📐 Architecture Diagrams & References
Visual reference models, attack lifecycles, defense architectures, and maturity frameworks for cybersecurity training and interview preparation.
Defense-in-Depth Model
Layered security architecture from perimeter to data
🌍 Perimeter Security
DDoS Protection, CDN, WAF
↓
🔥 Network Security
NGFW, IDS/IPS, Segmentation
↓
💻 Host Security
EDR, Hardening, Patch Mgmt
↓
📱 Application Security
SAST, DAST, WAF, RASP
↓
💾 Data Security
Encryption, DLP, Classification
↓
👤 Identity Security
IAM, MFA, PAM, Zero Trust
Cyber Kill Chain
Lockheed Martin attack lifecycle model
🔍 Reconnaissance
Gather target information
↓
⚔️ Weaponization
Create exploit payload
↓
📧 Delivery
Phishing, drive-by, supply chain
↓
💥 Exploitation
Execute vulnerability exploit
↓
📦 Installation
Install backdoor / RAT
↓
📡 Command & Control
Establish C2 channel
↓
🎯 Actions on Objectives
Data exfil, destruction, ransomware
Incident Response Lifecycle
NIST SP 800-61 incident handling process
📋 Preparation
IR plan, tools, team, training
↓
🔔 Detection & Analysis
Alert triage, IOC analysis, scope
↓
🛡️ Containment
Short-term and long-term containment
↓
🧹 Eradication
Remove threat, patch vulnerability
↓
🔄 Recovery
Restore systems, verify integrity
↓
📝 Post-Incident Review
Lessons learned, detection improvement
MITRE ATT&CK Tactics
Enterprise ATT&CK tactic categories
🔍 Reconnaissance
Gathering target information
↓
🚪 Initial Access
Phishing, exploits, supply chain
↓
⚡ Execution
Running malicious code
↓
📌 Persistence
Maintaining foothold
↓
⬆️ Privilege Escalation
Gaining higher permissions
↓
🔑 Credential Access
Stealing credentials
↓
↔️ Lateral Movement
Moving through network
↓
📤 Exfiltration
Stealing data
Zero Trust Architecture
NIST SP 800-207 zero trust model
👤 Subject
User, device, or workload requesting access
↓
🔐 Policy Enforcement Point
Gateway that enforces access decisions
↓
🧠 Policy Decision Point
Evaluates identity, context, risk
↓
📊 Trust Algorithm
Device health, behavior, threat intel
↓
🏢 Enterprise Resource
Application, data, or service accessed
SOC Maturity Model
SOC capability maturity progression
📍 Level 1 — Reactive
Ad-hoc response, basic SIEM, manual processes
↓
📍 Level 2 — Proactive
Defined playbooks, SOAR, regular hunting
↓
📍 Level 3 — Adaptive
Threat-intel driven, ATT&CK mapping, metrics
↓
📍 Level 4 — Predictive
ML-powered detection, auto-response, AI triage
↓
📍 Level 5 — Autonomous
Full AISecOps, self-healing, continuous optimization