Security Operations
Operational foundations
Change management with approval and rollback paths, accurate asset inventory, and hardened configuration baselines (CIS Benchmarks, STIGs) underpin everything else. Vulnerability management is a cycle: discover, prioritize by CVSS plus exploitability plus asset criticality, remediate or mitigate, verify, and report.
Monitoring and detection
Logs feed SIEM correlation; SOAR automates triage and response; EDR/XDR watches endpoint behavior rather than signatures. IDS detects out-of-band from a span or tap port, while IPS sits inline and blocks. Firewall generations run from packet filter to stateful to NGFW, with WAFs inspecting Layer 7 web traffic. NAC admits or quarantines devices based on posture. DLP watches data egress, email security leans on SPF, DKIM, and DMARC, DNS filtering blocks malicious resolution, and honeypots or honeynets are deception for detection rather than prevention.
Identity and access
SSO reduces credential sprawl, MFA blocks replay of stolen passwords, federation uses SAML or OAuth/OIDC, Kerberos handles domain authentication, and PAM with just-in-time elevation contains privileged accounts.
Incident response and forensics
The lifecycle is preparation; detection and analysis; containment, eradication, and recovery; then post-incident activity and lessons learned. Preserve evidence with documented chain of custody and hash verification, and collect in order of volatility: CPU and cache, then memory, then network state, then disk, then backups and logs.
Wireless, physical, and proactive work
WPA3 with 802.1X/EAP, rogue AP detection, cameras, locks, and access logs round out operations; threat hunting and threat intelligence feed proactive detection.
Worked example: a running server is actively compromised and must be imaged. Capture memory first, then the disk image, hashing both - powering it off destroys volatile evidence.