I am always confused between Prevention, Detection, Protection. Which one is before the another? I'd say Prevention --> Detection --> Protection. Is that valid?
Generally, it's a circle, not a line.
Prevention means it stops before happening. But to stop it, you need Protection. To protect from something, you usually need to have the means to Detect it. And in order to detect it, you must know what to look for, which knowledge may be considered Prevention.
I re-read the question a few times and I'll give my take on the essence of the question. I read this as as - "What comes first - preventing an attack by way of firewalls, security patches etc; detecting attacks; or responding to attacks/incidents". If so, I'd say these are parallel concepts that don't really have a sequence. You don't wait for a break-in to fix a bad lock on a door. In the world of security, attacks, patches, detection of attacks, internal security testing, patches and fixes etc happen anachronously. The infrastructure for all of these should always be active and in place.
Now, if we were to talk about a specific attack or security incident (say, a DOS attack), you'd have measures in place to ensure the attack doesn't bring down the server or its performance, following which you'd detect the DOS attack as its happening or in a very recent past, followed by remediation techniques that could be termed as "protection", but its more of a "response" (as Aria pointed out).