Junior Security Analyst

• 24/7
• review the security alerts
• Monitor and investigate various security alerts
• Participate in SOC brainstorms and workshops
• Cooperate with other teams to keep your company safe
• Constantly learn and discover new attacks and defenses

Collegues

Senior Analyst is your closest colleague. He helps you and other Junior analysts when something is unclear and handles complex cases after you do the initial analysis.

SOC Engineer doesn't have shifts and doesn't analyze the alerts. Instead, he maintains security tools and configures the alerts to make your analyst's job easier.

SOC Manager tries to keep everything under control. He reports SOC results to the top management and makes sure you aren't lost in that big new cyber security world.

Incident Responder You don't work with him every day, but when he's online, you know something serious has happened. He is called on demand during major incidents.

Daily Duties

• Detect and prevent a data stealer infection on a coworker's laptop
• Analyze and stop a phishing campaign targeting the finance team
• Participate in a bigger incident, such as a full-scale ransomware attack
• Team up with your teammates to build detection rules and automations
• Go beyond cyber and understand how companies operate from the inside

Cyber Incident Response Team (CIRT)

Attack vectors - humans, systems.

One-line summary: Attackers want ACCESS. They take the cheapest door: a human, or a system. Defense = Mitigation (stop most) + Detection (catch the rest, which is the SOC's job).

The Mental Model: The Fortress

Remember: a trained gatekeeper is useless if the lock is cheap, and a great lock is useless if the gatekeeper hands over the key. Protect both.

The Human Element

Why attack humans?

• Cheaper & faster than days of exploiting firewalls: one phishing email to the IT admin can be enough.
• Humans hold access: websites, mailboxes, databases, VPNs.

Two kinds of attackers

• 🎯 Targeted: hunt for one specific access (e.g., the bank's admin).
• 🕸️ Opportunistic: breach as many accounts as possible, decide how to monetize later.

Who gets hit → what happens next

Pattern: the person is never the prize; their access is the prize. Always ask: "What does this person's account unlock?"

Attacks on Systems

System = anywhere data lives: physical server, lab machine, cloud platform.

Scale matters: phish one user → 1 mailbox. Breach the mail server → thousands of mailboxes.

Step 1 of almost every serious attack = gain ACCESS.

What comes after depends on motive: steal data, deploy ransomware, or destroy data.

The 4 Doors Into a System

H — Human-led attacks

Users start the attack themselves:

• Plugging in a USB found on the street (e.g., Rubber Ducky acts as a keyboard and runs payloads the instant it's plugged in)
• Downloading pirated software laced with malware
• Reusing weak passwords everywhere (check them at haveibeenpwned.com; "tryhackme" has appeared in breaches 425 times)
• Course stat: 81% of breaches involve stolen or weak passwords

V — Vulnerabilities (bugs in the software)

• 2024: 40,000+ vulnerabilities published, 300+ actively exploited in real attacks.
• Flaws can hide for decades: Shellshock existed from 1992, found in 2014.
• Zero-day = attackers find it before the vendor does. No patch exists, so detection is your only defense.
• CVE (Common Vulnerabilities and Exposures) = the ID a flaw gets once public. Then it's a race: attackers build exploits vs. defenders patch.

Famous Windows CVEs to recognize:

CVE format: CVE-YEAR-NUMBER

Responding to a vulnerability: the cure is a patch from the vendor. While waiting (zero-day):

1. Restrict access to trusted IPs only
2. Apply the vendor's temporary workarounds
3. Block known attack patterns on IPS / WAF
4. Monitor hard for exploitation traces

M — Misconfigurations (human mistakes in setup)

Not a software bug. A setup mistake, usually made for convenience.

Real examples:

• "123456" password exposed chats from 64M McDonald's job applications
• Misconfigured AWS cloud → breach of 106M bank customers (Capital One, 2019)
• Badly configured smart fridges recruited into botnets

The "perfectly secure DB ruined in 5 steps" story:

1. Install latest SQL DB → ✅ secure
2. Load customer data → now valuable
3. Set password to 1111 → ❌ misconfig #1: weak password
4. Disable firewall for the DB → ❌ misconfig #2: unrestricted access
5. Wait a few days → 💀 data stolen

Lesson: latest version ≠ secure. Configuration matters as much as code.

Responding to misconfigurations: no update needed, just a better setup.

• Penetration testing: hire ethical hackers to simulate an attack
• Vulnerability scans: tools that find default passwords & outdated software
• Configuration audits: compare against best practices like CIS Benchmarks

S — Supply chain

• Breach one trusted app or library → push a malicious update → every user is compromised.
• Famous cases: SolarWinds, 3CX (thousands of companies hit)
• Even TryHackMe was hit via Lottie Player (an animation library).
• Hard to prevent: you don't control all the code you run, so detection & response matter most.

Defense: Mitigation + Detection

Layered defense

Attacks ──► [Mitigation 1] ──► [Mitigation 2] ──► SOC handles what's left
               blocks some        blocks more        (detect & investigate)

Mitigation = prevent attacks or reduce their impact. Detection = catch what gets through. Mitigations will be bypassed one day.

Protecting HUMANS

Protecting SYSTEMS

Key difference: you can train humans to spot attacks; you can't train a system. You train the IT team that configures it.

Why a SOC analyst should care about mitigation

Investigating endless repeat attacks burns you out. Push good mitigations (approved by IT/management) → fewer alerts, safer company.

Where the Course Oversimplifies ⚠️

• "Humans are the weakest link" is a lazy framing. If one click compromises the company, the system design failed (no MFA, too much privilege, no segmentation). Blame architecture before people.
• "An answer to a CVE is always a patch": not always. End-of-life systems never get patches (see the 100k+ exposed Windows XP/Server 2008 hosts), so the answer becomes isolate, replace, or accept risk.
• "81% of breaches involve stolen passwords" comes from the 2017 Verizon DBIR. Treat it as directional, not current.
• Antivirus ≠ protection against everything. It misses fileless attacks, living-off-the-land techniques, and new malware. That's why EDR + detection exists.
• Missing from the course: MFA. It's the single highest-value control against stolen passwords and arguably belongs at the top of both tables.

• Security flaw that can be exploited → Vulnerability
• Malware delivered via a trusted app or library → Supply Chain attack

⚡ Recap

1. Attackers want access; they take the easiest path.
2. Two targets: humans (phishing, malware) and systems.
3. Four doors: Human-led, Vulnerabilities, Misconfigurations, Supply chain.
4. Vulnerability → patch. Misconfiguration → better setup. Zero-day / supply chain → detection.
5. Defense = layers of mitigation + SOC detection for what slips through.