Connect architecture, identity, and logging to security operations

Architecture determines what evidence can exist. Endpoint telemetry observes process and identity activity on a host, while network sensors observe traffic that crosses their collection point. Encrypted traffic may hide payloads but still exposes selected metadata. Place collection where it sees the decision or transition under investigation.

Segmentation limits paths only when policy is enforced and verified. A diagram is intended state; flow logs, firewall decisions, and controlled connection tests show observed state. Keep management, user, server, and security-tool paths distinct so a sensor outage does not silently become a control outage.

Cloud control planes, workload identities, and data planes produce different evidence. A successful console sign-in does not prove which workload credential called an API, and a network address may represent a gateway rather than the originating identity. Preserve principal, action, resource, decision, and request correlation identifiers together.

Zero trust decisions evaluate subject, asset, resource, and context for each access request. Network location can contribute context but should not substitute for identity and policy. When a workload crosses accounts or subscriptions, inspect the assumed role or service principal and the policy evaluation chain.

A log is useful only when the source is configured, events arrive intact, clocks are understood, and retention covers the question. Hashes or protected storage can reveal later alteration, but neither proves that a missing event was collected. Host hardening reduces attack paths; critical-file changes and unusual parent-child processes provide evidence of state drift.

Cloud-native services, virtual machines, containers, and mobile endpoints expose different control planes. Analysts must identify who controls the host, workload, image, API, or device record before treating one console as complete evidence. An MDM compliance flag is useful context, not a replacement for authentication, authorization, or endpoint observations.

Critical Windows files include the registry hives SAM, SECURITY, SYSTEM, and SOFTWARE in %SystemRoot%\System32\config, each user's NTUSER.DAT, and the .evtx logs in %SystemRoot%\System32\winevt\Logs. Core Windows processes are smss.exe (session manager), csrss.exe, wininit.exe, services.exe (starts services and parents svchost.exe), lsass.exe (enforces security policy and holds credentials, which makes it a credential-dumping target), and winlogon.exe. One of these names running from another folder or under an unexpected parent is a strong lead.

Critical Linux files include /etc/passwd (accounts), /etc/shadow (password hashes), /etc/sudoers and /etc/sudoers.d (privilege), /etc/ssh/sshd_config and each user's ~/.ssh/authorized_keys (remote access), /etc/crontab, the cron directories, and systemd unit files (scheduled and persistent execution), and /var/log (logs). systemd runs as PID 1 and is the parent of services such as sshd and cron, so a shell or interpreter with an unusual parent deserves review.

Zero trust evaluates each request; SASE commonly delivers network and security capabilities from distributed services; hybrid cloud joins on-premises and cloud control planes. None of these labels removes the need to identify the policy decision, enforcement point, principal, device, and requested resource. PAM governs privileged human access, while secrets management controls credentials used by applications and automation.

Encryption protects confidentiality only when algorithms, modes, certificates, and keys fit the data state and recovery plan. OT is the broad operational environment, an ICS controls a process, and SCADA supervises distributed processes and telemetry. Security changes must respect safety, availability, deterministic behavior, and the system owner's operating window.

Encryption techniques: symmetric encryption (for example AES) uses one shared key and suits bulk data at rest or in a session; asymmetric encryption (RSA, elliptic curve) uses a public/private key pair for key exchange and digital signatures; hashing (SHA-256) is one-way and verifies integrity instead of hiding data. PKI binds a public key to an identity in a certificate signed by a certificate authority, and TLS uses that certificate to authenticate a server and agree session keys. Data-protection concepts: classification labels sensitivity; DLP detects or blocks sensitive data in use, in motion, and at rest; tokenization replaces a value with a surrogate held in a vault; masking hides part of a value from view; retention and disposal rules limit how long data exists.

Authentication proves an identity with passwords, MFA, certificates, or passkeys (FIDO2). With SSO and federation, an identity provider vouches for the user to other services through a SAML assertion or an OpenID Connect ID token; Kerberos issues tickets inside a domain; OAuth 2.0 delegates access with scoped tokens. Authorization then decides what the identity may do: RBAC grants permissions by role, and ABAC evaluates attributes and context for each request.