Understanding Security Operations

Security analysis begins with vulnerability analysis, threat identification, and then is managed by a formula of detection, delay, and response.

After creating a ranked list of what is valuable/vulnerable, then resources are allocated to securing that value.

The idea is that an effective security operation detects threats and provides for an adequate delay in the ability of that threat to do its intended damage before a response is in place to neutralize the threat. This is most easily envisioned with physical security where you might have a motion or video sensor that sees an intruding thief and alerts police services. The thief is perhaps delayed by locked doors or safes which delay his attack long enough for police to arrive and arrest him.

It should be clear that the failure of any of the variables is a failure of effective security.  If the threat is never detected, then it has unlimited time to do damage. If it is detected but not delayed in time for a response to neutralize, then the damage is done. And if it is detected and even delayed, but there is never a response, then it is just a matter of time before the damage is done.

In practice, I have witnessed systems that had almost no delay built-in because the detection capability was developed to the point of knowing when a decision to commit an act was made, allowing for response before the plan was being executed. There are also systems that presume very poor detection, so they emphasize significant delay and most rapid response. Understanding these variables and applying them in even the most abstract and complex security situations never changes.

Of course, there is always a limit to resources that can be applied to the variables, which is why security operations begin with identifying and ranking those assets to be protected.

At the highest levels, national security operations can be most fascinating because they tend to face the most threats and have the greatest valued resources to protect. All governmental activities contribute to security, but most of what we are interested in is derived from intelligence/information efforts, diplomacy, law enforcement, border protection, and military capabilities.

As blog articles are added within the category of Security Operations, you should always be able to connect the topic to values/vulnerabilities, threat identification, detection, delay, and response.