1.2.2. Prevention, Detection, and Response

💡 First Principle: Every security program must do three things: prevent what it can, detect what it can't prevent, and respond to what it detects. Organizations that only invest in prevention are blind to active attacks. Those that only detect never actually stop anything.

Consider a bank robbery analogy. Prevention includes the vault door, the security guards, and the dye packs in the cash. Detection includes the silent alarm, surveillance cameras, and the teller's panic button. Response includes the police dispatch, the lockdown procedure, and the investigation that follows. Remove any layer and the system breaks.

In cybersecurity, this maps directly to the security operations lifecycle:

Loading diagram...

Prevention is where most organizations start: firewalls, antivirus, encryption, access controls, security awareness training. These controls stop known threats using known patterns.

Detection catches what prevention misses: SIEM systems correlating log data, IDS/IPS analyzing traffic patterns, vulnerability scanners finding weaknesses, user behavior analytics spotting anomalies. Without detection, a breach can persist for months unnoticed — the average "dwell time" for undetected attackers is measured in weeks.

Response contains the damage and begins recovery: incident response plans, forensic analysis, threat containment, eradication, and communication. Without response procedures, detected incidents become chaos.

Improvement closes the loop — after every incident (and at regular intervals), the organization reviews what happened, what worked, what failed, and what changes are needed. Lessons learned feed back into prevention and detection: a new attack vector discovered during response becomes a new detection rule and a new training module. Organizations that skip this step repeat the same failures.

This cycle directly maps to exam objectives in Domain 4 (Security Operations) and Domain 5 (Security Program Management). When you reach those phases, you'll recognize these patterns everywhere.

Reflection Question: An organization installs a next-generation firewall but has no SIEM and no incident response plan. Which stage of the cycle is missing, and what's the business risk?