The defender's mindset for systems

Why this matters

System security is about adversaries who already got onto the host — local privilege escalation, lateral movement, persistence. The defender's mindset assumes the perimeter is breached and asks 'what makes the next step harder?'. Defense-in-depth: every layer (kernel, filesystem, network, process) gets its own controls so that compromising one doesn't grant the others.

Demo

An attacker who lands a webshell on your box already has the unprivileged user. The question is whether they can escalate to root, persist across reboots, and move to neighbouring hosts — each a separate defence.

Try it yourself

1. Pick a host you operate. List five things an unprivileged user on it could do that you'd consider 'compromised'. For each, write the control that stops it.
2. Run linpeas.sh on a staging host. It reports privilege-escalation vectors. Count how many findings have remediations you've shipped.
3. Read one Detection Engineering Cookbook chapter (Florian Roth). Note how detection assumes initial access has already happened.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, contrast the system-security mindset with web-security mindset.

2. Why it works (the mechanism)

Walk me through a typical post-exploitation chain on Linux from initial shell to persistence.

3. Advanced — application & what's next

Defence in depth is sometimes criticised as 'expensive controls that overlap'. When is it actually necessary?

References

• MITRE ATT&CK — Privilege Escalation tactic
• linpeas / winpeas