1 — The MAPE-K loop and the vocabulary

1 — The MAPE-K loop and the vocabulary

Study time: ± 45 minutes

Why this exists

Prevention always fails eventually. Firewalls and access control keep most attackers out, but not all, and an attack you never notice is one you can never stop. Security operations is the discipline of seeing the intruder who got through and doing something about it — the security team of an IT environment, not the locks on its doors.

The loop: MAPE-K

CyBOK frames the whole field as one continuous loop, borrowed from autonomic computing:

• Monitor — collect traces (logs, network traffic). The cameras.
• Analyse — decide whether that data is evidence of an attack. The guard reading the feeds.
• Plan — decide what to do about it. Ignore, investigate, or act.
• Execute — carry out the response. Stepping in.
• Knowledge — the stable base feeding every step: what your systems are, what is normal, what threats exist.

Hold onto one distinction: events are fleeting (a single login, a packet), knowledge is stable (your asset inventory, your threat intelligence). You need the knowledge to interpret the events.

The vocabulary (know what each is)

• SOC (Security Operations Center) — the team and facility that watch continuously.
• CISO — the executive who owns information security.
• CSIRT / CERT — the incident-response team that acts when something serious happens.
• ISAC — a sector-wide group that shares threat information.
• IDS (Intrusion Detection System) — spots attacks and raises the alarm.
• IPS (Intrusion Prevention System) — also blocks them.
• DMZ (Demilitarised Zone) — a walled-off zone for public-facing servers, separated from the internal network.
• SIEM — centrally collects, correlates and alerts on data from across the network.
• SOAR — automates standard responses.
• CTI (Cyber Threat Intelligence) — knowledge about who is attacking and how.

Core resources

• CyBOK KA 8, section 1 — vocabulary, processes and the loop. (± 20 min)
• CyBOK SOIM webinar slides — the same ground, visually. (± 15 min)

Check yourself

1. Name the five parts of the MAPE-K loop and give a one-line example of each for a web application.
2. What is the difference between an IDS and an IPS?
3. Someone says "we bought a SIEM, so our security is handled." What is wrong with that statement?
4. What is the difference between a SOC, a SIEM, and SOIM?