scenario

You will be joining the defensive security team for FakeBank, a large financial institution. You will be at the forefront of investigating and resolving suspicious events marked as such by FakeBank's sophisticated "Security Information and Event Management (SIEM)."

It is your duty to protect FakeBank and it's customers. Be proactive and inquisitive. To begin this practical, click on the green "View Site" button located below.

This action will open a "static site" on the right side of your screen. Investigate the "Web Discovery Attack" and perform the necessary, guided, protective measures to stop it from continuing.