In a nutshell Defensive security is the "blue" side: everything that keeps an attack from happening and helps spot and repel it in time. Two jobs — prevention (keep them out) and detection & response (catch it and act). It rests on five areas: SOC, threat intelligence, DFIR, malware analysis and SIEM. The central console is the SIEM: it gathers events from everywhere and raises the alarm on anything suspicious. The analyst's loop: event → alert → analysis → response.
Two jobs of defence
Security is two sides of one coin. The attacker (red team) hunts for holes; the defender (blue team) closes them, catches and repels attacks. Even if you're drawn to pentesting, you must know defence: your reports are written for the people who defend, and to get past a defence you have to understand what it sees.
- Prevention — keep them out. Make the break-in not happen: train people (so they don't click phishing), install updates, set access rights and configurations.
- Detection & response — catch it and act. If an attack does run, see it in time and react: stop it, evict it, recover.
Analogy — guarding a building. Half the work is strong locks, passes and staff briefings (don't let them in). The other half is cameras, alarms and guards who react to a break-in (catch it and respond).
The five areas of the blue side
| Area | What it does |
|---|---|
| SOC (Security Operations Center) | Security's "duty shift": watches the network and systems round the clock, catches the suspicious, reacts. |
| Threat Intelligence | Gathers knowledge about adversaries: who attacks, with what methods, after what — to prepare ahead of time. |
| DFIR (forensics & incident response) | Once an attack has happened: investigate what occurred, collect evidence, restore operations. |
| Malware Analysis | Takes malware apart: what the virus does, how to detect and neutralise it. |
| SIEM (event collection & analysis) | Pools events from every device in one place and raises the alarm on the suspicious — the SOC's main console. |
Attack and defence are mirrors
An attack and a defence are one event seen from two sides: the same password brute-force that breaks a system gives the attacker away in the logs.
🔴 Red team — attacks
- brute-forces its way into FakeBank
- looks for open doors
- goal — get inside
🔵 Blue team — defends
- catches the attacker with that same brute-force in the logs
- sees the malicious IP, checks its reputation
- blocks and escalates
The room's practical example: you're a SOC analyst, an attack hits FakeBank. Events arrive on the SIEM dashboard, an alert pops up, you dig into it, find the malicious IP address, check it against reputation databases and block it. Event → alert → analysis → action — that, in miniature, is the defender's job.
Related
The opposite, "red" side is in directory-brute-forcing and the stages of a pentest; why any of this is worth defending is in the CIA triad.