Security Operations and Incident Response
Operations is continuous: centralise logs in a SIEM, define baselines from hardened configurations, monitor for deviation, and manage change and patching with documented approvals and rollback plans. Vulnerability management is a cycle - discover, prioritise by risk and exploitability, remediate or mitigate, verify - not a scan report. Asset inventory is the prerequisite; you cannot protect what you have not recorded.
Incident response follows a lifecycle: preparation → detection and analysis → containment, eradication and recovery → post-incident activity. Prepare playbooks, contacts, tooling and authority in advance. On detection, confirm and scope before acting; contain (short-term isolation, then longer-term with clean segmentation); eradicate the root cause; recover to a known-good state; then hold a lessons-learned review.
Evidence handling follows order of volatility: collect from the most perishable first - CPU registers and cache, memory, network connections, running processes, disk, remote logs, backups. Photograph and document the scene, hash images, and never power off a running machine if memory capture matters; isolate the network instead.
Continuity and recovery: compare hot, warm and cold sites, and DR test types - checklist, walkthrough/tabletop, simulation, parallel and full failover - increasing in cost and assurance. Backups need the 3-2-1 rule, immutability and tested restores, because ransomware targets backups first. Malware families to recognise: virus, worm, trojan, rootkit, ransomware, logic bomb, fileless and supply-chain attacks.
Traps: eradication before containment lets an attacker spread; shutting a machine down destroys volatile evidence; a full failover test is not the first test you run; restoring backups is part of recovery, not eradication; a SIEM correlates but does not automatically remediate.
Worked example: malware alert on a workstation - isolate the NIC, capture memory and process list, image the disk, preserve logs, identify the patient-zero and lateral movement, then reimage rather than clean, and review detections after recovery.