Security Operations
Security Operations covers keeping controls running: monitoring, responding, recovering, and changing systems without breaking them.
Core rules
- Incident response phases: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Containment may precede full analysis, but evidence preservation and scope matter.
- SIEM correlates logs; it does not replace tuned detection, retention, or response procedures. Time synchronization and centralized logging improve investigations.
- BCP keeps the business operating; DR restores technology. RTO is maximum tolerable downtime; RPO is maximum tolerable data loss. Backups need isolation, testing, and restoration checks.
- Change management approves and records changes; emergency changes still require retrospective review. Patch management prioritizes by exposure and exploitability, not only CVSS.
- Physical and environmental controls-access, fire suppression, power, temperature-protect availability.
Worked example
Ransomware is detected on a file server. The team isolates the host from the network, preserves volatile evidence, identifies the account and initial vector, disables compromised credentials, and restores from an offline backup after verifying it is clean. Restoring first without containment risks reinfection; waiting for perfect attribution risks spread. The order reflects containment, evidence, eradication, recovery, then lessons learned.
Traps
RTO and RPO are not interchangeable. Disaster recovery is not business continuity. A SIEM alert is not an incident until validated. Backups that have never been restored are unproven. Patching every system immediately can conflict with availability requirements and change control.