Defensive Security Fundamentals
Defensive Security Fundamentals is the vocabulary layer of the eCDFP. It tests whether you can reason about controls, risk and adversary models instead of reciting product names. Expect scenario items that ask you to classify a control, map observed activity to a framework, or choose the defensible next step when two options both sound reasonable.
Core rules and concepts
- Risk = likelihood x impact. A vulnerability is a weakness; a threat is an actor or event that could exploit it; risk exists only where the two meet on an asset. A critical CVE on an isolated, powered-off host is not automatically a critical risk.
- Control families: preventive (blocks), detective (records or alerts), corrective (restores), compensating (substitutes when the primary control is infeasible). Defense in depth layers network, endpoint, identity and data controls so that no single failure is fatal.
- Least privilege, separation of duties, secure defaults, attack-surface reduction are design rules, not products.
- Kill Chain vs ATT&CK: the Cyber Kill Chain is a linear seven-phase adversary progression from reconnaissance to actions on objectives. MITRE ATT&CK is a matrix of tactics (the 'why') and techniques (the 'how') derived from observed intrusions, and is the right tool for mapping detection coverage.
- Pyramid of Pain ranks indicators by how much blocking them hurts the adversary: hashes, IPs and domains are cheap to change, while tools and TTPs are expensive. Detection built on TTPs survives infrastructure rotation.
- NIST CSF functions: Identify, Protect, Detect, Respond, Recover. Zero Trust: never trust implicitly, verify explicitly, assume breach.
Worked example
A workstation runs an unpatched browser (vulnerability) and its user visits a malicious ad network (threat). You deploy an EDR rule that kills the child process spawned by the browser: that is a preventive, host-based, technical control. If instead you deploy Sysmon and alert on the same child process, the control is detective. The reasoning rule is to ask what the control actually does at the moment of the event, not which product it ships in. A compensating control appears when patching is impossible, for example isolating the host behind a restrictive firewall rule.
Traps that cost marks
Treating every vulnerability as a risk without an exposure path; labelling logging and alerting as preventive; forcing a kill-chain phase onto activity the question wants mapped to an ATT&CK tactic; treating a hash or IP blocklist as durable detection; forgetting the compensating-control option when the primary control is infeasible.
Key points
- Classify controls by function (preventive, detective, corrective, compensating) before naming a product.
- Risk requires an asset, a vulnerability and a plausible threat path.
- Use ATT&CK for tactic and technique mapping; use the Kill Chain for linear intrusion narrative.
- TTP-based detection outlives IOC-based detection per the Pyramid of Pain.
- Zero Trust means verify explicitly and assume breach, not 'trust the internal network'.