CYBRARY Foundations: the whole job, in plain words
Nothing here assumes you have worked a shift. Each idea is written the way you would explain it to a friend, with the proper term in brackets so the next page you read makes sense. When you want the formal vocabulary instead, the analyst vocabulary page has the same material with the identifiers.
What a security team actually does all day
- 1
Something is noticed
A tool watching the machines sees something it was told to watch for — a password tried fifty times, a program starting from a folder programs do not live in.
Called: A detection rule fires and raises an alert.
- 2
Someone decides if it matters
A person reads what the tool saw and checks a couple of other places. Most of the time there is an ordinary explanation.
Called: Triage: confirm, dismiss with a reason, or escalate.
- 3
It becomes a file with a name
If it does matter, everything found gets written into one record so nobody has to remember it: which machine, which account, what happened and when.
Called: A case (or incident ticket) is opened.
- 4
The spread is worked out
Before anything is switched off, you find out how far it went. Turning off the first machine you find often just warns the intruder.
Called: Scoping.
- 5
It is stopped
The machine is cut off the network, the password is changed, the connection out is blocked — whichever of those actually ends it.
Called: Containment and eradication.
- 6
Work goes back to normal, and the lesson is written down
The machine is rebuilt or restored, and the team says plainly what would have caught it sooner.
Called: Recovery and lessons learned.
An alert is a machine saying “look at this”. A case is a person saying “this is what happened”. Most alerts never become cases, and that is normal — the skill is deciding quickly which ones should.
An attack is a set of steps, not one event
Attackers do the same kinds of things in roughly the same order. Someone wrote all of them down in a public catalog called MITRE ATT&CK, and the whole industry now uses its step names so two people can describe the same attack the same way.
| In plain words | The proper name | What it looks like |
|---|---|---|
| Getting in | Initial access | An email with a document that runs something when it is opened. |
| Running something | Execution | The document starts a hidden program. |
| Staying in | Persistence | A scheduled job restarts the program every hour, even after a reboot. |
| Stealing a password | Credential access | Passwords are lifted out of the computer's memory. |
| Looking around | Discovery | A list of every shared folder the account can reach. |
| Moving to another machine | Lateral movement | The stolen password opens the file server. |
| Phoning home | Command and control | The program checks in with the attacker every few minutes. |
| Taking the data | Exfiltration | Files leave in small pieces so nothing looks unusual. |
| Doing damage | Impact | Backups are deleted and files are encrypted. |
Why a factory is divided into zones
In an office, the worst case is lost data. In a factory, the worst case is a machine moving when someone is standing next to it. So an industrial site is split into zones, each with its own rules, and the only ways between them — conduits — are few, named and watched. That idea is written down in a standard called IEC 62443.
The office network — Level 4/5 — enterprise
Email, laptops, finance systems. Where nearly every attack starts.
The buffer in between — Level 3.5 — the plant DMZ
A small set of shared machines that both sides may talk to, so the office never talks straight to the factory.
The control room — Level 2/3 — supervisory
The screens an operator watches and the workstation an engineer programs from.
The controllers — Level 1 — basic control
The small industrial computers that actually run the line, on a loop, forever.
The machinery itself — Level 0 — field devices
Valves, motors, sensors. Physical things that move and can hurt someone.
This is why the office answer can be the wrong answer on a plant floor. Unplugging a suspicious laptop costs somebody an afternoon. Unplugging a controller can stop a process mid-cycle, and stopping it badly is its own hazard.
Now do it once
Reading about a shift is not a shift. Ten minutes on a real machine, scored on what your commands actually returned, teaches more than the rest of this page.