The standing discipline. Not what you do when something breaks — what you do every week so that when something breaks, you already know what you're holding.
Operations is the unglamorous half of security. There's no incident, no adrenaline, no writeup at the end. There's a scanner producing output, a patch cadence, a rotation schedule, and an inventory that's either current or quietly lying to you.
The measure of whether it's working is entirely counterfactual: how much shorter your worst day is because of work you did on an ordinary one.
Everything in this section is a monitor in the sense of Build Time vs Run Time — a control whose answer changes without anyone touching the code. If you haven't read that chapter, read it first; it's the one that explains why re-running something you already ran is the entire discipline rather than a waste.
Available now¶
- Vulnerability Management — finding, triaging, and fixing known vulnerabilities in what you're running
- Secrets Management — storage, scope, rotation, and what to do when one leaks
- Research Data Security — classification and handling when the data belongs to people who trusted you
Planned chapters¶
| Chapter | What it covers |
|---|---|
| Continuous Vulnerability Scanning | The build-time gate vs the runtime monitor, worked end to end. Why the same artifact needs re-scanning forever, SBOM as the durable input, and a real triage funnel — 1,202 findings down to 643 down to something a person can act on |
| SBOM as Living Inventory | Generation is a build-time act; matching is a runtime one. syft generates, grype matches, and the interesting part is that only one side of that pair ever changes |
| Patching and Backports | Why your scanner says CVE-2024-XXXX is unpatched on RHEL when Red Hat fixed it in February. Version-string matching vs vendor status, and how much noise this single issue produces |
| Credential Rotation | Doing it on a schedule so you're not learning the procedure during an incident. Scope, dependency order, and the credentials nobody remembers |
| Monitoring and Telemetry | What to collect, what to alert on, what to keep, and the retention question you'll wish you'd answered earlier |
| Hardening Baselines | A defensible default state for hosts, containers, and clusters — and how to detect drift from it |
| Egress Control | The single highest-leverage control against credential exfiltration, and the reason it's almost never implemented |
The counterfactual problem
Operations work is impossible to justify with a success story, because success looks like nothing happening. The only evidence you'll ever have is incidents that were shorter than they should have been, and nobody writes those up.
This is why the discipline erodes. Somebody asks what the scanner caught this quarter, the answer is "nothing critical," and the budget moves. Then the quarter it matters, the inventory is eight months stale and the rotation runbook was written for a system that got replaced.
Do it anyway. Write down when you did it. That log is the only argument you'll have.