Security Operations and Incident Management
Core concepts
Security operations covers prevention, detection, response, and recovery. Know the incident response lifecycle (prepare, identify, contain, eradicate, recover, lessons learned) and the difference between an event, an incident, and a crisis. Understand access control principles (least privilege, need-to-know, defense in depth), physical security layers, and the role of a security operations center (SOC).
Reporting and escalation
Expect questions on escalation thresholds, notification chains, evidence preservation (chain of custody), and the balance between containing a threat and preserving evidence. Know business continuity and disaster recovery basics and their relationship to incident management.
Traps to watch
- Jumping to eradication before containment - contain first.
- Skipping lessons learned; the cycle is incomplete without it.
- Confusing need-to-know (information access) with least privilege (system/access rights).
- Breaking chain of custody by handling evidence improperly.
- Treating every anomaly as a crisis; proportional escalation matters.
Rule of thumb
When in doubt during an incident: protect life, then contain, then preserve evidence, then investigate. Safety outranks property and evidence.
Worked example
An analyst detects unauthorized badge use at a restricted door. Correct sequence: verify the alert (identify), restrict access/contain, preserve logs and video (chain of custody), then investigate and apply lessons learned - not immediately confront the individual without coordination.