Defence
Lessons filed under Defence.
Baselines: writing down what normal is You cannot notice a change if you never wrote down what normal was.
File integrity: noticing a change A hash turns a whole file into one short line, and that line is enough to tell you it changed.
Reading logs for a story A log is a list of events, and a list of events is a story once you put it in order.
Alerting on your own device Detection you have to remember to perform is detection you will forget, so make the phone tell you.
Incident response, in six steps When something looks wrong, a calm order of steps beats a rush, and the last step is the one most people skip.