Structuring Chaos: A Security Analyst’s Guide to Data Structures and Algorithms

 As a grey-bearded security guy who spends most days managing endpoint detection and response (EDR) platforms like SentinelOne and CrowdStrike for Optiv, stepping back into software engineering requires a fundamental shift in perspective. To any newbie starting out in Java, applying algorithmic design and data structures is not just about making code work; it is about making it survive at scale. You are architecting the physical memory layout and the mathematical rules the computer must follow to interact with that memory. 

There is no single "best" data structure or algorithm; there are only strategic trade-offs evaluated through Big-O notation. Big-O is how we measure algorithmic efficiency—specifically time and space complexity—which dictates how a program will behave when a dataset grows from ten items to ten million. In a Security Operations Center (SOC), an inefficient algorithm scaling at O(n^2) will crash the dashboard when parsing terabytes of telemetry, while an efficient algorithm scaling at O(log n) will isolate the threat in milliseconds.

Choosing one design over another depends entirely on the mission. If I need to rapidly ingest and drop massive amounts of unpredictable network traffic logs without memory reallocation bottlenecks, I will utilize a Linked List. Because it dynamically allocates non-contiguous memory using pointers, insertions and deletions are lightning-fast (O(1) operations). However, if my primary goal is rapid threat hunting against a massive database of known malicious file hashes, a Linked List is useless because it forces a slow, linear search. Instead, I would store that data in a pre-sorted array and apply a Binary Search algorithm. By repeatedly halving the search space, Binary Search achieves O(log n) efficiency, finding a match almost instantly.

When data is inherently relational or hierarchical, flat linear structures fail entirely. That is when I apply Tree structures. In my recent Java coursework, I mapped out a hierarchy of car makes, but in my daily operations, this exact structure models malware execution chains. A parent process (the root node) spawning malicious child processes (sub-nodes) can be rapidly analyzed using Depth-First or Breadth-First traversal algorithms to map the entire blast radius of a ransomware attack.

Ultimately, applying these techniques means analyzing the physical constraints of the problem before writing a single line of code. By understanding how data behaves in memory and measuring algorithmic efficiency with Big-O notation, you stop writing scripts that just function and start engineering resilient systems capable of handling enterprise-grade chaos.

Demystifying Java and OOP: A Security Analyst's Return to Coding

 As someone who spends most of my days managing endpoint security platforms like SentinelOne and Microsoft Defender for Optiv, I am used to looking at software from the outside in. My job involves hunting for vulnerabilities, tracking behavioral anomalies, and locking down systems. I actually first learned Java about 18 years ago, but stepping back over to the development side to pick it up again makes this grey-bearded security guy feel like the new kid in class all over again.

If you are taking your first steps into programming or knocking the rust off after a long hiatus like I am, I want to share my perspective on getting your environment set up and wrapping your head around the core concepts.

Getting your machine ready to write Java requires a specific environmental setup. You need to download the Java Development Kit (JDK), which acts as the underlying engine that compiles and runs your code. You will also want an Integrated Development Environment (IDE), which serves as your digital workbench, highlighting syntax errors and keeping your files organized. This time around, I decided to use Apache NetBeans as my IDE. Instead of getting bogged down in the granular installation steps here, I highly recommend checking out the official Oracle Java Tutorials or the NetBeans Quick Start Guide. Those resources walked me right through to getting my first "Hello, World!" program running on my screen.

Once your environment is humming, the real challenge is understanding the mindset behind the language. Java is built entirely on Object-Oriented Programming (OOP). When people first start coding, they usually imagine writing a massive, top-to-bottom list of instructions for the computer to execute in chronological order. OOP throws that out the window. Instead, it asks you to build your software by modeling it after real-world items (Oracle, 2024).

To understand OOP, you need to grasp a few foundational principles:

• Classes and Objects: Think of a Class as a blueprint, and an Object as the actual house built from that blueprint. If you are building a program to manage a multi-pet household, you might create a Cat class. This blueprint defines what a cat has (a name, an age, a coat type) and what it does (meows, eats, sleeps). When you use that blueprint in your code to create a specific 5-year-old longhair, that specific cat is the Object (Sierra, Bates, & Robson, 2021).

• Encapsulation: Coming from a managed security services background, this is my favorite principle. Encapsulation is all about protecting data by hiding the internal mechanics of your object from the outside world. Just like you don't need to understand a car's fuel injection system to drive it—you just press the gas pedal—encapsulation ensures that other parts of your program can interact with an object without accidentally breaking its internal state (Sierra et al., 2021).

• Inheritance: This principle is all about efficiency and reusing your work. If you already have a well-written Animal class that includes basic behaviors like eating and sleeping, your new Cat class can simply inherit those traits (Oracle, 2024). You don't have to rewrite the code from scratch; you just attach the feline-specific details to the existing foundation.

• Polymorphism: This simply means "many forms." It allows different objects to be treated as instances of the same class through a shared interface. If you issue a makeNoise() command in your code, a Dog object will bark and a Cat object will meow. The system doesn't need to know exactly what animal it is talking to; it just issues the command, and the specific object knows exactly how to execute its own version of that action (Sierra et al., 2021).

Transitioning from reading technical logs to writing object-oriented code requires a mental shift, but breaking the world down into interacting objects makes complex systems incredibly manageable. Whether you are aiming to build applications or just trying to understand the fundamental architecture of the systems you are defending, mastering OOP is the key to unlocking how modern software operates.

Further Reading & References

If you want to dive deeper into these concepts, here are a few resources that are incredibly helpful for newcomers and returning programmers alike:

• Apache Software Foundation. (n.d.). NetBeans Java Quick Start Tutorial. Retrieved from https://netbeans.apache.org/tutorial/main/kb/docs/java/quickstart/ (A great step-by-step guide if you decide to use the same IDE I am currently using).

• Oracle. (2024). The Java Tutorials: Object-Oriented Programming Concepts. Retrieved from https://docs.oracle.com/javase/tutorial/java/concepts/ (The official, foundational documentation straight from the source).

• Sierra, K., Bates, B., & Robson, E. (2021). Head First Java (3rd ed.). O'Reilly Media. (An excellent, highly visual book that breaks down complex OOP concepts into easily digestible, real-world examples).

 

My final post of this class was an introduction to EDR and Endpoint Security. EDR stands for Endpoint Detection and Response. There is also a component of Endpoint Security referred to as NGAV or Next-Generation Antivirus. Both are required now to have the greatest chance of preventing infections and breaches. What is the difference between the two and how do they work together to help mitigate threats to your computer?

            “NGAV is the prevention component of endpoint security, which aims to stop cyber threats from entering a network.” (Aarness, 2025) EDR detects activity that circumvents NGAV and allows teams to contain the threat, hopefully before it can move laterally in the environment. (Aarness, 2025) You can think of NGAV as the first line of defense in your arsenal against cyber threats. While EDR is next in line to help contain anything that gets by the first line. Because EDR gathers all the activity surrounding a potential threat, it is valuable data even if it fails to contain the threat. This data can be used to determine what the threat actor actually did and what they gained access to.

            I work as part of the managed endpoint protection security team for a large computer security firm. I have been doing this for 14 years. What is managed endpoint protection? It is the outsourcing of endpoint protection. This covers laptops, desktops, servers and even mobile devices. (SentinelOne, 2025)

            Why would you outsource such an important part of your computer security? Mainly because of a few things. The first being the rising endpoint threat complexity. But this can be covered by a good EDR and NGAV solution. More importantly, there is limited in-house security expertise and around-the-clock monitoring. (SentinelOne, 2025) Today, it is quite hard to staff a full security staff with the knowledge needed to detect and combat cyber threats. Not even considering trying to staff one 24/7/365. Additionally, compared to staffing your own internal SOC (Security Operations Center) it is quite cost effective. If you must deal with any government regulations such as HIPAA, PCI DSS or GDPR, these companies should be equipped to help you deal with the cyber security side of remaining compliant.

Because these new EDR tools upload pretty much everything that an endpoint does to their respective clouds, it often requires outside tools to analyze all the data. A common technique is to export all the data for a given period when searching for a threat or breach. Then importing this data into Excel and then using the data tools in Excel to sort and analyze the data.

Additionally, you may find that if you have extensive knowledge of a scripting language, such as Python, that it may be easier to implement a script to go through the data. Many threat analysts write their own tools in Python to analyze EDR data. This speeds up their analysis and provides a more comprehensive result, especially when looking at a potential breach.

Keeping track of all of this data requires a very large database and extensive database management. Our largest databases are used for what we call MDR. Which is similar to EDR but ingests data from multiple sources, not just the Endpoint. We use Google SecOps for this. We ingest data from all sources such as the endpoint, Office 365 and Azure AD. This cloud-based database acts as a very large SIEM and correlates data among the different feeds to find potential risks and threats.

What is Google SecOps? It is a cloud service that is designed to retain, analyze and search the large amounts of security and network data that is generated by today’s tools. (Google, 2025) “The Google SecOps platform enables security analysts to analyze and mitigate a security threat throughout its lifecycle.” (Google, 2025)

Works Cited

Aarness, A. (2025, January 7). EDR vs NGAV. Retrieved from Crowdstrike: https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/edr-vs-ngav/

Google. (2025). Google SecOps overview. Retrieved from cloud.google.com: https://cloud.google.com/chronicle/docs/secops/secops-overview

SentinelOne. (2025, June 15). What is Managed Endpoint Protection? Retrieved from SentinelOne: https://www.sentinelone.com/cybersecurity-101/endpoint-security/managed-endpoint-protection/

 

 

• How to effectively integrate AI tools into your blogging process to produce high-quality, engaging, and accurate content? 

You can use AI tools such as CoPilot and ChatGPT to help you in your blogging process. It really comes down to how well you craft the prompt. The prompt is the phrase or sentence that you use to get information from an A.I. system. Spend quality time crafting your prompt to get the best results. The more generic your prompt the more generic and worse the A.I. will do. Be specific. The more specific and targeted you can make your prompt, the better chance that you will receive good, quality responses.

• How to ensure the content maintains your brand voice and consistency?

No A.I. system, at this time, can truly duplicate the tone and voice of a human writer. It can attempt to mimic it but it generally sounds like it came from an A.I.. You should spend time editing the response to make it sound like you. This way you can make sure to match your tone and voice. It can be a great tool but it isn’t going to do all the work. Editing the content created is essential to maintain your voice.

• How to double-check all facts, statistics, and references for accuracy to avoid spreading false information?

Once again, editing is your friend. An A.I. is only as good as the data it gathers. This may be old, stagnant or even wrong in some cases. You should spend time thoroughly going over any data that the A.I. generated for accuracy and truthfulness.

• How to be vigilant to maintain equality and fairness?

In actions such as this, an A.I. tool can really shine. You could use it to go over your content for inclusivity and fairness. Especially if you’re unsure, your own content should be checked for this.

 I work in the computer security industry. This entire enterprise focuses on computers and how they work. We not only provide protection to networks and endpoints but also use computers ourselves. An endpoint is any device that connects to a network but isn’t a network device such as a switch or router. It is easiest to think of an endpoint as a personal computer or server but mobile devices can also be endpoints. Without computer literacy, you can’t operate effectively in this industry. It is simply not possible. You may not need to know the inner workings of a computer but you do need to know how to operate office applications, web browsers, operating systems and basic networking.

Artificial intelligence is rapidly changing how this industry operates. For example, endpoint protection products such as SentinelOne and Crowdstrike make liberal use of A.I. to detect potential threats. As A.I. becomes smarter and more wildly used, I envision it will transform networking as well. Firewalls, routers and switches will become even smarter. Firewalls will adapt to incoming threats in real time without needing interactions from real people. Routers and switches will monitor traffic and make changes in how packets are sent and moved throughout the network to reduce trip time and network congestion.

On the flip side, bad actors will start to use A.I. to attack systems. They’ll be able to modify tactics such as ports attacked and network packets on the fly in order to break into systems. Only by using A.I. in defense will we be able to respond quick enough to prevent breaches.

 PART 1: 

 

PART 2: 

PART 3: 

I have a caching problem. At least with some websites commonly used such as google.com. My ping results to common websites are good while trace routes are too quick as it is cached in the nearest router owned by AT&T.

Ping is a good tool to use to test if a website or network location is up and available. It measures total time for response from the location and any dropped packets. While trace route shows the path that a packet takes through the network. It can be used to troubleshoot a problem reaching a particular site that you know is up but are unable to reach. For example, one time we were having some sort of network issue and couldn't access most websites. Our pings out using IP addresses were good showing the network was working but we were unable to pull up websites. So we moved to trace routes. This showed a problem reaching our external DNS server. The hop before the server was consistently timing out. It turned out that the switch used had went bad and was causing outages all over.

 

The assignment for Week 2 of my course had us look at various Office applications. We put the same data into Word, Excel and PowerPoint. I am going to look at each application and show that the best one for this assignment is Word.

A word processor is used for writing documents. It’s main function is that of a typewriter with added benefits. It has the ability to change fonts, size of text, show images and provide references. It can set things up for printing such as mailers. It can display and print things such as tables and spreadsheets but this is not its forte.

            A spreadsheet is “a computer program that allows the entry, calculation, and storage of data in columns and rows.” (Merriam-Webster, nd, SPREADSHEET Definition & Meaning - Merriam-Webster). This is where it excels. The modern spreadsheet application can be used to store the written word much like a word processor but it lacks some of the same features and it’s row/column setup will cause difficulties.

            A presentation application, such as PowerPoint, works best as a method of presenting data for others to view in a meeting. It can display text and images and even parts of spreadsheets. It does not perform calculations like a spreadsheet nor is it best used in place of a word processor. It is broken down into slides for presentation. Each slide should be prepared with concise and pertinent information.

            A database is “a usually large collection of data organized especially for rapid search and retrieval.” (Merriam-Webster, nd, DATABASE Definition & Meaning - Merriam-Webster). It is mainly used to store data so that the data can be used by other applications. It is best at storing and retrieving data. It can perform calculations on data but this limited to the type of data and database. It can store documents such as word processing documents or spreadsheets but it cannot generate them.

            Why is Microsoft Word the best application for presenting the data in this assignment? Because it has basic functionality of the other two applications. Plus it can display a large amount of text and format it for the best viewing of the audience. It can display tables or even entire spreadsheets. It can also format text in such a way that you can display it in a meeting. While it will only perform basic calculations on the cells in a table, its ability to display an entire spreadsheet makes up for it.

            Anytime that you need to display a large amount of text, images or different pages in a spreadsheet, Word would excel. Authoring a scholarly journal would be an excellent use Word as it will display the text and images needed as well as preparing the reference page. If you need to present different pages of a spreadsheet in one document for others to go over such as a report, it will also function admirably. It is not as good at making presentations as PowerPoint but it is capable of displaying text in the same manner and adding images and video. It can double by selecting each page in a document as a slide.