Gap Analysis , Zero Trust , Physical Security , Deception and Disruption

What is a Gap Analysis?

An evaluation that compares an organization's current security posture against a desired standard, framework, or regulatory baseline to identify missing controls (the "gaps") and build a remediation roadmap.

What is the core philosophy of Zero Trust?

"Never trust, always verify." Implicit trust based on network location (e.g., being inside the corporate office or on the VPN) is completely eliminated; every access request must be authenticated, authorized, and validated dynamically.

What are key implementation components of a Zero Trust architecture?

• Micro-segmentation (breaking the network into tiny zones)

• Continuous device health and behavior monitoring

• Least-privilege access enforced per application, not per network session

What is a Mantrap (Airlock)?

A physical security control consisting of two interlocking doors with a small space between them. The first door must close and verify identity (often via biometrics) before the second door can open, specifically designed to prevent tailgating/piggybacking.

Physical controls for asset protection (Rack-level)

Rack-level locks, locked server cabinet doors, and physical port blockers to prevent hardware theft and unauthorized physical plug-ins (like rogue USB rubber duckies).

Environmental controls in physical security

HVAC systems with strict temperature and humidity monitoring, plus fire suppression systems (like pre-action or clean-agent systems), designed to protect server hardware and media vaults.

What is a Honeypot?

A decoy system, server, or application deployed on a network that contains simulated vulnerabilities and attractive fake data to lure, distract, and study attackers without risking real assets.

What are Honeyfiles (Canary Tokens)?

Decoy files (e.g., passwords.txt) placed in sensitive locations. Because legitimate users have no reason to touch them, any attempt to access or read a honeyfile instantly triggers an alert in the SOC.

What is a Honeynet?

An entire network of multiple decoy systems designed to lure attackers, allowing security teams to safely observe, log, and gather threat intelligence on active attacker TTPs (Tactics, Techniques, and Procedures).