Domain 4: Security Operations

Log Data - Firewall Logs

Records tracking permitted and blocked traffic across boundaries, logging IP addresses, ports, and applications.

Log Data - Application Logs

Software-generated event records capturing transactions, database queries, authentication attempts, and errors.

Log Data - Endpoint Logs

Local host telemetry capturing process execution, file modifications, logon events, and account modifications.

Log Data - OS-Specific Security Logs

Operating system event records (e.g., Windows Event Viewer, Linux syslog) auditing logon sessions and privilege use.

Log Data - IPS/IDS Logs

Telemetry recording detected exploits, signature matches, anomaly alerts, and potential policy violations.

Log Data - Network Logs

Operational and routing traffic events collected from switches, routers, DHCP servers, and DNS infrastructure.

Log Data - Metadata

Contextual information describing other data (e.g., email headers, packet timing, file size, GPS coordinates).

Data Sources - Vulnerability Scans

Automated assessments that scan devices and open ports to discover missing security patches and misconfigurations.

Data Sources - Automated Reports

Scheduled or event-triggered summaries compiled by security software to track compliance, vulnerabilities, and alerts.

Data Sources - Dashboards

Real-time graphical consoles that aggregate telemetry to deliver high-level situational awareness across systems.

Data Sources - Packet Captures (PCAP)

Full-payload packet recordings captured directly from the network wire used for detailed protocol analysis and inspection.

Incident Response - Preparation

Pre-incident planning that establishes communication protocols, forensic toolkits, playbooks, and response documentation.

Incident Response - Detection

Identifying potential security events and unusual system behavior across monitoring feeds, logs, and user reports.

Incident Response - Analysis

Investigating an active intrusion, examining precursors, assessing indicators of compromise, and confirming exploit scope.

Incident Response - Containment

Isolating infected systems or compromised network segments (e.g., sandboxing) to halt threat propagation.

Incident Response - Eradication

Removing malicious artifacts, neutralizing backdoors, disabling compromised accounts, and repairing vulnerabilities.

Incident Response - Recovery

Restoring system configurations and data from backups, rebuilding compromised hosts, and verifying operational security.

Incident Response - Lessons Learned

A post-incident review meeting with affected stakeholders to identify procedural gaps and improve response strategies.

IR Training

Pre-incident instruction and drills preparing response personnel, management, and staff on proper reporting and action steps.

IR Testing - Tabletop Exercise

A discussion-based walkthrough where key stakeholders analyze simulated incident scenarios without touching production systems.

IR Testing - Simulation

A practical operational drill (such as simulated phishing) testing user habits and technical filter effectiveness.

Root Cause Analysis (RCA)

The systematic process of analyzing an incident by asking "why" to uncover the foundational failure that allowed it.

Threat Hunting

Proactively searching across networks, endpoints, and datasets to uncover stealthy adversaries before automated alerts trigger.

Digital Forensics - Legal Hold

A formal directive issued by legal counsel requiring custodians to preserve all relevant electronically stored information (ESI).

Digital Forensics - Chain of Custody

A chronological, legally verifiable record documenting every individual who accessed, transferred, or sealed physical and digital evidence.

Digital Forensics - Acquisition

The process of collecting volatile and persistent data (RAM, disk images, logs) using forensically sound methods.

Digital Forensics - Reporting

Formally documenting evidence collection methods, analytical findings, and professional conclusions for legal or organizational review.

Digital Forensics - Preservation

Isolating and protecting original evidence using cryptographic hashes and write-blockers to prevent any alteration.

Digital Forensics - E-Discovery

The formal legal process of identifying, collecting, and reviewing electronically stored information (ESI) for litigation.

Automation - User Provisioning

Automating account creation, group assignments, and access rights during onboarding and role transitions.

Automation - Resource Provisioning

Using scripted templates or orchestration tools to deploy cloud resources, virtual machines, and storage automatically.

Automation - Guard Rails

Automated boundary checks and policy rules that restrict configuration choices to ensure security compliance.

Automation - Security Groups

Automating the creation, adjustment, and auditing of virtual firewall access lists controlling instance traffic.

Automation - Ticket Creation

Scripting automated help-desk ticket generation immediately upon sensor alert or anomalous event detection.

Automation - Escalation

Configuring automated routing to alert on-call personnel or tier-level analysts when unresolved incidents reach thresholds.

Automation - Enabling/Disabling Services & Access

Scripting the instant shutdown of unauthorized services or immediate revocation of access during security containment.

Automation - Continuous Integration and Testing

Embedding automated vulnerability scans, unit tests, and build checks directly into the continuous software development pipeline.

Automation - Integrations and APIs

Using Application Programming Interfaces (APIs) to allow disparate security appliances and cloud platforms to share data seamlessly.

Automation Benefits - Efficiency / Time Saving

Automating repetitive operational tasks so security teams can focus on strategic and complex tasks.

Automation Benefits - Enforcing Baselines

Using scripts to ensure every newly provisioned system adheres strictly to defined hardening standards.

Automation Benefits - Standard Configurations

Ensuring identical, repeatable infrastructure deployments across dev, test, and production environments.

Automation Benefits - Secure Scaling

Enabling infrastructure to scale dynamically up and down while automatically applying consistent security policies.

Automation Benefits - Employee Retention

Reducing alert burnout and fatigue by automating mundane, repetitive operational procedures.

Automation Benefits - Reaction Time

Drastically lowering response times by triggering instantaneous script-driven threat mitigation.

Automation Benefits - Workforce Multiplier

Enabling a lean security team to defend and monitor an extensive enterprise footprint 24/7.

Automation Considerations - Complexity

The operational challenge of managing interconnected automation scripts where multiple moving parts must function smoothly.

Automation Considerations - Cost

The financial resources needed to build, license, implement, and maintain automation software and APIs.

Automation Considerations - Single Point of Failure

The risk that a failure in a central automation engine or script halts broader organizational operations.

Automation Considerations - Technical Debt

The long-term maintenance cost incurred by implementing quick, poorly structured scripts instead of resilient code.

Automation Considerations - Ongoing Supportability

The continuous requirement to update and test automation scripts as underlying operating systems and APIs evolve.

Monitoring - Log Aggregation

Consolidating diverse logs from servers, firewalls, and cloud services into a single centralized SIEM database.

Monitoring - Alerting

Automated, real-time notifications (SMS, email, console) dispatched when security telemetry hits defined thresholds.

Monitoring - Scanning

Continuously and actively inspecting systems, network ports, and applications to detect misconfigurations and missing patches.

Monitoring - Reporting

Compiling processed log and audit telemetry into actionable summaries detailing compliance status and vulnerability counts.

Monitoring - Archiving

Retaining and protecting historical event records over extended periods to support compliance, audits, and long-term forensics.

Alert Remediation - Quarantine

Isolating an infected file, process, or compromised host onto a restricted VLAN to prevent lateral infection.

Alert Remediation - Alert Tuning

Adjusting detection rules and alert thresholds over time to reduce false positives and avoid alert fatigue.

Monitoring Tools - SCAP

A standardized NIST framework enabling automated vulnerability checks, configuration validation, and patch compliance scanning.

Monitoring Tools - Benchmarks

Prescriptive, industry-standard hardening baselines (e.g., CIS Benchmarks) outlining minimum security settings.

Monitoring Tools - Agents vs. Agentless

Agent-based monitoring runs local software for deep real-time visibility; agentless monitoring queries hosts remotely without installed code.

Monitoring Tools - SIEM

A platform providing centralized log aggregation, real-time security event correlation, alerting, and forensic analysis.

Monitoring Tools - Antivirus / Anti-malware

Host software designed to detect, block, and remove malicious programs (trojans, ransomware, worms) via signatures and heuristics.

Monitoring Tools - Data Loss Prevention (DLP)

A solution that inspects data in use, in transit, and at rest to identify and block unauthorized transfers of sensitive information.

Monitoring Tools - SNMP Traps

Unsolicited UDP/162 alert messages sent immediately by network devices to a management station when an event occurs.

Monitoring Tools - NetFlow

A protocol that collects and summarizes IP traffic conversation metadata (endpoints, ports, data volume) without recording full payloads.

Monitoring Tools - Vulnerability Scanners

Non-invasive assessment utilities that probe networks and hosts for unpatched CVEs, open ports, and default credentials.

Firewalls - Rules & Access Lists

Ordered top-to-bottom criteria permitting or blocking traffic based on IP addresses, ports, and protocols, ending in an implicit deny.

Firewalls - Ports and Protocols

Restricting ingress and egress communications to authorized transport types (TCP/UDP) and approved port numbers.

Firewalls - Screened Subnets

A isolated perimeter network segment (formerly DMZ) providing public Internet access to public services while shielding internal hosts.

IDS/IPS - Signatures vs. Anomalies

Signatures match specific known malicious exploit patterns; anomaly detection identifies deviations from established operational baselines.

Web Filter - Agent-Based vs. Proxy

Agent-based software enforces URL rules locally on laptops anywhere; centralized forward proxies route and filter all network egress traffic.

Web Filter - URL Scanning

Inspecting explicit URLs in real time to prevent connections to known malicious web destinations.

Web Filter - Content Categorization

Grouping websites by category (e.g., gambling, adult, hacking) to allow or block browsing access across the enterprise.

Web Filter - Block Rules

Directives configured to block access to specific URLs, domain patterns, or predefined topic categories.

Web Filter - Reputation

Scoring IP addresses and web domains based on historical threat behavior to automatically block access to untrusted sites.

OS Security - Group Policy

A Windows Active Directory management feature used to configure and enforce baseline security settings and access across domain hosts.

OS Security - SELinux

A Linux kernel security module enforcing Mandatory Access Control (MAC) to confine application processes to least privileges.

Secure Protocols - Protocol Selection

Selecting cryptographically secure transport protocols (SSH, HTTPS, SFTP) over unencrypted legacy counterparts (Telnet, HTTP, FTP).

Secure Protocols - Port Selection

Binding secure communications to dedicated secure network ports (e.g., TCP port 443 for HTTPS, TCP port 22 for SSH).

Secure Protocols - Transport Method

Enforcing encryption across the transmission path (e.g., WPA3 over wireless, IPsec/TLS tunnels across the WAN).

DNS Filtering

Preventing connections to malicious or restricted sites by refusing to resolve suspicious domain lookups to IP addresses.

Email Security - DMARC

An email authentication protocol that uses SPF and DKIM to tell receiving servers whether to accept, quarantine, or reject failing messages.

Email Security - DKIM

An email authentication mechanism that cryptographically signs outgoing emails using public-key cryptography in the header to prove integrity.

Email Security - SPF

A DNS TXT record listing all IP addresses and mail servers authorized to send outbound email on behalf of a specific domain.

Email Security - Gateway

An inbound and outbound mail filter that intercepts spam, blocks phishing attempts, analyzes attachments, and prevents outbound data leaks.

File Integrity Monitoring (FIM)

A host-based control that checks OS and application files against trusted cryptographic baselines to alert on unauthorized modifications.

Network Access Control (NAC)

A solution that evaluates endpoint posture (antivirus status, patch updates, certificates) before granting full network admission.

EDR vs. XDR

EDR provides behavioral monitoring and automated response on endpoints; XDR correlates telemetry across endpoints, networks, identity, and cloud.

User Behavior Analytics (UBA / UEBA)

Using machine learning and statistical modeling to establish normal activity baselines and flag anomalous user or account behavior.

Permission Assignments

Enforcing least privilege by provisioning user and group permissions strictly to the minimum level needed for job duties.

Identity Proofing

The process of validating a user’s real-world identity (e.g., verifying passports or official credentials) before issuing digital accounts.

Federation

An identity architecture connecting authentication systems across different partner organizations, allowing shared credentials.

Single Sign-On (SSO)

An authentication framework allowing a user to authenticate once and access multiple linked services without re-entering credentials.

SSO Protocols - LDAP

An open, lightweight protocol used to query, search, and authenticate identities within an X.500 directory tree (e.g., Active Directory).

SSO Protocols - OAuth

An open authorization framework using secure tokens to allow applications access to third-party resources without exposing user passwords.

SSO Protocols - SAML

An XML-based open standard for exchanging authentication and authorization assertions between an Identity Provider (IdP) and Service Provider (SP).

Interoperability

The ability of varied security tools, platforms, and directory services to interact seamlessly through open, standard protocols.

Attestation

The process where a system cryptographically proves its hardware integrity and security state (often using a TPM) before receiving access.

Access Control - Mandatory (MAC)

An OS-enforced access model based on security classification labels assigned to objects and clearance levels assigned to subjects.

Access Control - Discretionary (DAC)

An access model where resource owners have total discretion to configure and grant read/write access permissions to others.