2.6. Reflection Checkpoint

Key Takeaways

• Architecture shapes visibility — Zero Trust, segmentation, and log source coverage determine where you can and cannot detect threats. Gaps in architecture = gaps in detection.
• Log time synchronization is a forensic prerequisite — NTP alignment enables reliable multi-system event correlation; skew undermines investigation timelines.
• OS features are attacker tools — Registry auto-run keys, scheduled tasks, and process injection are the same OS features attackers use for persistence and execution. Normal behavior baselines make anomalies visible.
• Network indicators reveal patterns, not individual packets — Beaconing, lateral movement, and exfiltration are detected through behavioral patterns across time, not single events.
• SIEM sees; SOAR acts — SIEM correlates and alerts; SOAR automates defined response steps. Novel threats still need human analyst judgment.
• Email authentication proves origin, not legitimacy — SPF/DKIM/DMARC passing only means the email came from who it claims; attackers can pass all three checks with malicious domains they control.
• Sandboxing has limits — Sandbox-aware malware won't execute its payload in analysis; a clean sandbox run is inconclusive, not proof of safety.
• Behavior analytics catches what signatures miss — Impossible travel, bulk access, and unusual process trees catch compromised credentials and living-off-the-land attacks that have no malware signatures.

Connecting Forward

Phase 3 shifts from detecting threats to systematically finding and prioritizing vulnerabilities before attackers can exploit them. Where Phase 2 is reactive and detective, Phase 3 is proactive — scanning, scoring, and remediating weaknesses before they become incidents.

Self-Check Questions

1. Your SIEM fires an alert: a server is making outbound connections to an IP flagged as malicious in a threat intel feed, but the connections use HTTPS on port 443. Your SSL inspection proxy is not deployed on the server segment. Walk through what you can and cannot determine from available evidence, and identify which architectural gap is most limiting your investigation.

2. A user's account shows a login from Chicago at 9:00am and a login from Singapore at 9:45am. The user works remotely in Chicago and has no business reason to be in Singapore. Name three distinct hypotheses that explain this, and identify one piece of evidence that would confirm or eliminate each hypothesis.