Assume Breach
A First Course in Defensive Security
Introduction: Assume Breach
The old question was “how do we keep attackers out?” The better one is “what do we do given that, sooner or later, they get in?” That shift in assumption changes everything.
The unlocked door behind the badge
Every organisation says its systems are secure. It puts a padlock icon on the login page, a privacy policy in the footer, and an “enterprise-grade encryption” line on the marketing site. Then, somewhere behind all of that, there is a server no one has patched in eleven months, a password four people share, and a staff member about to click a link they shouldn’t. The claim and the reality are two different things. The gap between them is where information security lives.
Modern security starts from an uncomfortable premise: assume breach. Assume the perimeter will fail, the patch will be late, and someone will click the link. Across a large enough system and enough time, they will. A defender who assumes they can keep every attacker out builds one wall and trusts it. A defender who assumes breach builds in depth, watches for the intrusion, limits how far it spreads, and plans to recover. This is not pessimism. It is how real systems are defended.
This book is a first course in that mindset. It will not turn you into a hacker or a penetration tester in twelve weeks. It will do something more useful: teach you to think like a defender. That means looking at a system and seeing, before anything goes wrong, where it could go wrong, what it would cost, and what to do about it. That habit of mind is the thing you take into any job, in any industry, for the rest of your career.
How to think like a defender
Defenders reason in a particular way, and the whole book is built to grow that habit. Assume nothing is safe until it is shown to be: a control that looks fine on paper is only a claim until you have reason to trust it. Understand the attacker in order to protect against them. You cannot defend what you do not understand, so we spend time on how attacks work, studying them to see what they need so you can take it away. Weigh the cost, because perfect security is unaffordable and unusable. Every control is a trade-off, and a defender’s skill is deciding which ones are worth it. And never forget the human. Most breaches do not defeat the technology; they walk past it through a person. The human factor is often the whole story.
Who this is for, and how to read it
This is a first book on defensive security, for anyone meeting the subject for the first time: a student, someone moving into security from another part of IT, or a curious professional who wants the mental model without the jargon. It assumes no prior security background.
The chapters build in a deliberate order. The early ones establish the foundations: how security is measured, where software goes wrong, how identity and secrets are protected. The middle turns to managing risk and surviving incidents. The later ones defend systems and networks, and end where security always ends: with people. You will get the most from reading in order, because each chapter leans on the ones before it, but each is self-contained enough to revisit on its own.
The book carries the concepts. It stays tool-agnostic: it explains what is true on any system rather than which button to click, so it doesn’t go out of date the moment a tool does. Where practice helps, a Try it yourself note points you at the kind of hands-on exercise the ideas invite, and the practice-environment appendix shows how to set up somewhere safe to do it. Each chapter ends with a few Questions to consider. They are prompts worth sitting with rather than a test. Several are easier to answer well after a later chapter, which is deliberate.
A word on using AI
Using AI to learn this material is a good idea, and this book encourages it. Ask an assistant to explain a concept a second way, to quiz you, or to challenge your answer to one of the end-of-chapter questions. What matters is that you stay in the conversation and do the thinking. Use it to understand faster. Do not use it to skip understanding. If you want to get better at that skill itself, the companion volume Conversation, Not Delegation is about this: thinking with AI rather than delegating your thinking to it.
This book is open access under a Creative Commons Attribution (CC BY) licence. It is part of the books.borck.education series.