1 Security Operations Foundations

Goals of security operations

Security operations help an organization protect the systems and information needed to carry out its mission. Their aim is not to eliminate every possible threat, which is unrealistic, but to manage cybersecurity risk and keep important services dependable.

Common goals include protecting the confidentiality, integrity, and availability of information; detecting harmful activity; limiting its effects; and restoring operations after disruption.

The six connected security functions

The NIST Cybersecurity Framework (CSF) 2.0 organizes cybersecurity outcomes into six connected functions:

• Govern: Set cybersecurity strategy, expectations, roles, and policy.

• Identify: Understand assets, dependencies, threats, and risks.

• Protect: Apply safeguards to reduce risk.

• Detect: Find and analyze possible attacks or compromises.

• Respond: Contain and manage incidents.

• Recover: Restore affected systems and operations.

These functions are continuous and interrelated, not a one-way checklist. Knowing which services are critical, for example, helps an organization choose protections, recognize meaningful alerts, and plan recovery.

Layered safeguards

Defense in depth uses multiple, complementary safeguards so that failure of one control does not automatically expose an important asset. The goal is layered resilience, not reliance on a single tool or safeguard. Layers can include:

• People and policy: Training, clear responsibilities, and reporting procedures.

• Identity and access: Unique accounts, appropriate permissions, and authentication controls.

• Devices and software: Secure configurations, updates, and malware protections.

• Networks and facilities: Segmentation, firewalls, and physical access controls.

• Monitoring and response: Logging, alert review, incident handling, and recovery plans.

A strong password policy may help prevent account compromise, but it is not sufficient by itself. Limited account privileges can reduce damage if an account is stolen; monitoring can reveal unusual activity; and a response plan can help contain the incident.

Assessing and prioritizing risk

Cybersecurity risk concerns potential harm to an organization, its people, or its operations from a threat exploiting a weakness. A risk assessment considers what could happen, how likely it is, and how serious the consequences would be. Teams use this analysis to prioritize safeguards and decide whether to reduce, transfer, avoid, or accept a risk, within established authority and risk tolerance.

A weakness in an isolated, low-importance test system may warrant a different priority from the same weakness in a customer-facing service that stores sensitive information. The technical finding matters, but so do exposure, likelihood of exploitation, and potential impact. Risk assessment supports prioritization; it does not guarantee certainty or replace informed organizational decisions. Reassess risk as assets, threats, and circumstances change.

Safe security practice

Security practice should take place only on systems you own or have explicit permission to test. Before testing, define the scope and rules of engagement: which systems are included, which activities are allowed, and when the work must stop.

A safe practice lab should:

• Use a dedicated virtual machine or container environment separated from production and other sensitive systems.

• Restrict network access and avoid exposing deliberately vulnerable services to the public internet. Bind services to the local machine when appropriate, and verify port mappings and firewall rules.

• Use synthetic accounts and data, not real credentials, customer records, or workplace data.

• Take snapshots or backups so systems can be restored. Keep lab software updated except where a controlled exercise intentionally requires a known vulnerable version.

• Use purpose-built training targets rather than unrelated public or organizational systems.

• Stop if activity reaches an unintended system, creates unexpected disruption, or falls outside the agreed scope.

OWASP WebGoat is intentionally insecure and designed for security training. Its project guidance warns that the application is vulnerable and recommends limiting its exposure, including disconnecting it from the internet while in use.