Assume Breach
A First Course in Defensive Security
Introduction: Assume Breach
A security control can fail. A supplier account can be misused, a patch can arrive late, or a colleague can approve an unexpected login request. A defender plans for those possibilities while still trying to prevent them. Assume breach means designing detection, containment and recovery into the system.
Who this book is for
This is a first course for students, people moving into security, and curious professionals. It assumes basic familiarity with a browser and files, but no security background or programming. The core reading and exercises require no software installation, paid service, AI account or group.
By the end, you should be able to take a small system description, identify important assets and plausible threats, choose layered controls within a budget, specify tests of those controls, and defend a response/recovery decision with its uncertainties. This is introductory judgement, not authorisation to test other people’s systems or a qualification to run a production incident alone.
How the chapters build
Read in order on your first pass. Each part contributes to a short defender’s dossier, using the fictional Harbour Community Centre in The Defender’s Dossier.
| Part | What you should be able to do afterwards |
|---|---|
| I: Foundations | Identify assets, threats, permissions and appropriate protection mechanisms |
| II: Managing Risk | Justify a control choice and check a recovery plan against stated targets |
| III: Systems and Networks | Trace a trust boundary and test permitted and forbidden actions |
| IV: People and Threats | Separate evidence from inference and design a usable verification process |
| V: Putting It Together | Defend a complete plan for a changed case and identify what is not ready |
Every chapter has questions to consider and a short applied task. Try the task before reading the worked dossier. The final chapter gives an independent variant and success criteria. Definitions alone are not evidence that you can use them.
The network primer is in chapter 7. NTLM, cryptographic attack models and named tools provide optional depth; you do not need to configure them to complete the dossier. The practice appendix explains boundaries for optional hands-on work. It does not claim that a generic VM or container setting creates a safe lab.
Several chapters link Incident Zero, an optional print-and-play group game. It offers a different experience of making decisions under pressure. The book’s solo exercises provide a complete route if you never play.
Optional AI conversations
An assistant can explain a term, challenge a proposed control or quiz you. Try your own answer first, then ask it to identify an assumption you missed. Keep the evidence trail: a fluent explanation or invented incident is not a verified source. Three chapters include longer conversation prompts; other chapters use calculation, annotation and evidence checks.
Use fictional inputs from this book. Do not paste real phishing emails, credentials, session tokens, personal information, internal logs or production firewall rules into a public assistant. If you adapt an example, remove sensitive details and follow your organisation’s approved data-handling rules. A generated configuration is a draft to test in an authorised environment, never a ready-to-deploy answer.
For more on this method, see Conversation, Not Delegation. No companion book is required here.
The series trunk is Conversation, Not Delegation for method and The Human Edge for professional judgement. This book is the branch for defensive security.
Reading claims and sources
Examples labelled fictional are teaching inputs. Historical incidents and consequential technical claims have nearby sources, with a curated trail in Further Reading. Legal summaries describe selected regimes as checked in September 2026; applicability and facts matter. For an actual incident, involve the authorised technical and legal advisers.
This book is open access under the author’s stated Creative Commons Attribution 4.0 International (CC BY 4.0 International) licence; original code examples use MIT. The free edition is the focus, and the series catalogue links the related books.