Defence Strategies Reference
A practical guide to defensive security — layered protection, detection, incident response, and recovery. Every strategy maps to the attacks it counters, so you can defend with purpose rather than checklist fatigue.
Introduction
Defence is not a single product — it’s a continuous cycle: prevent → detect → respond → recover. The goal is to make attacks expensive, noisy, and short-lived.
Prevent
Reduce the attack surface and stop attacks before they succeed: patching, hardening, MFA, least privilege, network segmentation.
PreventDetect
Find intrusions fast: logging, SIEM, EDR, IDS, threat hunting, deception.
DetectRespond
Contain and eradicate threats: incident response plans, playbooks, isolation, forensics.
RespondRecover
Restore operations and learn: backups, disaster recovery, post-incident review, resilience.
RecoverDefense in Depth
Layer multiple independent controls so a single failure doesn’t cause a breach. No single layer is trusted to stop everything.
Zero Trust Architecture
Never trust by default; verify every request, device, and identity — regardless of network location.
Core principles
- Verify explicitly — authenticate and authorize every request using all available signals (identity, device health, location, behavior).
- Least privilege access — grant just-enough, just-in-time access; revoke when done.
- Assume breach — segment, monitor, and limit blast radius as if compromise already happened.
Building blocks
Identity
MFA, SSO, conditional access, passwordless (FIDO2/WebAuthn), identity governance.
ArchitectureDevice
Device compliance checks, certificate-based auth, endpoint posture before access.
ArchitectureNetwork
Micro-segmentation, software-defined perimeters, no implicit trust on LAN/VPN.
ArchitectureApplication & Data
Per-app access policies, encryption, DLP, API authorization, shadow-IT control.
ArchitecturePrevention Controls
The highest-ROI defences: stop the most common attacks before they land.
Patch Management
Close known vulnerabilities before they’re exploited. Most breaches use unpatched, known CVEs.
Multi-Factor Authentication
MFA blocks the vast majority of credential-stuffing and password-based attacks.
Least Privilege
Give users and services only the permissions they need; removes the elevation step for attackers.
Network Segmentation
Isolate sensitive systems so a breach in one zone can’t spread laterally.
Application Allow-Listing
Only approved executables run — blocks LOLBins, malware, and unsigned code.
Email & Web Filtering
Block phishing, malicious attachments, and risky domains before users see them.
Backup (3-2-1)
Immutable, offline backups neutralize ransomware’s leverage.
Secrets Management
Remove hardcoded credentials; rotate keys; vault secrets.
System Hardening
Reduce the attack surface by removing unnecessary components and locking down configurations.
| Area | Key actions | Benchmark |
|---|---|---|
| OS Hardening | Remove unused services/packages, disable guest accounts, enforce strong password policy, configure audit logging, enable host firewall. | CIS Benchmarks |
| Windows | Enable BitLocker, Credential Guard, WDAC, LSA protection, disable SMBv1/LLMNR, enable Windows Defender tamper protection. | CIS / Microsoft baselines |
| Linux | Minimal install, SELinux/AppArmor enforcing, restrict sudo, disable root SSH login, use SSH keys, kernel hardening (sysctl). | CIS / STIG |
| Network Devices | Disable unused ports, change default creds, SSHv2 only, ACLs, disable CDP/LLDP where unused. | CIS / vendor guides |
| Cloud | Lock down S3/object storage, least-privilege IAM, enable MFA on root, restrict IMDS, enable logging (CloudTrail). | CIS Cloud Benchmarks |
| Web Servers | Remove server version headers, disable directory listing, TLS 1.2+, security headers (CSP, HSTS). | OWASP / CIS |
| Databases | Remove default accounts, network restrictions, least-privilege DB users, encryption, audit logging. | CIS / vendor guides |
OpenSCAP, Lynis, InSpec, Chef/Puppet/Ansible baselines, and cloud posture managers (AWS Config, Azure Policy).
Detection
Prevention fails sometimes. Detection is how you find the attacker before real damage is done.
SIEM
Aggregate and correlate logs across the estate to surface anomalies and alert on threats.
EDR / XDR
Continuous endpoint visibility, behavioral detection, and response actions (isolate, kill process).
IDS / IPS
Network-based detection (and blocking) of malicious traffic patterns and signatures.
Deception (Honeypots)
Plant decoys to lure attackers and generate high-fidelity alerts with near-zero false positives.
Threat Hunting
Proactively search for attackers that evaded automated detection, driven by hypotheses.
UEBA
Detect anomalies in user/entity behavior — impossible travel, unusual data access, off-hours activity.
Monitoring & Logging
You can’t detect what you don’t collect. Centralized, immutable logs are the foundation of detection and forensics.
What to log (minimum)
- Authentication — logons, failures, MFA challenges, privilege changes (Windows 4624/4625/4672/4720, Linux auth.log).
- Process & command-line — Sysmon Event 1, PowerShell script block logging (Event 4104), auditd execve.
- Network — firewall, DNS, proxy/flow logs (NetFlow), IDS alerts.
- Cloud — CloudTrail, Azure Activity, GCP Audit logs, and object-storage access logs.
- Application & database — web server access logs, DB audit logs, API gateway logs.
- Endpoint — EDR telemetry, registry/file changes, scheduled task creation.
Best practices
Centralize
Ship all logs to a SIEM / log lake with adequate retention (often 90+ days, 1 year for compliance).
DetectImmutable & offsite
Store logs so attackers can’t tamper with or delete them — WORM storage or separate admin plane.
DetectTime sync
Use NTP everywhere so cross-system correlation and timelines are accurate.
DetectAlert tuning
Reduce false positives with context; every alert should have a clear action and owner.
DetectIncident Response
A structured, rehearsed process for containing and eradicating a breach. Aligned to NIST SP 800-61.
- Preparation — build the IR plan, roles, communication channels, tools, and run tabletop exercises.
- Detection & Analysis — confirm the incident, scope it, and prioritize severity.
- Containment — isolate affected systems/accounts, preserve evidence, stop the bleeding.
- Eradication — remove the attacker’s access and artifacts (malware, persistence, backdoors).
- Recovery — restore systems from clean state, monitor for re-compromise.
- Lessons Learned — document findings and improve controls to prevent recurrence.
Playbooks
Pre-written runbooks for common incidents: phishing, ransomware, data exfil, insider threat, DDoS.
RespondContainment Strategy
Decide isolate-vs-observe per incident; short-term (block, disconnect) then long-term (reimage, rotate creds).
RespondEvidence Preservation
Capture forensic images, memory dumps, and logs with chain of custody before remediation.
RespondCommunication
Internal escalation, legal, PR, regulator (GDPR 72h), and customer notification plans.
RespondRecovery & Business Continuity
Resilience: how fast you restore operations after disruption, and how you survive worst-case scenarios.
Backup Strategy
3-2-1 rule + immutability + regular restore testing. Backups that can’t be restored are useless.
RecoverDisaster Recovery (DR)
Recovery Time Objective (RTO) and Recovery Point Objective (RPO) define acceptable downtime/data loss.
RecoverBusiness Continuity (BCP)
Keep critical functions running during disruption — alternate sites, manual fallback, staff redundancy.
RecoverPost-Incident Review
Blameless review to extract lessons, close control gaps, and update playbooks.
RecoverAttack → Defence Map
Every attack has a counter. Use this map to translate an attack into concrete defensive controls.
| Attack | Prevent | Detect | Respond / Recover |
|---|---|---|---|
| Phishing | Email filtering, DMARC, MFA, user training | Gateway logs, link-click telemetry, MFA fatigue alerts | Reset creds, scan for malware, report the campaign |
| Credential stuffing / spraying | MFA, passwordless, rate limiting, breached-password screening | Many failures across accounts, impossible travel | Force reset, block source, review sign-ins |
| SQL Injection | Parameterized queries, WAF, least-priv DB | WAF alerts, DB error patterns | Patch code, rotate DB creds, audit data access |
| XSS | Output encoding, CSP, input validation | CSP violations, WAF signatures | Fix sink, invalidate sessions, review stored payloads |
| SSRF | Allow-list egress, block metadata endpoint | Requests to 169.254.169.254 / internal IPs | Rotate cloud creds, close vector, review requests |
| Kerberoasting / PtH | Strong service passwords, LAPS, Credential Guard | Event 4769 anomalies, NTLM anomalies | Rotate KRBTGT/affected creds, hunt lateral movement |
| Ransomware | Immutable backups, segmentation, MFA, patching | Mass encryption (Sysmon 11), shadow copy deletion | Isolate, restore from clean backups, notify |
| DDoS | CDN/scrubbing, rate limiting, redundancy | Traffic spikes, connection exhaustion | Activate DDoS provider, failover, scale |
| Data exfiltration | DLP, least privilege, egress filtering, encryption | Large outbound transfers, unusual DNS/cloud usage | Block egress, contain, assess data loss, notify |
| LOLBins / obfuscation | App allow-listing, LOLBin blocking | Sysmon 1 anomalies, script block logging, entropy | Isolate host, kill processes, rebuild |
| Privilege escalation | Least privilege, patching, sudo/SUID auditing | Unexpected privilege change, token anomalies | Revoke elevated access, reimage, hunt |
| Insider threat | Least privilege, PAM, separation of duties, background checks | UEBA, unusual data access, off-hours activity | Revoke access, legal/HR, forensic review |