1.2.1. Asymmetry: Why Attackers Have It Easier
💡 First Principle: Defenders must secure every asset, every configuration, every user behavior — attackers only need one gap. This means the value of defense lies not in perfection but in raising the cost of attack while minimizing dwell time after breach.
This asymmetry has direct implications for how analysts prioritize. You cannot eliminate all attack surface — you can only reduce it and detect movement across it faster. The concept of dwell time (how long an attacker remains in a network before detection) is a critical metric because longer dwell time = more damage. The industry benchmark has historically been measured in months; mature SOC programs aim for days.
Raising the cost of attack means:
- Requiring multiple successful steps to achieve an objective (defense in depth)
- Making lateral movement noisy and detectable (microsegmentation, privileged access monitoring)
- Reducing the value of any single credential (MFA, PAM)
- Detecting reconnaissance before it becomes exploitation (honeypots, threat hunting)
For the exam, this mental model explains why layered controls, privileged access management, and network segmentation get tested together — they're all expressions of the same principle: make the attacker work harder at every step.
⚠️ Exam Trap: Defense in depth and Zero Trust are different concepts. Defense in depth is about multiple independent security layers so no single failure is catastrophic. Zero Trust is specifically about removing implicit trust from network location — they're complementary, not identical.
Reflection Question: A security team has a limited budget. Should they invest in preventing every possible initial access vector, or in detecting and responding quickly once an attacker is inside? What principle guides this decision?
