دانلود کتاب عملیات امنیت و تحلیل دفاعی

Security monitoring and the ability to detect breaches are important components of successful enterprise defense. Because of this, we must understand how attacks are conducted and must become proficient in the handling, parsing, and understanding of log data.

Along with these “hard skills” we must also understand the mindset of attackers and adapt our own productive mindsets, which will compel us to lean into complex issues in pursuit of the facts surrounding a data breach. In this Learning Unit we will discuss these “softer skills”, which will serve as a foundation for our later discussion.

As a security defense professional, we are charged with the defense of an IT infrastructure and all systems connected to it. To perform this job effectively, we must understand how attacks are performed so we can better detect them.

By way of illustration, consider an analogy of a medieval monarch building a castle. If the monarch learns that their enemy has built catapults capable of hurling large boulders, the monarch may implement thicker walls. Similarly, if their enemy is equipped with ladders, the monarch might give their troops tools to push the ladders off the walls. In this scenario, the monarch can build a better defense by understanding the techniques and mindsets of their would-be attacker.

Similarly, we must consider the perspectives, tools, and tactics of an attacker to anticipate what they might do next. In industry terms, we should develop a better security mindset.1 As we understand the weaknesses in the target systems and networks, we gain a better insight into what to look for in security logs, which will allow us to detect attacks in real time.