# Security Operations and Administration

> Chapter 4 of the Courseiva ISC2-SSCP curriculum — https://courseiva.com/learn/isc2-sscp/security-operations-and-administration

**Official objective:** 2.1 — Understand and support security operations and administration functions.

## Introduction

Security Operations and Administration — it is the day-to-day work of keeping an organisation’s digital doors locked, its alarms working, and its logbooks accurate. For the SSCP exam, this objective (2.1) asks you to understand how real security teams protect systems continuously, not just set a password and walk away.

## The 3-Flat Building Security Rota Analogy

You share a 3-flat building with your two friends. Each flat has its own lock, but the building also has a front door with a shared code, a security camera in the hallway, and a rota for who checks the mail and reports suspicious packages.

Every morning, you check the building logbook to see who came and went overnight. You notice the log shows a delivery person entered at 2am — that’s unusual. You check the camera footage and see it was actually your friend’s cousin who borrowed the code without asking. You update the access code, and you send a message to all residents reminding them to only share the code with approved visitors. This is the core of security operations and administration: you are not just locking doors, you are watching, logging, reviewing, and updating the rules.

Now, imagine that the building management company audits you once a year. They ask for the logbook, the camera footage schedule, and proof of your password-change policy. They check that you have a written plan for what to do if a key is lost. This is the administration part — the paperwork, policies, and procedures that prove you are running security properly.

The whole system works only because you have defined roles: one person manages the access code, one logs incidents, and one is the backup. You meet monthly to review threats. This maps precisely to security operations: monitoring, incident response, and change management, plus security administration: creating policies, managing access, and ensuring compliance.

## Core explanation

Security operations and administration is the backbone of any organisation’s cybersecurity effort. Think of it as two jobs that work together: operations is the active, ongoing work of monitoring and responding, while administration is the planning, policy-making, and record-keeping that makes operations possible.

Let’s start with security operations. This includes all the real-time activities that protect systems. The main functions are:

- Monitoring: watching logs, alerts, and network traffic for signs of trouble. A Security Information and Event Management (SIEM) system collects logs from firewalls, servers, and applications. Analysts review these logs to spot anomalies — for example, a user logging in from two different countries in five minutes.

- Incident response: when something goes wrong — a virus, a break-in, a stolen laptop — the team follows a plan to contain the damage, remove the threat, and recover normal operations. The plan typically includes preparation, detection, containment, eradication, recovery, and lessons learned.

- Change management: every time someone updates software, adds a user, or changes a firewall rule, there should be a process to request, approve, test, and document the change. This prevents mistakes that could break security.

- Backup and recovery: regularly copying important data and testing the ability to restore it. If ransomware encrypts the files, you need backups that are offline and untouchable by the attackers.

- Vulnerability management: scanning systems for known weaknesses (like old software versions) and prioritising which to fix first based on risk.

Now for security administration. This is the governance side. It includes:

- Policy creation: writing documents that define rules — for example, a password policy that says passwords must be at least 12 characters and changed every 90 days.

- Access control administration: managing who can access what. This uses the principle of least privilege — giving people only the access they need to do their job, nothing more. For example, a receptionist does not need access to the payroll database.

- Compliance: ensuring the organisation follows laws and standards like GDPR (data protection) or PCI DSS (credit card security). Administrators document what they have done to prove compliance to auditors.

- Training and awareness: teaching employees how to spot phishing emails, use strong passwords, and report suspicious activity.

- Asset management: keeping an inventory of all hardware and software, including version numbers, locations, and who owns each asset.

These two sides — operations and administration — feed into each other. Operations generates logs and incident reports that inform policy updates. Administration sets the rules that operations enforces. If either side is weak, the whole security programme suffers.

Historically, organisations did not separate these functions. A single IT person might handle everything, leading to burnout and gaps. Modern best practice splits them into dedicated teams, with clear handoffs and documented procedures. This is why the SSCP exam tests your understanding of both roles.

## Real-world context

You work as a systems administrator at a mid-sized retail company with 500 employees. One Monday morning, the security operations centre (SOC) alerts you that a user account called "jdoe" logged into the HR system at 3am from an IP address in another country. Jane Doe is on maternity leave and has not logged in for months.

You take these steps in sequence:

1. Verify the alert: check the SIEM system to confirm the log entry is not a false positive. You see the IP address belongs to a known malicious range. The account was also used to download 200 employee records.

2. Initiate incident response: you follow the company’s incident response plan. First, you disable the compromised account immediately to stop further access. You also block the IP address at the firewall.

3. Notify the incident response team: you call the lead analyst, who takes over containment. They isolate the HR database server from the network to prevent data exfiltration.

4. Document everything: you record the time, actions taken, and communications in the incident ticketing system. This log will be vital for the post-incident review.

5. Reset credentials: you reset Jane’s password and enforce a multi-factor authentication (MFA) requirement for the HR department. MFA requires a second factor — like a code from a phone app — in addition to the password.

6. Update the policy: after the incident, the security administrator revises the remote access policy. All HR accounts now require MFA, and any account inactive for 30 days must be disabled automatically.

7. Conduct user training: you run a 15-minute session for the HR team on identifying phishing attempts, because the attacker likely got Jane’s password through a phishing email.

Throughout this process, you are performing both operations (monitoring, responding) and administration (updating policy, documenting, training). The SSCP exam expects you to know how these roles intersect in a real organisation.

## Exam focus

The SSCP exam tests objective 2.1 with scenario-based questions that ask you what to do first, what tool to use, or which policy applies. You will see questions like "A user reports a suspicious email attachment — what is the first step?" or "Which document defines the rules for granting access to systems?"

Key exam traps to watch for:

- Confusing operations with administration: a question might describe an ongoing monitoring task and ask who is responsible. Operations handles the monitoring; administration creates the policies that monitoring enforces. Memorise the split.

- Failing to prioritise: in incident response, SSCP loves asking what you do first. The correct answer is always isolate or contain — not investigate thoroughly or notify management. Containment before everything else.

- Misidentifying the correct policy type: they will list four document names — Acceptable Use Policy, Data Classification Policy, Incident Response Plan, Business Continuity Plan — and ask which one applies. Know the definitions.

- Overlooking the principle of least privilege: many questions test whether you know to grant the minimum necessary access. Any answer that gives more access than needed is wrong.

- Mixing up change management and vulnerability management: change management controls modifications to systems; vulnerability management scans for weaknesses in existing configurations.

Concepts to memorise for the exam:

- The incident response lifecycle: Preparation, Detection, Containment, Eradication, Recovery, Lessons Learned.

- The three types of controls: administrative (policies, training), technical (firewalls, encryption), and physical (locks, guards).

- Separation of duties: no single person should have power to both approve and execute a sensitive action (for example, a person who requests a software purchase should not also approve the invoice).

- Job rotation and mandatory vacation: these are administrative controls that help detect fraud. If someone is covering for a colleague, they might find suspicious activity that the regular person was hiding.

- The difference between a policy (high-level intent), a standard (mandatory requirements), a procedure (step-by-step instructions), and a guideline (recommendations). SSCP may ask you to match a description to one of these.

- Record retention: how long to keep logs and documents. The exam may test that you keep records as required by law or regulation, and dispose of them securely when no longer needed.

## Step by step

1. **Monitor logs and alerts** — Security operations teams continuously review logs from firewalls, servers, and applications using a SIEM system. They look for anything unusual — a login at 3am, a failed password followed by a success, or a connection to a known malicious IP. This step catches potential threats early.
2. **Verify and triage the alert** — When an alert triggers, the analyst confirms whether it is a real threat or a false positive (e.g., an authorised administrator working late). They assign a severity level — critical, high, medium, low — based on impact and likelihood. Triage ensures resources go to the most dangerous issues first.
3. **Contain the incident** — If the alert is a real threat, the team acts to stop it from spreading. This might mean disabling a compromised account, blocking an IP address at the firewall, or isolating an infected server from the network. Containment happens before investigation to limit damage.
4. **Eradicate the root cause** — After containment, the team removes the underlying problem — deleting malware, patching the vulnerability, or changing all affected passwords. Without eradication, the same attack will recur as soon as containment is lifted.
5. **Recover and restore normal operations** — The team brings affected systems back online, often from clean backups. They test that everything works correctly and that the vulnerability is fully fixed. Recovery should be done in a controlled, documented way.
6. **Document lessons learned** — After the incident is resolved, the team writes a report: what happened, what went well, what went wrong, and what changes are needed. This step improves future response and updates policies or training. It is often overlooked but is critical for maturity.

## Comparisons

### Security Operations vs Security Administration

**Security Operations:**
- Active, daily monitoring and response
- Focuses on alerts, incidents, and vulnerabilities
- Uses tools like SIEM and firewalls

**Security Administration:**
- Planning, policy, and compliance
- Focuses on documents, audits, and training
- Uses tools like policy templates and compliance checklists

### Policy vs Procedure

**Policy:**
- High-level rule or requirement
- Broad, intent-based
- Example: 'All passwords must be 12 characters'

**Procedure:**
- Detailed step-by-step instructions
- Specific, actionable
- Example: 'Click Settings, then Security, then Change Password...'

### Incident Response: Containment vs Incident Response: Eradication

**Incident Response: Containment:**
- First action after detection
- Stops the spread of the threat
- Example: Disable a compromised account

**Incident Response: Eradication:**
- Happens after containment
- Removes the root cause of the incident
- Example: Delete malware from the system

### Change Management vs Vulnerability Management

**Change Management:**
- Controls modifications to systems
- Prevents errors introduced by changes
- Example: Approving a firewall rule update

**Vulnerability Management:**
- Identifies weaknesses in existing systems
- Prioritises fixes based on risk
- Example: Running a scan for missing patches

### Principle of Least Privilege vs Separation of Duties

**Principle of Least Privilege:**
- Limits access to the minimum needed
- Applied to individual user permissions
- Example: A receptionist cannot access payroll data

**Separation of Duties:**
- Splits a task across multiple people
- Prevents any one person from having too much control
- Example: One person orders supplies, another approves the invoice

## Diagram

_A flowchart showing the two halves of Security Operations and Administration: the operational activities on the left feed information back to the administrative functions on the right._

```mermaid
flowchart TD
    A[Security Operations] --> B[Monitoring & SIEM]
    A --> C[Incident Response]
    A --> D[Vulnerability Management]
    A --> E[Backup & Recovery]
    A --> F[Change Management]
    G[Security Administration] --> H[Policy Creation]
    G --> I[Access Control Administration]
    G --> J[Compliance & Audits]
    G --> K[Training & Awareness]
    G --> L[Asset Management]
    B & C & D & E & F -- Information feeds back to --> H & I & J & K & L
```

## Common misconceptions

- **Misconception:** Security operations is just about installing antivirus software and forgetting about it. **Reality:** Security operations is continuous: it includes monitoring, updating, patching, log analysis, and incident response. Antivirus is only one small part of a layered defence. (Many people think cybersecurity is a one-time purchase. The exam highlights that threats evolve constantly, so operations must be ongoing.)
- **Misconception:** The IT department and the security team are the same people with the same job. **Reality:** IT maintains systems for performance and availability; security focuses on confidentiality, integrity, and availability through controls. They overlap but have different priorities and reporting lines. (Beginners assume 'IT' covers everything. The SSCP distinguishes between operational technology support and dedicated security functions.)
- **Misconception:** A policy is the same as a procedure. **Reality:** A policy states the rule ('passwords must be 12 characters'), while a procedure gives the exact steps ('go to Settings, click Change Password, type 12 characters'). Policies are high-level; procedures are detailed instructions. (These terms are used loosely in everyday language. The exam expects precise definitions.)
- **Misconception:** Compliance means your security is perfect — if you follow the rules, you are safe. **Reality:** Compliance means you meet minimum legal or contractual requirements. Real security often requires going beyond what compliance mandates. Attackers do not care about your compliance checklist. (People assume checking a box equals protection. The exam teaches that compliance is a floor, not a ceiling.)
- **Misconception:** Change management is only for large, complex changes like server upgrades. **Reality:** Change management applies to any modification that could affect security — including minor changes like updating a firewall rule, adding a new user, or changing a DNS setting. Small changes can cause big vulnerabilities. (In practice, many small changes are made without review, leading to 'configuration drift' that attackers exploit.)

## Key takeaways

- Security operations is the day-to-day monitoring and response work; security administration is the policy-making and compliance side.
- The first step in any incident response is always containment to prevent further damage.
- Change management requires every system modification to be requested, approved, tested, and documented.
- The principle of least privilege means granting only the minimum access required for a person or system to function.
- Separation of duties prevents one person from having too much control over a sensitive process.
- A policy sets the rule, a standard sets the requirement, a procedure gives steps, and a guideline offers recommendations.
- Compliance is a legal minimum, not a guarantee of strong security.

## FAQ

**What is the difference between security operations and security administration?**

Security operations is the active, daily work of monitoring systems, responding to incidents, and managing vulnerabilities. Security administration is the planning side — creating policies, managing access control, and ensuring compliance. They work together, but operations does the doing, administration sets the rules.

**Do I need to know about SIEM for the SSCP exam?**

Yes, but only at a conceptual level. Know that a SIEM (Security Information and Event Management) system collects and correlates logs from multiple sources to detect suspicious patterns. You do not need to know specific vendor products.

**What is the first thing to do during an incident?**

Contain the incident to stop it from spreading. The SSCP exam is clear: containment comes before investigation, eradication, or notification. Do not start analysing the attack until you have isolated it.

**What is the principle of least privilege?**

It means giving users and systems only the permissions they need to do their job, and nothing more. For example, a marketing assistant does not need access to the payroll database. This principle limits damage if an account is compromised.

**How are policies different from procedures?**

A policy is a high-level rule or requirement — for example, 'all passwords must be at least 12 characters'. A procedure is the detailed step-by-step instructions for how to meet that policy — for example, 'click on your profile icon, select Change Password, enter your new password...'.

**What is separation of duties and why is it important?**

Separation of duties means splitting a sensitive task into parts so no single person can complete it alone. For example, one person requests a software purchase, another approves it, and a third receives the software. This prevents fraud and reduces the risk of insider threats.

## Check your understanding

1. **What is the first step in incident response after an alert is verified?**

   Answer: Containment — stop the threat from spreading before doing anything else.

2. **What is the difference between a policy and a procedure?**

   Answer: A policy is a high-level rule ('passwords must be 12 characters'), while a procedure gives the exact steps to follow to comply with the policy.

3. **What does the principle of least privilege mean?**

   Answer: It means granting users and systems only the minimum permissions they need to perform their jobs, nothing more.

4. **Which function manages access rights and user accounts on a day-to-day basis?**

   Answer: Security administration manages access control, including creating, modifying, and revoking user accounts and permissions.

5. **Why is separation of duties important in security administration?**

   Answer: It prevents a single person from having too much control over a sensitive process, reducing the risk of fraud or insider threats.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/isc2-sscp/security-operations-and-administration