Think Like a Defender — Defense Range

What does a defender do first?

Before fixing anything, a defender makes a short list. Three questions, every time.

📦

1. What am I protecting?

The valuable stuff. Your customers' names, your order list, your money, your password. These are your assets.

⚠️

2. What could go wrong?

The ways someone could steal, break, or peek at those assets. These are the threats.

🛡️

3. What will I do about it?

The fixes that close each threat. These are your defenses. You cannot fix everything at once, so you start with the worst.

That is threat modeling. List your assets, the threats to them, and the defenses. Real security teams do exactly this before they build anything. Now you try it on a real site.

Meet the wide-open site

Here is Mia's lemonade-stand website. It works, but a defender sees five problems right away. Look at the little notes under the page.

⚠️ not secure http://mias-lemonade.example

🍋

Mia's Lemonade Stand

🔎 The defender's first look

Five weaknesses, each tagged on the page. On the next screen you will fix them, worst first.

The password is 1234
The connection is plain, not scrambled
A secret is hidden in the browser
There is no backup of the order list
The page shares a home address

Mia's site uses a normal setup: your browser asks, her server answers. Every one of these problems is common on real sites, and every one has a known fix.

Lock the worst things first

Each risk is rated by impact. Open the high-impact ones first, read the fix, and apply it. Watch the security score climb as the site gets harder to break.

20 Wide open

Five risks open. Start with the red ones.

High impact (fix first) Medium Lower

Order matters. A defender spends their time where it counts most. A weak password and a plain connection are bigger holes than an oversharing menu, so those get fixed first.

You just thought like a defender

You did the real job: you listed the assets, named the threats, and applied a defense for each one, worst first. The site that started wide open is now hard to break.

🧠 The five fixes you made

Traded 1234 for a long, unpredictable password that beats guessing.
Turned on HTTPS so snoops on the network see only scrambled gibberish.
Moved the secret off the browser and onto the server, out of a visitor's reach.
Turned on backups, so a crash or a mistake does not erase the order list.
Stopped posting a home address, which also makes a trick harder to pull off.

The one habit: list what could go wrong, then fix the highest-impact problems first. You will never fix everything, and a good defender does not try to. They protect what matters most.