https://hafizsyedshahali.github.io/security-journal/Hafiz's Security JournalTechnical notes by Hafiz Syed Shah Ali, AI Engineer · SOC Engineering & Security Automation: networking, hardening and security automation. 2026-11-09T22:20:12+05:00 Hafiz Syed Shah Ali https://hafizsyedshahali.github.io/security-journal/ Jekyll © 2026 Hafiz Syed Shah Ali /security-journal/assets/img/favicons/favicon.ico /security-journal/assets/img/favicons/favicon-96x96.png Looking Back: My Junior Cybersecurity Analyst Journey So Far2026-11-11T21:00:00+05:00 2026-11-11T21:00:00+05:00 https://hafizsyedshahali.github.io/security-journal/posts/my-junior-cybersecurity-analyst-journey/ Hafiz Syed Shah Ali A few weeks ago I started this journal with one goal: write every day about what I study as I move from AI automation into cybersecurity. I’ve now finished every course in Cisco’s Junior Cybersecurity Analyst Career Path, and with the last posts from it written up, this felt like the right moment to stop and look back before moving on to the next stage. This post isn’t about a new topic. It’s ... Cyber Threat Management, Part 7: Incident Response and Disaster Recovery2026-11-11T14:00:00+05:00 2026-11-11T14:00:00+05:00 https://hafizsyedshahali.github.io/security-journal/posts/incident-response-and-disaster-recovery/ Hafiz Syed Shah Ali The final section of Cyber Threat Management, and of the whole Junior Cybersecurity Analyst path, was about what to do when things go wrong: responding to a security incident, and recovering from a disaster. Incident response An incident is an event that threatens the confidentiality, integrity or availability of systems or data, like a malware infection, a data breach or a DDoS attack. Incid... Cyber Threat Management, Part 6: Digital Forensics, the Cyber Kill Chain and the Diamond Model2026-11-10T21:00:00+05:00 2026-11-10T21:00:00+05:00 https://hafizsyedshahali.github.io/security-journal/posts/digital-forensics-kill-chain-and-diamond-model/ Hafiz Syed Shah Ali This was my favorite section of the course. It’s about what happens after an attack is spotted: collecting evidence properly, and using models like the Cyber Kill Chain and the Diamond Model to understand what the attacker did and how to stop them next time. Digital forensics Digital forensics is the recovery and investigation of evidence from computers, networks and other digital devices. It... Cyber Threat Management, Part 5: Secure Device Management, Risk and Security Controls2026-11-10T14:00:00+05:00 2026-11-10T14:00:00+05:00 https://hafizsyedshahali.github.io/security-journal/posts/secure-device-management-risk-and-controls/ Hafiz Syed Shah Ali This section brought together two things: managing devices securely over their whole life, and managing risk in a structured way. It ended with security controls, which is where risk management turns into actual protection. Secure device management Risk management, briefly Every decision about devices comes back to risk. There are four ways to handle a risk: Risk avoidance: stop doing th... Cyber Threat Management, Part 4: Endpoint Vulnerability Assessment and CVSS2026-11-09T21:00:00+05:00 2026-11-09T21:00:00+05:00 https://hafizsyedshahali.github.io/security-journal/posts/endpoint-vulnerability-assessment-and-cvss/ Hafiz Syed Shah Ali Before you can spot something unusual on a network, you need to know what normal looks like. This section covered how to build that picture (profiling), how to spot changes from it (anomaly detection), and how to score vulnerabilities so you know which ones to fix first (CVSS). Network and server profiling Profiling means building a detailed picture of normal behavior, so anything different s...