Become a Cyber Defender

Defence-in-Depth

A security strategy deploying multiple redundant defensive layers so that if one layer fails, others stop the attack.

SOC (Security Operations Centre)

A central command facility where cybersecurity teams monitor, detect, analyze, and respond to security incidents.

Indicator of Compromise (IoC)

Digital forensic evidence indicating that a system or network has suffered an unauthorised intrusion or malware infection.

Computer Misuse Act 1990

The foundational UK legislation making unauthorised access to computer systems and data illegal.

Explore the standard NIST incident response phases followed by professional defenders during a cyber breach.

1. 1Preparation: Equip the team with incident tools, policies, communication channels, and secure backup systems.
2. 2Detection & Analysis: Detect unusual network alerts, examine logs, and determine whether a real security incident is underway.
3. 3Containment: Isolate infected machines from the local network to stop the threat spreading to critical databases.
4. 4Eradication & Recovery: Remove malware artifacts, patch exploited vulnerabilities, and restore clean systems from verified backups.
5. 5Post-Incident Review: Hold a lessons-learned briefing to review what happened and strengthen future defences.

pythonlog_entries = [
    {'ip': '192.168.1.5', 'status': 200, 'failed_attempts': 0},
    {'ip': '203.0.113.42', 'status': 401, 'failed_attempts': 15},
    {'ip': '192.168.1.12', 'status': 200, 'failed_attempts': 1}
]

THRESHOLD = 5
for log in log_entries:
    if log['failed_attempts'] >= THRESHOLD:
        print(f"INCIDENT ALERT: Potential brute-force attack detected from IP {log['ip']}!")
        print('Action: Automatically blacklisting IP and alerting SOC analyst.')

This Python script mimics a Security Information and Event Management (SIEM) rule by flagging IP addresses that exceed a failed login threshold and triggering an incident alert.