Security Operations & Defense

Secure design reduces how often things go wrong; security operations decides what happens when they do. It is the continuous work of knowing what you expose to the internet, finding and fixing weaknesses before attackers use them, noticing suspicious activity quickly, and responding in a way that limits damage and restores trust.

For engineering teams the boundary with Application Security is practical: application security builds controls into software, while security operations watches the running systems, people, and infrastructure. In small companies the same engineers do both. The guides in this topic are written for that reality — practical enough for a team without a dedicated security operations center, and grounded in the standards larger teams use.

TL;DR

• Attack surface management keeps an up-to-date inventory of what is exposed, who owns it, and what changed.
• Vulnerability management prioritizes fixes by real-world risk — known exploitation, exploit likelihood, and exposure — not by CVSS score alone.
• A SIEM collects and normalizes security-relevant logs so they can be searched, correlated, and retained.
• Detection engineering treats detections as tested code mapped to attacker behavior (MITRE ATT&CK), not as a pile of vendor alerts.
• Incident response depends on preparation done before the incident: roles, runbooks, access, and evidence that is already being collected.

The Defensive Loop

Featured Topics

Knowing Your Exposure

• Attack Surface Management — Discovering exposed domains, services, cloud resources, and forgotten assets
• Vulnerability Management — CVSS, EPSS, the KEV catalog, remediation SLAs, and verification

Detecting Attacks

• Security Information and Event Management — Log sources, normalization, correlation, retention, and cost
• Security Detection Engineering — Detection as code, Sigma rules, ATT&CK coverage, and alert quality

Responding

• Security Incident Response — Preparation, triage, containment, eradication, recovery, and post-incident review

Common Questions

Do small teams need security operations?

Yes, in proportion. A small team does not need a 24/7 operations center, but it does need an asset inventory, a patching routine, centralized identity and cloud audit logs, a few high-value alerts, and a written plan for a leaked credential or compromised account. Most serious incidents at small companies come from exactly those gaps.

Where should we start?

Start with inventory and identity: know your internet-facing assets (attack surface management), enforce multi-factor authentication, and collect identity and cloud control-plane logs. Then build a vulnerability routine and an incident response plan before investing in advanced detection.

How does this relate to IT incident management?

Incident management covers outages and service disruptions; security incident response covers malicious or suspicious activity. They share coordination practices — incident command, communication, timelines — but security incidents add evidence preservation, attacker awareness, and legal or regulatory notification.

Is this the same as compliance?

No, but they overlap. Compliance frameworks require many of these practices — logging, vulnerability remediation, incident response — and ask for evidence that they happen. Security operations is the practice itself; compliance is how you demonstrate it.

Learning Path

Beginner

Inventory your domains and cloud accounts, turn on cloud audit logging, and write a one-page runbook for a leaked credential (incident response).

Intermediate

Prioritize vulnerabilities with KEV and EPSS (vulnerability management), centralize logs in a SIEM, and write your first tested detections.

Advanced

Map detection coverage to ATT&CK, run purple-team exercises, automate response steps, and measure detection and response times (detection engineering).

Related Topics

• Digital Forensics and Evidence Handling — Preserve evidence, maintain provenance, and document an investigation timeline.
• Security Awareness and Phishing Resilience — Design practical reporting, training, and feedback tied to observed incidents.
• Application Security — Building security into software
• Identity & Access Management — Authentication, authorization, and privileged access
• Compliance & Privacy Engineering — Audit evidence and regulatory obligations
• Incident Management — Coordinating responses to service disruptions
• Observability & SRE — The logging and alerting foundations security operations builds on