By Samyuktha
Introduction
It's easy to think of security as a purely preventive discipline — block the attack, close the hole, stop the bad request before it lands. But prevention is only half the story. A genuinely secure system also has to notice when something suspicious does happen, and it has to keep behaving safely even when things go wrong in ways nobody planned for. That's the territory A09 and A10 cover, and it's a different kind of thinking than the categories I've written about so far in this series.
A09: Security Logging and Alerting Failures asks:
Can we see and respond when something suspicious happens?
