1.1.1. Assume Breach: Why Defenders Think Differently
💡 First Principle: "Assume breach" means designing your detection and response capabilities as if attackers are already inside — because assuming they're not leads to under-investing in the internal visibility that would catch them.
The assume breach posture emerged from a painful lesson the security industry learned repeatedly: perimeter defenses fail. Firewalls get bypassed. VPNs get compromised. Credentials get phished. When an organization assumes its perimeter is intact, it fails to build the internal monitoring that would catch an attacker who has already crossed it. Assume breach flips this: instead of asking "how do we keep them out?" the question becomes "how would we know they're in, and what would we do about it?"
This has practical implications for how SOC analysts work. Every user could be a threat (insider or compromised credential). Every system could be compromised. Every piece of lateral movement should be detectable. This is why monitoring internal east-west traffic (not just perimeter north-south traffic) matters, why privileged accounts need tighter controls than regular users, and why anomaly detection matters more than signature-based detection alone.
For the CySA+ exam, assume breach underpins several domain concepts: Zero Trust architecture (1.1), threat hunting (which assumes threats are present, not just possible), and evidence acquisition procedures (which treat every system as a potential crime scene until proven otherwise).
⚠️ Exam Trap: Zero Trust is not "deny all traffic." It's a framework where every access request is verified regardless of network location — authenticated users and systems inside the network still get least-privilege access, but they're not automatically trusted just because they're on the internal network.
Reflection Question: If you're designing monitoring for a corporate network, why would you instrument internal lateral movement (workstation-to-workstation traffic) as carefully as you monitor internet-facing traffic?
