🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Security Operations: Monitoring, Defense, and Controls › Lesson 1
TEC-CYBE44-03 · Lesson 1 · 12 clock hours · theory

Security Operations Foundations and the Defense-in-Depth Model

Objective. Students will explain the defense-in-depth model, identify the major security control categories (preventive, detective, corrective, compensating), and map them to real operational roles.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

What Is Security Operations?

Security operations is the day-to-day practice of protecting an organization's information systems, data, and people. Security operations professionals monitor networks and endpoints, investigate alerts, respond to incidents, and maintain the controls that keep threats from causing harm. Whether you work in a small business or a large enterprise Security Operations Center (SOC), your job rests on a common foundation: defense in depth.

The Defense-in-Depth Model

Defense in depth (DiD) is a layered security strategy borrowed from military doctrine. The core idea is simple: no single control is perfect, so you stack multiple independent layers of protection. If an attacker defeats one layer, the next layer buys time, raises the cost of attack, or stops the threat entirely.

A typical defense-in-depth architecture for an organization moves from the outermost boundary inward:

1. Perimeter / Network boundary — firewalls, border routers, intrusion prevention systems

2. Network segmentation — VLANs, DMZs, internal firewalls separating sensitive zones

3. Endpoint — antivirus/EDR agents, host-based firewalls, OS hardening

4. Application — input validation, web application firewalls, secure coding practices

5. Data — encryption at rest and in transit, data loss prevention (DLP) tools

6. Identity and access — multi-factor authentication (MFA), least privilege, privileged access management

7. Physical — badge readers, security cameras, locked server rooms, cable locks

8. Administrative / Policies — acceptable use policies, security awareness training, change management procedures

No layer should be treated as a final solution. Each layer must be monitored, tested, and updated regularly.

The Four Major Security Control Categories

Every security control you will encounter in this program fits into one of four functional categories.

Preventive Controls

Preventive controls try to stop a security incident before it occurs. They reduce the likelihood that a threat successfully exploits a vulnerability.

Examples: firewalls, access control lists (ACLs), encryption, multi-factor authentication, security awareness training, cable locks on workstations.

Detective Controls

Detective controls identify and record that an incident has occurred or is occurring. They do not stop the attack on their own but they generate the evidence needed to respond.

Examples: intrusion detection systems (IDS), security information and event management (SIEM) platforms, log monitoring, security cameras, file integrity monitoring.

Corrective Controls

Corrective controls reduce the impact of an incident after it is detected and help restore normal operations. They are activated in response to a confirmed event.

Examples: incident response procedures, data backups and restore processes, patching a vulnerable system, quarantining an infected endpoint, revoking compromised credentials.

Compensating Controls

Compensating controls are alternative measures put in place when a primary control cannot be implemented due to technical, financial, or operational limitations. They must provide a comparable level of protection to the control they replace.

Examples: using enhanced logging and monitoring on a legacy system that cannot be patched, requiring additional approval steps when MFA cannot be deployed on a specific device.

How Control Categories Map to Operational Roles

Understanding which category a control belongs to tells you who is responsible for it and when it matters.

| Role | Typical Control Focus |

|---|---|

| Security Engineer | Preventive — builds and configures technical controls |

| SOC Analyst (Tier 1/2) | Detective — monitors alerts, triages events |

| Incident Responder | Corrective — contains damage, restores systems |

| Risk Analyst / Auditor | Compensating — identifies gaps and alternative mitigations |

In practice, a single professional may wear all four hats, especially in smaller organizations. Knowing this framework lets you speak a common language with teammates, auditors, and the vendors you will work with throughout your career.

Applying the Model: A Small Business Example

Imagine a dental office with ten workstations, a patient record server, and a Wi-Fi network. A layered defense might look like this:

Even this modest stack demonstrates that defense in depth is achievable without enterprise-level budgets.

Safety and Professional Responsibility

When working in a live operations environment, always follow your organization's change management and authorization procedures before modifying any control. Unauthorized changes to firewalls, access controls, or monitoring tools can create outages or compliance violations. If you are handling physical security equipment (servers, cabling, rack gear), follow lockout/tagout procedures when required and use appropriate PPE such as anti-static wrist straps when working inside hardware. Treat all breach-related data you encounter in this course — including case study materials — as sensitive; do not share it outside the classroom without instructor permission.

Key terms8

Defense in DepthA layered security strategy that uses multiple independent controls so that if one layer fails, additional layers continue to protect assets.
Preventive ControlA security measure designed to stop an incident from occurring by reducing the likelihood that a threat successfully exploits a vulnerability.
Detective ControlA security measure that identifies and records security events or incidents as they occur or after the fact, enabling response and investigation.
Corrective ControlA security measure activated after an incident is detected to reduce its impact and restore normal operations.
Compensating ControlAn alternative security measure put in place when a primary control cannot be implemented, designed to provide an equivalent level of protection.
Security Operations Center (SOC)A centralized team and facility responsible for continuously monitoring, detecting, and responding to security events across an organization's environment.
Least PrivilegeThe principle that users and systems are granted only the minimum access rights needed to perform their authorized functions.
SIEM (Security Information and Event Management)A platform that collects, aggregates, and analyzes log data from across an environment to support real-time threat detection and compliance reporting.
In class: Diagram a layered defense-in-depth architecture for a small business scenario, labeling each layer with a specific control and its category. · Classify a provided list of 20 security controls as preventive, detective, corrective, or compensating and justify each classification in writing. · Research and present a real-world breach case study, identifying which control layers failed or were absent and what corrective controls could have helped.
Materials: CompTIA Security+ Study Guide (current exam version), ISC2 CC Official Study Guide, whiteboard/diagramming software (draw.io or equivalent), case study handouts from publicly available breach reports (e.g., Verizon DBIR summary).
Check: Students score at least 75% on a 20-question multiple-choice quiz covering control categories and defense-in-depth layers; diagram must correctly label a minimum of five distinct layers.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

Security Controls and Concepts
1. A company deploys a firewall that blocks all inbound traffic by default and only permits traffic explicitly allowed by policy. Which control category best describes this firewall?
Security Controls and Concepts
2. An organization cannot apply operating system patches to a critical legacy medical device because the vendor does not support patching. The security team adds enhanced network monitoring specifically for that device. What type of control is the enhanced monitoring in this context?
Security Controls and Concepts
3. Which of the following best illustrates a corrective control?
Security Architecture and Design
4. According to the defense-in-depth model, what is the primary reason for using multiple overlapping security layers?
Security Operations and Monitoring
5. A SOC analyst reviews SIEM alerts and identifies unusual after-hours authentication attempts against an HR server. At which defense-in-depth layer is the analyst primarily operating?
Security Architecture and Design
6. A penetration test reveals that a company's guest Wi-Fi and internal payroll server are on the same flat network. Which defense-in-depth layer is most clearly absent?
Security Controls and Concepts
7. Which pair of controls represents one detective and one preventive control?
Identity and Access Management
8. An auditor reviewing a small retail company notes that cashiers can access the payroll database using the same credentials they use for point-of-sale terminals. Which administrative principle, when applied as a preventive control, would most directly address this risk?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
Program planNext lesson →