Security Operations
Security Operations tests day-to-day detection and response: the incident lifecycle, evidence handling, resilience targets, and the change and configuration discipline that keeps controls real. Scenario items reward the order of operations more than any single tool.
Incident response lifecycle
NIST SP 800-61 phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. Contain before you eradicate. Wiping a host to "clean" it destroys the evidence needed to find the entry vector, and may leave the persistence mechanism intact elsewhere. Post-incident activity exists to change controls, not just to file a report.
Forensic handling
Follow order of volatility: registers and cache, then memory, then network state, then disk, then backups, then archival media. Capture memory before powering a machine down. Maintain chain of custody, hash images, use write blockers, and build a timeline from multiple sources.
Resilience and continuity
A business impact analysis sets the maximum tolerable downtime, which drives RTO (restore time) and RPO (tolerable data loss). Site options run hot, warm, cold. Backups follow 3-2-1 with at least one offline or immutable copy, and an untested restore is an assumption, not a control. RAID and replication are availability mechanisms, not backups.
Detection infrastructure
Centralised logging in a SIEM with synchronised time, defined retention, and use cases that generate actionable alerts; UEBA for behavioural anomalies; threat intelligence expressed as indicators and adversary tactics.
Worked example
Ransomware is encrypting a file server. First, isolate the server at the network level while leaving it powered on so memory evidence survives - containment limits spread and preserves the data needed to find the entry vector. Then identify patient zero from EDR telemetry and logs, and verify whether backups are immutable or already encrypted. Eradicate by rebuilding, rotating credentials, and patching the entry point, then restore from a verified clean backup and hold a post-incident review. The reasoning: every step preserves the ability to complete the next one.
Traps that cost marks
- Eradicating or restoring before containing, causing reinfection.
- Powering off a host and losing volatile evidence.
- Treating RAID, snapshots, or replication as backups.
- Emergency changes made without retroactive documentation.
- Deleting logs during troubleshooting.