Defensive Security
Harden systems, detect intrusions, and respond to incidents before damage is done. Where offensive security breaks things, defensive security builds the walls, cameras, and alarm systems — and trains the people who monitor them.
Intermediate
SIEM & Log Analysis
Splunk, ELK Stack — aggregating logs, detecting anomalies, and finding attacker activity in the noise.
Intermediate
Incident Response
Contain, eradicate, and recover from security breaches. Playbooks, forensics, and post-mortem analysis.
Intermediate
Threat Modelling
STRIDE, attack trees, and MITRE ATT&CK — systematically identifying what could go wrong before it does.
Intermediate
System Hardening
Reducing attack surface. Firewall rules, least-privilege access, patch management, and CIS benchmarks.
Beginner
SOC Analyst Skills
Security Operations Centre fundamentals. Alert triage, threat hunting, and the first line of organisational defence.
Interview Scenarios
Real-world questions for Defensive Security
1What is your immediate containment playbook if a web server shows active Cobalt Strike beaconing to an external IP?
1. Isolation: Immediately isolate host from network via firewall drop rule or EDR network isolation, preserving RAM state. 2. Memory Dump: Capture volatile RAM using Volatility / LiME for process analysis. 3. Process Kill: Identify parent-child process tree (
ps -ef --forest) and terminate malicious PIDs. 4. Credential Invalidation: Revoke all service account tokens and SSH keys active on that host. 5. Firewall Lockdown: Block C2 destination IP/domain at perimeter firewall.2How do you configure UFW / IPTables to harden a Linux production server so only SSH (port 22) and HTTPS (port 443) are accessible?
UFW:
sudo ufw default deny incoming; sudo ufw default allow outgoing; sudo ufw allow 22/tcp; sudo ufw allow 443/tcp; sudo ufw enable. IPTables: iptables -P INPUT DROP; iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT; iptables -A INPUT -p tcp --dport 22 -j ACCEPT; iptables -A INPUT -p tcp --dport 443 -j ACCEPT.3How do you construct a SIEM query in Splunk / ELK to detect SSH brute-force attacks followed by a successful login?
Splunk Query:
index=os (sourcetype=syslog OR EventCode=4625 OR EventCode=4624) | stats count(eval(action="failure")) as Failures count(eval(action="success")) as Successes by src_ip, user | where Failures > 50 AND Successes > 0. This flags IPs that triggered over 50 failed logins before achieving authentication.4What is the step-by-step incident response playbook when ransomware starts encrypting network file shares?
1. Containment: Instantly disconnect affected machines from the LAN/Wi-Fi to halt lateral spread across SMB file shares. 2. Preserve VSS: Block script execution attempting to delete Shadow Copies (
vssadmin delete shadows). 3. Identify Ransomware Strain: Upload ransom note and sample encrypted header to ID Ransomware to identify extension and potential decrypters. 4. Restoration: Re-image compromised machines and restore data from isolated off-site backups.5How do you harden an SSH server configuration according to CIS Security Benchmarks?
Edit
/etc/ssh/sshd_config: Set PermitRootLogin no, PasswordAuthentication no, MaxAuthTries 3, ClientAliveInterval 300, ClientAliveCountMax 0, disable X11Forwarding, enforce SSH Protocol 2, and restrict login access to specific groups using AllowGroups sshusers.6How do you apply the STRIDE Threat Model to a modern web API ecosystem?
Map system components against: Spoofing (Enforce mTLS / OAuth2), Tampering (Implement digital signatures & TLS), Repudiation (Centralized immutable audit logs), Information Disclosure (Encrypt payloads at rest & in transit), Denial of Service (API Rate limiting & WAF), and Elevation of Privilege (Strict RBAC & least-privilege scoping).
7How do you detect Pass-the-Ticket and Golden Ticket attacks in Active Directory Domain Controller logs?
Monitor Active Directory Security Event ID 4769 (Kerberos TGS requested) and Event ID 4768 (TGT requested). Look for: 1. Kerberos tickets with anomalous 10-year expiration lifetimes. 2. Tickets issued for non-existent users or with mismatched encryption types (e.g. RC4-HMAC when AES is enforced). Mitigation: Reset the Domain
krbtgt account password twice sequentially.8How do you perform memory forensics using Volatility to detect hidden DLL injection in a compromised Windows process?
Run Volatility plugins: 1.
volatility -f memory.vmem windows.pslist to view active processes. 2. volatility -f memory.vmem windows.malfind to scan memory regions for PAGE_EXECUTE_READWRITE permissions containing MZ headers or injected shellcode. 3. Dump the process executable using windows.dumpfiles --pid for YARA scanning.9How do you guarantee Log Integrity so an attacker who gains root access cannot wipe auth logs to cover their tracks?
Configure Syslog / Rsyslog / Vector to stream system logs in real-time over TLS (
@syslog-server:6514) to a dedicated, write-only centralized SIEM server. Append-only permissions and SIEM immutability prevent an attacker from modifying historical logs even if local /var/log/auth.log is deleted.10How do you implement Microsegmentation and Zero Trust access controls inside a Kubernetes cluster?
1. Network Policies: Define default-deny NetworkPolicies for ingress and egress traffic between namespaces. 2. Service Mesh mTLS: Deploy Istio / Linkerd to enforce strict mutual TLS encryption and SPIFFE identity validation between pod containers. 3. RBAC: Enforce ServiceAccount least-privilege role bindings.