Domain 7: Security Operations
Defence-in-depth operations
Least privilege + need to know as default; separation of duties; job rotation; mandatory vacation (fraud detection); SPF = special privileges reviewed. Monitor privileged activity: session recording, command logging (PowerShell transcripts), vaulted credentials, JIT elevation.
Logging and detection stack
- Syslog (514), Windows event forwarding, netflow, DNS logs; time sync (NTP) matters for correlation.
- SIEM = central collection, correlation, alerting, retention.
- EDR/XDR = endpoint telemetry + automated response.
- SOAR = playbooks and automation; UEBA = behaviour baselines for insider detection.
- NIST SP 800-137: continuous monitoring; define events vs incidents (incident = event violating policy/harm).
Incident response (NIST 800-61 order)
- Preparation (playbooks, contacts, tooling) — before anything.
- Detection & analysis (triage, severity, declare incident).
- Containment (short-term isolate, long-term segment), eradication (remove root cause, patch), recovery (restore, validate, monitor).
- Post-incident activity — lessons learned report.
First responder basics: do not power off a compromised machine (RAM evidence); isolate at the network level; notify per playbook; preserve chain of custody.
Forensics and evidence
Order of volatility (collect first): CPU registers/cache → RAM & swap → temp/system files on disk → data on disk → remote logs/monitoring → physical configuration → archival media.
Hash evidence (before/after), write blockers, work on copies, document every transfer (who/when/why). Evidence: real (objects) vs testimonial (statements); admissibility = material, relevant, competent. Hearsay rules complicate logs — part of regular business practice helps.
Backup & recovery engineering
| Strategy | What it captures | Restore needs |
|---|---|---|
| Full | everything | 1 tape/file |
| Differential | changes since LAST FULL | last full + last diff |
| Incremental | changes since LAST BACKUP | last full + every incr since |
Grandfather-Father-Son rotation; 3-2-1 rule (3 copies, 2 media, 1 offsite or immutable); replication ≠ backup (replicates deletion too); test restores regularly. RAID is availability, not backup.
Sites: hot (live sync), warm (hardware ready, data restored on need), cold (space + power), mobile/reciprocal agreements. DR test types: read-through/checklist → table-top → walkthrough → simulation → parallel → full interruption (riskiest).
Reliability numbers
MTBF (mean time between failures), MTTR (repair), MTTF (non-repairable life), availability = uptime/(uptime+downtime) — 99.9% ≈ 8.76 h downtime/year. Redundancy designs: N+1, 2N; clustering, failover pairs, load balancing.
Change and configuration management
Change request → CAB review → test (staging) → schedule → implement → verify/back-out plan. Configuration baselines (CIS benchmarks), golden images, IaC pipelines with peer review, version control for infrastructure. Patch management cycle: evaluate → test → approve → deploy → verify; emergency changes documented retroactively.
Threat intelligence and hunting
Intel levels: strategic (trends for executives), operational (campaigns, TTPs), tactical (IOCs — hashes, IPs, domains). Feeds: STIX (language) / TAXII (transport). Threat hunting = proactive, hypothesis-driven search for what tools missed. Red vs purple team improves detection. Insider threat programs: UEBA, separation of duties, exit processes.
People and process safety nets
- Emergency/crisis management, safety of life first.
- Physical security operations: guards, CPTED, CCTV, mantraps (see physical layers) — supporting availability and confidentiality.
- MSSP/managed SOC (L1 triage, L2 investigate, L3 hunt) vs in-house; staffing models follow-the-sun.
Memory hooks
- IR order: Preparation → Detection & Analysis → Containment → Eradication → Recovery → Lessons Learned.
- Volatility: registers → RAM → disk → remote logs → archives.
- Differential = since last FULL; incremental = since last BACKUP.
- 3-2-1 backup rule; RAID is not backup.
- STIX = how intel is expressed; TAXII = how it moves.
Exam tips
- ‘What does the FIRST responder do?’ → contain/preserve, never reboot or wipe.
- Restore-order questions: full + latest differential (2 items) beats full + all incrementals.
- Lessons learned is the LAST step — but for ‘what should have happened BEFORE?’ it's preparation.
- SOAR answers contain ‘playbook/automation’; UEBA answers contain ‘behaviour/anomaly’.
- MTD/MAO ≤ RTO + WRT.