1.4. Reflection Checkpoint
Key Takeaways
- Assume breach is the mindset that builds internal detection and monitoring — it accepts that perimeter defense alone will fail and designs accordingly.
- CIA Triad classifies security impact: Confidentiality (unauthorized access), Integrity (unauthorized modification), Availability (denial of access). Knowing which is affected shapes the response.
- Attacker asymmetry means defenders must prioritize ruthlessly — raising the cost of attack and reducing dwell time matters more than trying to block every possible vector.
- Dwell time is a primary damage multiplier — earlier detection dramatically limits attacker impact, making MTTD one of the most important SOC metrics.
- SOC effectiveness requires all three: technology for scale, process for consistency, and human judgment for ambiguity.
- Data source visibility determines detection capability — a gap in log collection is a gap in detection, regardless of how good the SIEM is.
Connecting Forward
Phase 2 takes these principles into the specific exam domains. You'll see assume breach in action through threat hunting, the CIA Triad applied through CVSS scoring, attacker asymmetry expressed in layered controls, and the analyst's toolkit explored tool by tool. Every concept in Phases 2–5 connects back to one of these six principles.
Self-Check Questions
-
An organization deploys a next-generation firewall and considers its network secure. What mental model flaw does this represent, and what additional monitoring capabilities does it leave uncovered?
-
A malware infection that encrypts all files on a workstation is discovered three weeks after it occurred. The encryption key is not available from the attacker. Using CIA Triad analysis, describe what was violated, why three weeks of dwell time matters, and what two distinct metrics this failure affects.
