4

I am always confused between Prevention, Detection, Protection. Which one is before the another? I'd say Prevention --> Detection --> Protection. Is that valid?

  • 1
    You need to add more context. The order could be different from one context to another. I believe this is why you are sometimes confused :) – Ubaidah Nov 21 '16 at 17:43
  • Yes it's somewhat valid, but instead of "Protection" usually there's "Response". – Aria Nov 21 '16 at 18:44
  • 2
    "before" implies a natural sequence - are you sure they belong in a sequence? – schroeder Nov 21 '16 at 18:58
  • In this context, prevention and protection seem to be synonymous. If you prevent some type of attack you are protected against it. Similarly, if you have protections against an attack, you have prevented that type of attack. I guess you could argue that "protection" is slightly more general of a concept; e.g., detecting in-progress attack of some type that you previously hadn't fully prevented falls under the category of "protection", especially if your team can quickly respond to the newly detected attack and mitigate it. – dr jimbob Nov 21 '16 at 22:52
1

Generally, it's a circle, not a line.

Prevention means it stops before happening. But to stop it, you need Protection. To protect from something, you usually need to have the means to Detect it. And in order to detect it, you must know what to look for, which knowledge may be considered Prevention.

0

I re-read the question a few times and I'll give my take on the essence of the question. I read this as as - "What comes first - preventing an attack by way of firewalls, security patches etc; detecting attacks; or responding to attacks/incidents". If so, I'd say these are parallel concepts that don't really have a sequence. You don't wait for a break-in to fix a bad lock on a door. In the world of security, attacks, patches, detection of attacks, internal security testing, patches and fixes etc happen anachronously. The infrastructure for all of these should always be active and in place.

Now, if we were to talk about a specific attack or security incident (say, a DOS attack), you'd have measures in place to ensure the attack doesn't bring down the server or its performance, following which you'd detect the DOS attack as its happening or in a very recent past, followed by remediation techniques that could be termed as "protection", but its more of a "response" (as Aria pointed out).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.