---
title: "Research · 8 Defensive Operations & Governance · VORNAC"
description: "Blue-team operations, the security-product landscape, and compliance posture. 6 curated notes across featured, reference, and background tiers."
url: https://www.vornac.com/en/research/defensive-ops
lang: en
published: 2026-06-02
updated: 2026-06-02
alternate_de: https://www.vornac.com/research/defensive-ops
---

[Research Index](https://www.vornac.com/en/research) / 8 · Defensive Operations & Governance

VORNAC RESEARCH

8

# Defensive Operations & Governance.

Blue-team operations, the security-product landscape, and compliance posture.

6

Notes in this domain

0

Featured

4

Reference

2

Background

Reference

Reference

### [SIEM Architecture — Reference](https://www.vornac.com/en/research/defensive-ops/siem-architecture)

Reference architecture for a working SIEM: ingestion, normalization, detection layer, response loop — with the cost and quality trade-offs at each junction.

ReportingRecon

Reference

### [SSL/TLS Threat Model](https://www.vornac.com/en/research/defensive-ops/ssl-tls-threat-model)

TLS attack surface organized by ceremony stage: handshake, certificate path, cipher choice, record layer — with the deprecation and mitigation timeline.

Reference

### [DDoS Defense — Reference](https://www.vornac.com/en/research/defensive-ops/ddos-defense-reference)

DDoS attack-class taxonomy with the corresponding mitigation layers — anycast, scrubbing, app-layer rate logic.

Reference

### [Host & Network Hardening](https://www.vornac.com/en/research/defensive-ops/host-and-network-hardening)

Linux operator hardening, TCP/IP operational notes for detection engineers, AD defense from the defender's perspective, and data-center host hardening where physical access intersects vendor patches.

Reporting

Background

-   [Perimeter, Office & Database Security](https://www.vornac.com/en/research/defensive-ops/perimeter-and-database-security)

    What changes at the perimeter, the realities of office network hardening (BYOD, printers, guest segmentation), and database security beyond SQL injection — replication, backup, encryption-at-rest.

    Reporting · Known CVEs

-   [Compliance, Risk & Information Security Landscape](https://www.vornac.com/en/research/defensive-ops/compliance-and-governance)

    Cross-walk between common control frameworks, the reference architecture for an in-house risk-control platform, and the field-level orientation map of the discipline.

    —

[Previous domain 7 · AI, Data & Emerging Risk](https://www.vornac.com/en/research/ai-emerging) [All eight domains](https://www.vornac.com/en/research)

From reference to evidence

## Validate these gaps in your own environment.