Wrap-up and resources
Key Takeaways
- 1. Detection and incident response: Gather logs in one place and correlate them, make every alert actionable, and have a plan before the incident: contain while keeping evidence, then eradicate and recover, then a lesson that stops a repeat.
- 2. Hands-on project: investigate an incident from logs to report: An investigation is a story told with evidence: put events in time order, join the sources by a shared address or account, name each step in ATT&CK terms, then write what happened, what you did and what must change, without exaggeration and without a verdict no log supports.
- 3. Governance and frameworks: NIST CSF 2.0 and the national controls: A framework does not protect you on its own, but it makes sure nothing important is forgotten and everyone speaks one language. Start with governance: who owns it and what risk is acceptable, then identify, protect, detect, respond and recover.
- 4. AI and security: a weapon for both sides: Treat a model's inputs and outputs as untrusted data, give agents the least power possible with human approval for sensitive actions, and never paste work secrets into unapproved tools.
- 5. Career paths and certificates: A certificate opens the interview door; hands-on skill is what gets you through it. Start in a defensive role such as SOC or GRC, build a portfolio of projects, and never touch a system you do not own without written permission.
- 6. The roadmap and a 20-week plan: Do not move to a phase before the "done when" of the previous one is true. Half your time is hands-on, and every task becomes a piece of your GitHub portfolio.
Glossary
| Term | Definition | Part |
|---|---|---|
| SOC and SIEM | The security operations centre, and the system that collects and correlates logs and raises alerts. | 1 |
| Incident response phases | Preparation, detection and analysis, containment-eradication-recovery, lessons learned. | 1 |
| SOAR | Automating repeated response steps with ready playbooks. | 1 |
| Triage | Is the alert real? How severe? Before any deep investigation. | 2 |
| Timeline | Events from every source in order on one clock (UTC). | 2 |
| Shared key | An IP, account or host that joins different logs. | 2 |
| NIST CSF 2.0 | A framework of six functions: govern, identify, protect, detect, respond, recover. | 3 |
| ECC (NCA) | Saudi Arabia's Essential Cybersecurity Controls from the national authority, currently ECC-2:2024. | 3 |
| Risk treatment | Mitigate, transfer, avoid, or accept in writing. | 3 |
| Prompt injection | Malicious orders hidden in input or documents that make a model ignore its original instructions. Number one on the OWASP LLM list. | 4 |
| Excessive agency | An agent with more power or tools than it needs and no human approval. | 4 |
| Improper output handling | Passing model output to another system unchecked, turning it into fresh injection. | 4 |
| Security+ SY0-701 | Up to 90 questions in 90 minutes, pass mark 750 of 900, available until 11 June 2027. | 5 |
| ISC2 CC in 2026 | The free programme closed to new sign-ups; the exam is USD 199 plus a USD 50 yearly fee. | 5 |
| The most common way in | SOC analyst, then GRC for non-programmers. | 5 |
| Your free lab | Linux on VirtualBox, TryHackMe, PortSwigger, picoCTF, and Wireshark. | 6 |
| The seven phases | Foundations, principles, coding, defence and detection, web, identity-cloud-governance, certificate and portfolio. | 6 |
| The portfolio pieces | A log analysis script, an incident report, lab write-ups, and a risk register. | 6 |
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
course2
practice2
Done with this lesson?
Sign in to save your progress.