Defensive › Module 1 › Lesson 1
What Defense Is
Defense is reduce blast radius, detect sooner, recover faster — on systems YOU own at $LAB_HOST.
Visual · defense_what_is
Defense = prevent, detect, respond, recover. $LAB_HOST only. Original Cyberlium.
Opening
Defense is not a license to poke strangers. It is discipline on assets you operate.
Defensive security protects confidentiality, integrity, and availability of systems people depend on. Blue teams patch, harden, log, alert, backup, and restore. Red teams test controls under written scope — defenders fix what breaks. Both need vocabulary before any command runs. Cyberlium Topic 16 teaches hardening and logging literacy on YOUR lab VM or personal workstation — placeholder $LAB_HOST. You will NOT scan a classmate's laptop, harden an employer router without ticket, or 'audit' café Wi-Fi because you installed a tool. You will NOT treat logging as surveillance homework on strangers. Next: RoE Written Scope.
1. Prevent, detect, respond, recover
Prevention shrinks attack surface: patches, least privilege, firewalls, sane defaults. Detection turns telemetry into signals: auth failures, config drift, unexpected processes. Response contains damage; recovery restores from backups you tested.
Defenders name these phases before buying a SIEM. Attackers hope you skip prevention and logging — you won't on $LAB_HOST.
Command guide
Try these commands — Prevent, detect, respond, recover
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK — https://attack.mitre.org/ (attacker view for defenders) NIST CSF — https://www.nist.gov/cyberframework (Identify/Protect/Detect/Respond/Recover) CIS Controls — https://www.cisecurity.org/controls
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
Built-in (iproute2)
macOS: Use: netstat
Windows: Built-in (PowerShell: Invoke-WebRequest) Use: netstat
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://attack.mitre.org/matrices/enterprise/ -o /dev/null -w "ATT&CK matrix HTTP %{http_code}
"
ss -tulpn 2>/dev/null | head -15 || netstat -tulpn 2>/dev/null | head -10Primary tools to practice this lesson: curl, ss. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); NIST CSF (https://www.nist.gov/cyberframework); CIS Controls (https://www.cisecurity.org/controls). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defense is operator work on owned assets
Legitimate defensive work requires assets you administer: your lab VM, your personal PC, your lab router under your account. Curiosity about a neighbor's open port is not defense. A YouTube title saying 'audit any network' is not authorization.
Cyberlium labs assume a disposable lab VM or workstation you can revert. If the host is not $LAB_HOST in your RoE file, hardening commands stay closed for that target.
3. What this topic will never call practice
nmap sweeps on dorm LANs, 'hardening' a café gateway, scraping stranger logs from Shodan, or deploying agents on classmates' machines without written scope. Those harm strangers and violate law or policy — not homework.
Ship a sentence: defensive literacy here means hardening and logging on MY $LAB_HOST under written RoE. Next lesson writes that RoE.
4. What you ship: defense definition that excludes stranger hosts
Write defense = prevent/detect/respond/recover on owned assets. Lab dest = $LAB_HOST you control. NEVER stranger scans, café routers, classmate laptops. Notes chmod 600.
5. What you record before the next lesson
Date (UTC). Defense vs offensive misuse. Lab = $LAB_HOST you own. NEVER stranger hosts, LAN sweeps, café gateways. Path: $HOME/cyberlium-lab/t16-m01-l01-what-defense.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
nmap the dorm /24 'to learn defense.' Change firewall rules on the office router without change ticket. Install logging agents on a friend's PC 'to help.'
Right
Define defense phases and owned assets. Name $LAB_HOST as the only dest. Next: RoE Written Scope.
Mission: define defense as work you own
1) Write prevent/detect/respond/recover in one paragraph. 2) Write a NEVER list (stranger scans, café routers, classmate hosts). 3) Name $LAB_HOST as your lab placeholder. Never harden hosts you do not administer.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: 'Hint only: what is blast radius?' — not how to scan a dorm LAN.
Knowledge Check
APPLY: Defensive security on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Curiosity about a neighbor's open port authorizes a defensive scan.
True or False
Knowledge Check
APPLY: A defender studies auth failure logs mainly to:
Multiple choice