Security Operations
Incident response
Use the NIST SP 800-61 lifecycle: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Sequence matters - contain before you eradicate, and never destroy evidence in the name of speed. Lessons learned feed back into preparation.
Detection and monitoring
SIEM aggregates and correlates logs; SOAR automates playbooks; EDR watches endpoints; IDS/IPS compares signatures or baselines behavior. Understand SOC tiering, log retention, time synchronization (NTP matters for correlation and forensics), and detection engineering - tuning to reduce false positives rather than maximizing alerts.
Operational resilience
Vulnerability management is a cycle: discover, prioritize (CVSS, EPSS, known-exploited lists, business criticality), remediate, verify. Patch and configuration management ride on change control. Backups follow 3-2-1 and must be restore-tested; recovery sites are hot, warm, or cold depending on standby readiness. Tabletop exercises and failover tests prove the plan works.
Forensics
Respect the order of volatility: registers and cache → memory → network state → disk → removable media → backups and archives. Use write blockers, hash evidence, and maintain chain of custody. Do not power off a suspect host before capturing volatile data.
Traps
Reimaging a compromised host before collection is always the wrong answer. Blue team defends, red team attacks, purple team improves both. MTTR measures response speed, not incident count.
Worked example
A laptop is suspected of compromise. Correct order: capture RAM and live network connections, then image the disk through a write blocker, hash the image, and log every transfer of custody. Escalating straight to a rebuild destroys the evidence you would need for scoping and legal action.