1.6 How a Beginner Should Think Like a Defender
Inventory Before Controls
You cannot defend an unlisted asset. Start with a plain inventory: every host, service, account, and datastore, plus who owns it and what happens if it dies. Then enumerate the surface the way an outsider does. Subdomain enumeration with subfinder or certificate-transparency logs, service discovery with nmap -sV -p- 10.0.0.0/24, and a sweep for leaked artifacts — /.git/HEAD, /.env, /.aws/credentials — usually finds forgotten staging boxes, which is where real breaches begin. Rank everything by data value, not by hostname prestige: the aging admin panel beats the shiny web app.
Layer So No Single Failure Is Fatal
Defense-in-depth means each ring must fail on its own without ending the game. Perimeter: WAF and rate limits (e.g. limit_req in nginx) absorb noise, never trust them as access control. Network: VLAN or VRF segmentation with default-deny ACLs, because a flat L2 domain lets one compromised laptop ARP- and LLMNR-poison the whole block (ATT&CK T1557). Host: standard-user accounts, EDR telemetry, and patch SLAs such as critical within 14 days, high within 30. Data: encryption at rest, parameterized queries against injection, and backups that are offline and immutable — ransomware deletes accessible shares first. Human: report-friendly culture, passkeys, MFA on the accounts that gate others.
Assume the First Ring Falls
"Assume breach" changes design decisions, not slogans. Microsegment so a foothold cannot spray: lateral movement via Pass-the-Hash or cached tickets needs routable SMB and Kerberos paths that segmentation removes. Privileged access gets MFA, a jump host, and separate accounts, because a domain admin credential found in an LSASS dump should not also be the daily-driver login. Follow zero-trust guidance (NIST SP 800-207): credentials and network location are not automatically trust anchors; re-evaluate per request. Centralize logs with 90-day hot retention, write detection rules for the TTPs you expect, and rehearse a tabletop exercise twice a year — a plan that has never been run is fiction.
The Beginner's Weekly Loop
Map one system, harden its innermost layer first, enable one log source, and test one restore. One restored backup is worth ten backups that were never restored, and a defender who has actually re-image-restored understands risk better than one who has read about it.
Architecture Diagram
Key Takeaways
- Enumerate first: unmanaged subdomains and leaked
.envfiles are where intrusions start. - Layer controls so each one's failure degrades, not ends, protection.
- Segment and default-deny the network to break lateral movement primitives like Pass-the-Hash.
- Treat credentials and location as untrusted (NIST SP 800-207); MFA and jump hosts protect privilege.
- Log centrally, write detections, and test restores — assume breach means rehearsing, not surrendering.