Derek Talbott Blog

Blogging this week about chapters 19–21 helped me understand the essential topics of incident response, disaster recovery, and post-incident analysis. I found it rewarding to transform these security concepts into practical examples from real-world security operations instead of simply repeating the text. The exercise reinforced my knowledge while helping me understand how these processes operate in my current workplace. The main difficulty during this assignment involved transforming extensive, detailed information into brief yet substantial content. The exercise directly matches my current work requirements because it requires me to explain security concepts to various groups of people. I plan to maintain my blogging practice after the class ends because it will serve as a tool for professional knowledge sharing and process documentation, as well as personal branding. The ability to simplify complex technical information makes me more valuable to employers because it demonstrates...

Throughout this Cloud Computing and Governance course, blogging gave me a chance to reflect on what I was learning from our reading and being able to connect it to real-world applications, especially some within my own job. While it sometimes took a little extra effort to think of unique perspectives for each week's topic, the process definitely helped reinforce my understanding of everything.  This skill is definitely useful in my current role, as the ability to clearly explain complex ideas is valuable in both technical and non-technical settings. I can see myself continuing to blog professionally in the future, whether for knowledge sharing, documentation, or company branding. For an employer, having someone who can communicate expertise in an approachable way adds value, not just as a technical resource but also as a voice that can represent the company’s thought leadership in the industry.  Thank you for taking the time and learning through this course with me. Until next...

This  week's reading of  Chapters 15–18 presents real-world cybersecurity execution, focusing on incident response and recovery, as well as  communication. The structured incident response planning approach stood out to me as the most important lesson from this week's material. A documented and practiced security plan reduces both the chaos of a security breach and the time needed for recovery and damage reduction. The chapters demonstrated that preparedness, together with coordinated efforts and clearly defined responsibilities, maintains equal importance to the tools and technology used for threat investigation. The preservation of evidence, together with lessons learned activities, were a crucial element in post-incident procedures. The process of cybersecurity maturity requires organizations to extend their incident response beyond immediate threat resolution through proper documentation and reporting. The chapters demonstrated how organizations can improve their defe...

Hello again, welcome to Week 9. The material from this week demonstrated that cloud performance and disaster planning require an active strategic approach for success. The main lesson I learned was how dashboards, logs, and alerts function together to provide complete visibility into cloud health. AWS CloudWatch and Azure Monitor tools serve beyond metric reporting because they enable automated responses, which both save time and minimize human mistakes. The concept of configuring alarms to trigger both technical threshold alerts and cost-saving actions, such as auto-scaling or unused resource shutdowns caught my attention. The main emphasis of the lesson focused on business continuity and disaster recovery. The presentation explained RTO (Recovery Time Objective) and RPO (Recovery Point Objective) concepts through straightforward definitions. The recovery models presented as cold and hot standby provided an effective method to understand the relationship between cost and recovery spee...

The analysis of cloud storage this week revealed multiple essential elements that determine the appropriate cloud storage solution. The selection of cloud storage depends on three main factors, which include storage capacity requirements and data accessibility needs, data importance levels, and data structure needs. File system storage functions properly for team document sharing, yet fails to handle extensive unstructured data at scale. Object storage stands out as the best solution because it provides scalability features along with built-in metadata and REST API support. The presentation showed that backup strategies operate differently within cloud environments. It explained that durability stands apart from backup methods because organizations must protect their data through full incremental and differential backup approaches. The 3-2-1 and 4-2-3 rules provided essential guidance for organizations to protect their critical information. The module delivered valuable insights about ...

T he essential role of automation and continuous monitoring in enhancing cybersecurity posture was the main topics in this week's reading. The tools SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response), according to Chapter 14, help organizations streamline their threat detection and incident response processes. The tools stand out because they improve operational efficiency and decrease human mistakes particularly during intense security incidents. The fast pace of threat evolution makes manual security processes no longer sufficient for protecting against modern cyber threats. The main lesson shows that automation serves to strengthen human analysts rather than replace them. These systems enable cybersecurity teams to concentrate on advanced threats and strategic defense planning by eliminating false positives and performing regular tasks. The future of cybersecurity requires advanced technology to work in harmony with skill...

The emphasis on Identity and Access Management (IAM) this week demonstrates its essential role for achieving successful cloud deployment. The transition from perimeter-based security to identity-centric security within hybrid cloud environments became a key concept that caught my attention. The need to verify user identities has surpassed location-based verification because users now access services through various devices and locations. The implementation of Multi-Factor Authentication (MFA) together with certificate-based login and federated identities has become essential for modern security standards. I also gained a deeper appreciation for account lifecycle management. The process of creating accounts requires ongoing access reviews, user deactivation, and prevention of escalating privileges. The IAM features of AWS, Azure and GCP are extensive, but administrators must implement best practices including least privilege access and enforce robust password requirements. Organizations...

 This week’s content from Chapter 13 of the CompTIA CySA+ Cybersecurity Analyst Certification All-In-One Guide focused on the critical topic of incident response and recovery , a core component of cybersecurity operations.  Organizations need to shift away from reactive approaches by implementing structured incident response plans (IRPs) which consist of preparation, detection, containment, eradication, recovery, and lessons learned. The incident response phases enable organizations to respond quickly to security incidents while identifying and fixing the root causes to stop future occurrences. The importance of documentation and communication stands out to me because these elements don't receive a whole lot of information. Organizations need to establish clear reporting channels, define team roles, and conduct post-incident analysis to build a stronger security posture. The chapter confirms that organizations need both proper tools, trained personnel, and established respons...

This week’s chapters, 11 & 12, focused on detecting cyber threats through the analysis of system-collected data. The collection of logs and alerts is not good enough because organizations need to establish network baseline data to identify any abnormal activities. Security Information and Event Management (SIEM) and packet sniffers enable system monitoring, but users must conduct thorough analysis to determine important information.  Chapter 12 shows how threat intelligence enables organizations to anticipate hacker activities. The process of threat identification relies on analyzing unusual files and login patterns to determine the nature of the threat. The approach involves both attack reaction and proactive threat preparation through the analysis of trends and cybercriminals' operational patterns. The main lesson from this week was that data collection becomes effective only when organizations understand how to interpret and defend their systems with the gathered information...

  This week's reading and PowerPoint showed how complex it is to protect cloud environments. The shared responsibility model stands out as a key concept because it shows that CSPs protect infrastructure but customers must protect their data, identities, and configure their systems properly. The distinction between cloud security responsibilities becomes essential when dealing with shadow IT, inside misuse, and misconfigured services. The concept of defense-in-depth in cloud environments also seemed as a big piece of this weeks studies. Organizations need to implement multiple security controls which extend from networks to instances and data to achieve proper protections. Organizations can protect their workloads through microsegmentation and DevSecOps by implementing these techniques during the development stages. The standardization of cloud security through CASBs and cloud-native firewalls enables unified policy enforcement and visibility across AWS, Azure, and GCP platforms in ...

The main lesson from this week's material showed that cybersecurity requires both knowledge and readiness to execute actions swiftly and effectively. The importance of preparation stood out most to me in Chapter 9 because it stressed the need for creating incident response tools before incidents occur. The pre-built incident response toolkit consists of more than software because it includes strategic resources, which include forensic tools together with log collectors, and hardware for secure analysis environments. A team with excellent training becomes ineffective when time becomes critical because they lack this essential resource. The decisions made during an incident either help to contain threats or unintentionally make them worse, from what I learned in Chapter 10. The chapter talked about how organizations should evaluate incident severity while determining notification procedures and selecting between complete containment and targeted isolation methods. A well-prepared res...

This week's emphasis was on hybrid and multi-cloud networking, showing how modern cloud systems require complex infrastructure designs that need secure and resilient connections. The use of VPNs and direct connections was also a key concept during this week's reading and PowerPoint presentation. VPNs provide affordable encryption solutions for public networks which suits the requirements of small-scale operations and remote access needs. Enterprises handling large volumes of traffic and latency-dependent workloads should use AWS Direct Connect or Azure ExpressRoute through multiple location facilities because these services deliver reliable, high-performance connections. The direct options provide organizations with superior control over bandwidth and availability. The main lesson from this week was the difference between VLANs and VXLANs. The scalability of VLANs is limited because they function as traffic segmentation tools for security and efficiency purposes. VXLANs solve t...

This week's presentation, labeled Cloud+ Module 4, provided some extensive information about how cloud networking transforms traditional infrastructure through SDN (Software-Defined Networking) and NFV (Network Functions Virtualization) technologies. The main point that caught my attention was the different methods cloud providers AWS, Azure, and GCP use to segment and route their networks. AWS VPCs maintain strict regional and availability zone boundaries, but GCP VPCs provide worldwide regional coverage, which benefits distributed applications. The main lesson learned was the transition from hardware-based network management to logical configuration methods. Virtual operations allow users to create subnets and assign IP addresses using CIDR and manage route tables. The cloud benefits from these concepts because they enable scalability, redundancy, and security operations that do not require physical server access. The cloud stack uses OSI/TCP-IP models as its foundation, but modi...

 The detection of threats at their early stages depends on continuous monitoring of endpoints, networks, and email systems. The 8th chapter this week talks about how organizations can achieve real-time systems visibility through the implementation of SIEM (Security Information and Event Management) and EDR (Endpoint Detection and Response) tools. These tools collect logs and detect irregularities while performing automated response procedures. The exploitation of email continues to be one of the most common attack methods, so organizations must actively monitor for phishing attempts, malicious attachments, and unusual login behaviors. The identification of malicious activity depends heavily on data analytics through pattern recognition. Security teams can identify potential threats at an early stage by performing scheduled data analysis reviews, which examine login times, IP ranges, and unusual user behavior. The review process enables incident response while simultaneously enhanci...

T his weeks powerpoint information about cloud migration demonstrated that successful migration requires complex strategic planning. The process of data relocation from point A to point B requires detailed planning, evaluation, and continuous communication throughout the entire process. The most significant insight for me was the phased approach to migration, which requires multiple revisits because needs change, technologies advance, and cloud offerings transform. The documentation process stands as a crucial element because it requires organizations to record baseline performance data along with system dependencies, legal requirements, and temporary service desk hour modifications. The small details in the migration process determine whether the transition will succeed or fail. The different migration strategies, including rehosting, replatforming, and refactoring, became important concepts for me to understand. The different business requirements require unique approaches because th...

Welcome to my IT blog, which you can find here. I am Derek Talbott. I have spent multiple years in the IT field. I am studying Information Technology at Bellevue while working in the field, which allows me to combine academic knowledge with practical experience. Cloud Computing and Governance immediately drew my attention because cloud solutions have transitioned from future IT concepts to become the current reality. I have directly observed businesses transition from traditional infrastructure to cloud-based environments through my current position, and I have participated in discussions about cloud migration, hybrid networks, and remote access security. My experience with cloud governance remains limited because I have not yet gained sufficient knowledge about policy creation, compliance standards, and large-scale cloud operation management. I am eager to learn about this subject matter throughout this course. I will document my learning process through this blog by discussing weekl...

The readings from this week demonstrate that vulnerability management requires more than scanning activities because it demands an organizational strategy to detect and evaluate risks according to specific business requirements.  Chapter 5 demonstrated that maintaining an accurate and up-to-date asset inventory stands as a fundamental requirement for organizations. The protection of assets becomes impossible without knowing what assets exist. The continuous execution of vulnerability scanning together with strong patch management practices stood out to me as the most important aspect. The chapter demonstrated that unfiltered scan results lack accuracy, so analysts need both technical and critical thinking abilities to distinguish between actual threats and false positives. Chapter 7 talked about incident response and forensic readiness as essential components. The main lesson I learned was that vulnerability scanning exists to help organizations prepare for potential security incid...

 This week’s lesson on virtualization really emphasized how foundational virtual hardware is to cloud computing. One key takeaway for me was how hypervisors, especially Type 1, allow multiple virtual machines to operate efficiently on a single physical server. This setup not only saves on hardware costs but also improves scalability and flexibility, which are critical in cloud environments. Understanding vCPU sizing, memory overcommitment, and storage allocation also gave me insight into how IT teams balance performance with resource availability. I also found the comparison between traditional virtual machines and alternatives like containers and serverless computing really eye-opening. Containers offer a lightweight and portable solution for running applications, while serverless computing shifts the burden of infrastructure management entirely to the cloud provider. These approaches help reduce overhead and can make application deployment much more efficient. Overall, this week...

 This week’s readings really emphasized how foundational agreements and proactive analysis are to a strong cybersecurity posture. One key takeaway for me came from the deep dive into Service Level Agreements (SLAs) . SLAs are more than just technical checklists, they are legal and operational frameworks that define accountability, especially when it comes to security. In an environment where companies outsource critical infrastructure to third-party vendors, clearly defined SLAs are what ensure providers deliver not just uptime, but compliance with security protocols like data encryption, vulnerability patching timelines, and incident response commitments. From Chapter 4, I found the section on threat intelligence particularly compelling. The idea that cybersecurity is not just reactive but also predictive stood out. Gathering, analyzing, and applying threat intelligence helps organizations stay ahead of attackers. Whether it’s understanding threat actor motives or identifying in...

Hello and welcome to my first entry in what I hope becomes a valuable space for sharing insights, experiences, and lessons learned in the world of cybersecurity, system hardening, and network risk management. My name is Derek Talbott, and I am currently the Site IT Manager at Michelin in Junction City, Kansas. With over a decade of hands-on experience in IT, ranging from systems administration and Active Directory management to executing cybersecurity compliance rules across global infrastructures, I’ve learned just how critical strong security practices are in maintaining operational stability. Before transitioning into the civilian IT world, I served in the U.S. Army as a 15N Avionics Mechanic, 15F Aircraft Electrician, and 25B Information Technology Specialist. Those years taught me how to stay calm under pressure, lead by example, and treat every piece of technology as mission-critical, skills that continue to guide my approach to IT security today. I’m currently wrapping up my ...