Cyberspace Operations and Defensive/Offensive Doctrine
Doctrine vocabulary
Offensive cyberspace operations (OCO) act against adversary systems; defensive cyberspace operations (DCO) protect friendly networks; DODIN operations build and maintain the network itself. Every operation requires authorization, defined scope, and rules of engagement - unauthorized “testing” is a crime, not OCO.
The attack lifecycle
The kill chain runs: reconnaissance → weaponization → delivery → exploitation → installation → command and control → actions on objectives. Reconnaissance can be passive (OSINT, certificate transparency logs) or active (scanning, which is noisy and detectable). Later activity includes privilege escalation, lateral movement, persistence, and exfiltration. MITRE ATT&CK catalogs real adversary tactics and techniques (TTPs) so defenders can map detection coverage to each stage.
Defensive stack
Perimeter firewalls, network segmentation, EDR on endpoints, SIEM log correlation, IOC feeds, threat hunting, deception (honeypots), and tested backups. Common frameworks: NIST CSF (Identify, Protect, Detect, Respond, Recover) and NIST SP 800-61 for incident handling.
Traps
Assuming attribution is certain - it is almost always probabilistic. Confusing preventive with detective controls: patching is preventive, a SIEM is detective. Believing a vulnerability scan exploits anything. Mixing up OCO with lawful penetration testing performed under written authorization.
Worked example
A phishing email is delivery; a macro executing is exploitation; periodic HTTPS beacons to a rare domain are command and control. Rule of thumb: if you can name the ATT&CK tactic in front of you, you can predict the next technique and check the matching control.