Blue Team Concepts

The "Blue Team" protects organizations from cyber threats, risks, and attacks. Organizations hire Blue Teamers to watch over their networks, investigate cyber incidwents, perform recurring assessments of cyber risks, and helps the organization to keep its operationgs safe from cyber threats. This is also known as Computer Network Defense (CND).

Examples of Blue Team Jobs

• Security Operations Center (SOC) Analyst (Levels 1-4)
• Network Security Administrator/Engineer/Analyst
• Data Security Administrator/Engineer/Analyst
• Application Security Administrator/Engineer/Analyst
• Threat Intelligence Administrator/Engineer/Analyst
• Threat Hunter
Threat Response Analyst/Cybersecurity Analyst/Investigator/Finance Intelligence Analyst

There are great online resources like CyberSeek.org that desribe the types of jobs , career paths, and even lists number of open job positions posted.

Getting started on your Blue Team career path

Build a strong foundation of knowledge

Learn the OSI Model - The Open Systems Interconnection (OSI) model describes seven layers that computer systems use to communicate over a network. It was the first standard model for network communications, adopted by all major computer and telecommunication companies in the early 1980s. It is an ISO standard.

The modern Internet is not based on OSI, but on the simpler TCP/IP model. However, the OSI 7-layer model is still widely used, as it helps visualize and communicate how networks operate, and helps isolate and troubleshoot networking problems.

The seven (7) layers of the OSI model - A more detail explanation is here

• Layer 1 - Physical Layer - networking hardware
• Layer 2 - Data Link Layer - The strctured format of the data transiting the network
• Layer 3 - Network Layer - the physical path the data follows
• Layer 4 - Transport Layer - transmits data. e.g. TCP/IP and TCP/UDP protocols
• Layer 5 - Session Layer - maintains connections and is responsible for the individual sessions and ports
• Layer 6 - Presentation Layer - presents the data and is where data encryption is handled
• Layer 7 - Application Layer - human/computer interaction via applications

Learn the Basics of Networking
OSI Model in detail	Start
Computer Networking	Start
Types of networking protocols and their uses	Start
12 common network protocols explained	Start
Computer Networking Components	Start
Very nerdy, but strong nework addressing / routing knowledge gives you and advantage	Start

Blue Team Skills Development
Understanding Firewalls	Start
Network Defense Basics	Start
Virtualization	Start
Vulnerability Assessments	Start
Network troubleshooting	Start

As a beginner you must be familiar with basics of one or more of the following:

• Familiarity with the concepts of software applications, Security Information & Event Management (SIEM), Intrusion Detection and Prevention System (IDS & IPS) etc.
• Knowledge of the security approach across technologies, people, and tools.
• Technical hardening skills of all systems for decreasing the attack surface that perpetrators can exploit.
• Knowledge of attack and threat vectors or Analysis competence for correctly detecting critical threats and prioritizing responses appropriately.
• Ability to analyze logs to find potential intrusion and create playbooks (scripting knowledge) to automate defensive techniques