Defensive Security

Defensive security is a practice that involves protecting computer systems, networks, and other digital assets from unauthorized access, use, disclosure, disruption, modification, or destruction. Defensive security measures are put in place to prevent attacks from malicious actors, such as hackers and cybercriminals.

The goal of defensive security is to minimize the risk of security breaches and to mitigate the damage caused by such breaches if they do occur. This can include implementing firewalls, antivirus software, and intrusion detection systems, as well as conducting regular security audits and vulnerability assessments.

In addition to technical measures, defensive security also involves educating users on safe computing practices, such as using strong passwords and avoiding suspicious emails and websites. By taking a proactive approach to defensive security, organizations can better protect their digital assets and reduce the risk of costly security breaches.

Two Main Topics in Defensive Security

• Security Operations Center (SOC), covering Threat Intelligence

<aside> 💡 24/7 montering

</aside>

• Digital Forensics and Incident Response (DFIR), covering Malware Analysis

AbuseIPDB and Cisco Talos Intelligence: where you can perform a reputation and location check for the IP address.

Report malicious IPs on AbuseIPDB.

Adding a malicious IP address to a firewall block list via Security Operations Center task.

Identifying malicious IP address and dropping them

Practical Example of OS Security

Practical Example of OS Security is a detailed guide that explains how to secure an operating system. The guide covers topics such as file permissions, firewall configuration, antivirus software installation, and more.

By following the steps outlined in the guide, users can better protect their operating systems from security threats. The guide emphasizes the importance of regular updates and backups to ensure that systems remain secure and functional.