ISCSECURITY Masterclass Series
Zane A. — Security Consultant
Security controls are not products you buy. They are intentional design decisions that translate threat understanding into protective, detective, and responsive capabilities.
Too many organizations treat security like a shopping list: "We bought an EDR, we have a firewall, we're secure." But the adversary doesn't care about your budget, they care about your gaps.
Your controls are a verb, not a noun. If you set them and forget them, you're not secure. You're documenting your own compromise.
The core principles that guide our choices:
• Confidentiality: Restricting data viewing; failures expose sensitive records.
• Integrity: Ensuring data stays accurate; failures allow unauthorized modifications.
• Availability: Guaranteeing data access; failures mean destructive ransomware downtime.
• The Trust Basics: We back these up with Authentication (identity verification), Authorization (granular permissions), and Non-repudiation (undeniable action tracking).
The Adaptive Security Lifecycle:
1. Protect: Shrink the attack surface upfront through policies, hardening, patching, segmentation, and firewalls.
2. Detect: Spot abnormal or malicious activity early using log collection, SIEM rules, and anomaly monitoring.
3. Respond: Contain damage and restore normal operations through incident response playbooks, triage, and recovery.
4. Predict: Get ahead of what's coming next through risk assessments, threat intelligence, and purple-team exercises.
Defense-in-Depth layers that buy you time:
• Perimeter: Firewalls, WAF, VPN, and DDoS protection stop initial entry vectors.
• Network: Segmentation, NAC, and internal firewalls limit lateral movement pathways.
• Endpoint: EDR agents, host hardening, and application control block rogue process creation.
• Application: Rigorous input validation and strong authorization models stop logical exploit code injection.
• Data: Encryption at rest, secure backups, and DLP ensure data remains useless to a thief.
Risk Management options when prioritizing:
• Reduce: Lower likelihood or impact by implementing tactical controls, like patching a bug.
• Avoid: Eliminate the risk completely by shutting down an unneeded, exposed service.
• Transfer: Shift the operational or financial burden, like purchasing cyber insurance.
• Accept: Acknowledge low-impact findings and track them rather than burning budget.
Incident Response phases when theory becomes real:
1. Preparation: Testing playbooks and response procedures before an adversary strikes.
2. Recording & Triage: Routing alerts and identifying stealthy "living-off-the-land" traffic.
3. Notification & Containment: Informing stakeholders while instantly isolating compromised hosts.
4. Evidence & Eradication: Preserving logs, extracting artifacts, and flushing out secondary backdoors.
5. Recovery & Lessons: Safe production restoration and updating defense playbooks.
Threat Intelligence that drives action:
• Strategic: Big-picture risk, attacker motives, and global trends for executive leadership.
• Tactical: Adversary TTPs, tooling matrices, and behavior tracking for security architects.
• Operational: Imminent sector targeting context for active incident responders.
• Technical: Short-lived telemetry data like IPs, domains, and file hashes for SIEM filters.
The double-edged sword of AI:
• Where AI helps defenders: Powering adaptive MFA, automated phishing context scanning, outlier log analysis, and exploit-based patch prioritization.
• How attackers weaponize it: Crafting polymorphic malware to bypass static signatures, scraping OSINT for hyper-personalized phishing, and automated high-speed application fuzzing.
Threat Modeling basics:
• Identify core security objectives and assets.
• Map your system components, data flows, and trust boundaries.
• Decompose the logic and find weaknesses using structures like STRIDE.
• Revisit threat models whenever design changes, new features drop, or a fresh attack vector emerges.
The most common failure point in security architecture isn't a lack of tools, it's inadequate preparation and siloed defenses.
If your layers don't talk to each other, you're giving the adversary a clear runway.
I'm interested to know, where does your organization focus the majority of its budget, and which defense-in-depth layer do you feel is currently the hardest to successfully maintain; Endpoint, Application, or Data?
Curriculum reference:
ISCSECURITY Master Class Series — https://iscsecurity.org
Discussion group: https://cyberr.ai/groups/iscsecurity
3 reactions · 0 comments