Cybersecurity in a Nutshell - key concepts

Welcome to a guide to the most important cybersecurity concepts. If you want to understand how companies defend themselves against digital threats, this is for you. Each section includes a practical explanation, examples, and a clear view of how modern IT security works.

SIEM - your source of truth for security events

Imagine a central “eye” that collects logs (events) from servers, network devices, and applications 24/7. That’s what SIEM (Security Information and Event Management) does.

How does it work?

• Normalizes and correlates logs from many sources.
• Detects patterns of unusual behavior.
• Generates real-time alerts.

What are logs?

Logs are event journals - they record what happens in an IT system.

They can come from many sources, for example:

• Servers: (login attempts, system errors)
• Firewalls and routers: (connection attempts, scans)
• Applications and databases: (errors, user activity)
• Workstations: (software installs, USB usage)

What do they contain?

• IP addresses
• Usernames
• Timestamps
• Commands
• Errors
• System messages

Why are they useful?

⤳ They’re a key source of truth for analysts - without logs, incident investigation is almost impossible.

Why is SIEM so important?

• SIEM helps detect anomalies and suspicious actions early - like an early-warning system that reduces damage.
• It helps you understand what’s happening across users, systems, and applications - who did what, when, and where.
• It supports compliance and audits (e.g., GDPR, ISO 27001) and helps demonstrate that your organization protects data.

How SIEM saves the day:

Imagine it’s 2:00 AM. Most people are asleep, but your system is watching. It flags an unauthorized login attempt. Thanks to that alert, the security team can respond immediately and stop the incident before it becomes a full-scale breach.

You don’t have to start with expensive tools.

Not everyone needs to spend a fortune on commercial SIEM platforms right away. To get started, open-source tools can provide powerful capabilities:

• ELK Stack (Elasticsearch, Logstash, Kibana):
  • Elasticsearch - stores logs so you can search and analyze them quickly.
  • Logstash - collects logs from many sources, filters and transforms them, then forwards them to Elasticsearch.
  • Kibana - an interactive UI for dashboards, charts, and alerts on top of Elasticsearch.
• Wazuh - a broader platform that, in addition to log collection and analysis, supports endpoint threat detection (e.g., on servers).
• Security Onion - a Linux distribution with preconfigured SIEM and IDS tooling, including components like Suricata and Zeek for network monitoring.

SOC - the heart of your security operations

In a world where attacks happen every day, technology alone isn’t enough. You also need people who monitor, analyze, and respond to threats 24/7. That’s what a Security Operations Center (SOC) does - it’s the command center for your organization’s cybersecurity.

The SOC team: who does what?

SOC L1 - Tier 1 analyst

Their main job is continuous monitoring of alerts generated by security systems (such as SIEM, IDS/IPS, EDR). They perform a first-pass analysis, filter false positives, and escalate serious incidents to the next tier. They’re often early-career specialists who form the backbone of SOC operations.

SOC L2 - Tier 2 analyst

When an incident is considered a real threat, Tier 2 takes over. They investigate in depth, gathering context such as where the attack came from, what data is at risk, and what the likely vector is. They also coordinate immediate containment actions like isolating impacted systems, blocking malicious IPs, or resetting user passwords to minimize damage. This role requires deeper technical knowledge and fast problem-solving.

SOC L3 - security expert / threat hunter

These are the most experienced specialists in the SOC. They handle complex investigations, malware analysis, and security gaps. A key part of their work is Threat Hunting - proactively searching for hidden threats that may bypass standard detection. They act like “cyber detectives”, finding attacks before they cause major impact, and often improve and tune the tools used by the SOC.

How does a SOC work day-to-day?

SOC work is dynamic and often shift-based to maintain continuous coverage. Analysts watch SIEM consoles and respond to alerts, using tools like EDR, IDS, IPS, and SOAR (incident response automation). Clear communication with other teams and careful documentation are essential.

Real-life example:

A Tier 1 analyst notices a login alert from an unusual country and escalates. Tier 2 confirms that sensitive files were downloaded right after the login and isolates the machine. Tier 3 identifies a keylogger during deeper analysis - and thanks to coordinated SOC work, the company avoids a major data breach.

Why have a SOC?

• Attacks are inevitable: The question isn’t “if”, but “when”.
• Fast response: SOC enables rapid action and limits damage.
• Protection of critical assets: It helps prevent loss of data, reputation, and money.
• Compliance: Supports regulatory requirements (e.g., GDPR, ISO 27001).
• Continuous monitoring: Threats happen 24/7, and a SOC provides constant coverage.
• Peace of mind: Knowing experts are watching lets the business focus on growth.

A SOC is your most important ally in the fight for digital security and business continuity.

Explore the core threats

EDR - the guardian of endpoints

In today’s digital world, threats evolve fast, and protecting company laptops and desktops is a top priority. Endpoints - the devices employees use every day - are often the easiest target. To protect them effectively, you need more than traditional antivirus. That’s where advanced systems like EDR (Endpoint Detection and Response), IDS, and IPS come in.

EDR: your computer’s personal detective

Think of EDR as a vigilant detective that continuously watches what’s happening on a device. It doesn’t just check for known malware signatures - it looks for unusual and suspicious behavior.

What does EDR track?

• Processes: Is a program trying to do something it shouldn’t?
• Files: Are critical files being modified or encrypted unexpectedly?
• Network connections: Is the device connecting to suspicious servers?

Data exfiltration detection: If EDR detects suspicious activity (like mass copying sensitive documents to an external USB drive), it can immediately block the process and isolate the device before the incident escalates.

IDS and IPS: early warning and prevention systems

In addition to EDR, IDS (Intrusion Detection System) and IPS (Intrusion Prevention System) play a key role in network defense. They operate at the network level and complement endpoint protection.

• IDS (Intrusion Detection System): Think of it as an intelligent alarm. It monitors traffic for signs of intrusion or malicious activity. When it detects something, it alerts the security team. IDS doesn’t block by itself - it informs so you can respond.
• IPS (Intrusion Prevention System): Takes it one step further. IPS can detect and automatically block identified attacks - like a wall that prevents threats from entering or spreading.

Why is this trio so important?

• EDR protects individual endpoints from advanced attacks and unusual behavior.
• IDS warns about intrusion attempts and suspicious network activity.
• IPS actively prevents known attacks at the network level.

This protects both individual devices and the broader network. It reduces the risk of data theft, system outages, and other cyber incidents - supporting business continuity.

IMS - structured incident management

Why is IMS important?

• Centralized intake: No incident gets lost - everything is recorded in one system.
• Automatic categorization: Incidents are classified by type and severity.
• Prioritization: The system assigns priority based on predefined rules.
• Full audit trail: You can trace each step from detection to resolution.
• Reporting: Built-in summaries for audits and effectiveness reviews.

SOAR - automating security operations

In environments where large organizations can receive ~1000 alerts per day, handling everything manually doesn’t scale. SOAR (Security Orchestration, Automation & Response) addresses this by turning chaos into repeatable processes through smart automation.

What can SOAR do?

• Playbooks: Ready-made response flows for common incidents (e.g., auto-blocking an IP address).
• Tool integration: Connects SIEM, firewalls, and ticketing systems into one workflow.
• Real-time response: Typical incidents can be handled in minutes.
• Fewer mistakes: Reduces human error in routine operations.

XDR - extended detection and response

When traditional tools only see pieces of the puzzle, XDR (Extended Detection and Response) connects them. It’s an evolution of EDR that aggregates and analyzes data across your infrastructure: endpoints, network, cloud, and applications.

Key advantages of XDR

• Event correlation: Traditional tools often get only fragments. XDR collects signals from computers, network, cloud, and email - then links them into one story. It helps you see an attack end-to-end, not as isolated alerts.
• AI in action: Rules catch known threats, but attackers keep changing tactics. XDR uses machine learning to spot anomalies that don’t match normal behavior.
• Stronger coverage: Ransomware and APT campaigns are complex and long-running. XDR can detect signals across layers - from phishing to network movement to suspicious logins - beyond what a single EDR or IDS can provide.
• Noise reduction: XDR filters false positives and merges related alerts into a single incident, so analysts focus on real threats instead of thousands of notifications.

If an attacker tries to move from an infected workstation to a server, XDR can connect the chain of events - unusual logins, suspicious network traffic, and application anomalies - and treat it as one coherent incident.

XDR INFOGRAPHIC

Glossary

Kill Chain - A model that describes the stages of an attack, from preparation through infiltration to the end goal (e.g., data theft). Understanding the kill chain helps you detect and disrupt attacks earlier.

APT (Advanced Persistent Threat) - A sophisticated, long-term threat actor that operates patiently and stealthily to gain access to sensitive systems or data. APTs are difficult to detect and remove.

Zero-Day - A software vulnerability unknown to the vendor and not yet patched. Attackers can exploit it before a fix exists, which makes it especially dangerous.

Machine Learning - A method where computers learn patterns from data to make predictions or decisions without being explicitly programmed for every case. In security, it helps detect anomalies and new attack patterns.

Summary

Cybersecurity is a marathon, not a sprint. Technologies change, but one thing stays constant: awareness and the ability to respond. Whether you’re an IT professional or just getting started, one thing is true - knowledge is your first line of defense.