CENTC cheat sheet
CENTC · Keep the key ideas within reach.
Network Security Concepts and Fundamentals
CIA triad: Confidentiality (encryption, access control), Integrity (hashing, digital signatures), Availability (redundancy, DDoS mitigation).
Least privilege: each subject receives only the minimum rights needed for its function; separation of duties prevents one identity from completing a sensitive transaction alone.
Defense in depth layers controls so failure of one layer does not compromise the asset; no single control is trusted as sole protection.
Authentication verifies identity; authorization determines permitted actions; accounting/auditing records actions - the AAA model.
Symmetric ciphers (AES) are fast and use one shared key; asymmetric ciphers (RSA, ECC) solve key distribution but are far slower.
Hashing (SHA-256) is one-way and collision-resistant; HMAC adds a shared secret to a hash to provide integrity plus authenticity.
Risk = Threat x Vulnerability x Impact; a threat exploits a vulnerability, producing impact on an asset.
Non-repudiation is provided by digital signatures using the sender's private key, verifiable with the public key.
OSI layers: Physical, Data Link, Network, Transport, Session, Presentation, Application; TCP/IP maps to Link, Internet, Transport, Application.
Network Security Threats and Vulnerabilities
Spoofing (IP, ARP, DNS) falsifies source identity; mitigations include ingress/egress filtering, DHCP snooping, and DNSSEC.
On-path (MITM) attacks intercept and may alter traffic; TLS with certificate validation and HSTS detect or prevent them.
Phishing, spear phishing, and whaling are social-engineering vectors; DMARC, SPF, and DKIM reduce email spoofing success.
DDoS categories: volumetric (bandwidth), protocol/state-exhaustion (SYN flood), and application-layer (HTTP flood).
SQL injection and XSS exploit unvalidated input; parameterized queries and output encoding are structural mitigations.
Malware classes: virus (needs host), worm (self-propagating), trojan (disguised), ransomware (encrypts for extortion), rootkit (hides).
Zero-day exploits target unknown vulnerabilities; signature-based detection fails, so behavioral/anomaly analysis is required.
Privilege escalation moves from low to high rights; lateral movement spreads an intruder across hosts after initial access.
Network Security Architecture and Design
DMZ (screened subnet) hosts externally reachable services between two firewalls, isolating them from the internal network.
Segmentation limits blast radius; VLANs separate broadcast domains but require ACLs or firewalls for enforcement between them.
Zero Trust removes implicit trust based on network location; every request is authenticated and authorized per session.
802.1X port-based access control uses a supplicant, authenticator (switch), and authentication server (RADIUS) via EAP.
IPsec: AH provides integrity/authentication only; ESP provides confidentiality plus integrity; transport mode protects payload, tunnel mode protects the whole packet.
VPN types: site-to-site (gateway-to-gateway), remote-access (client-to-gateway); split tunneling exposes traffic outside the tunnel.
High availability uses redundancy (active/active or active/passive) with failover to remove single points of failure.
Microsegmentation applies per-workload policy, often in software-defined networking, rather than relying on perimeter controls.
Network Security Implementation and Operations
Stateful firewalls track connection state; stateless ACLs filter per packet using addresses, ports, and protocol.
NGFW adds application identification, IPS, and user awareness to traditional stateful filtering.
IDS is passive and alerts; IPS is inline and can block. Signature detection matches known patterns; anomaly detection baselines normal behavior.
WPA2 uses AES-CCMP with 802.1X (Enterprise) or PSK (Personal); WPA3 adds SAE to resist offline dictionary attacks.
TLS 1.2/1.3 protect data in transit; certificate pinning and proper chain validation prevent interception.
Patch and configuration management reduce exploitable surface; baselines and hardening standards define approved states.
NAT translates addresses (SNAT/DNAT/PAT); it is not a security control but can obscure internal topology.
Change management requires documented approval, testing, and rollback; emergency changes are logged and reviewed after the fact.
Network Security Monitoring and Incident Response
Log sources: firewalls, IDS/IPS, endpoints, authentication servers, DNS, and proxies; centralized via SIEM for correlation.
NIST IR phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.
Indicators of compromise include unusual outbound traffic, anomalous authentication, new admin accounts, and unexpected file changes.
Chain of custody documents evidence handling; order of volatility: memory/registers, then disk, then remote logs.
Alert triage prioritizes by severity, asset criticality, and confidence; false positives are tuned, not ignored.
MTTD (mean time to detect) and MTTR (mean time to respond) measure IR effectiveness.
Forensic imaging uses write blockers and hashing to preserve integrity of acquired evidence.
Containment options: isolate host from network, disable account, block indicator at perimeter; eradication removes root cause before recovery.
Network Security Governance, Risk, and Compliance
Frameworks: ISO/IEC 27001 (ISMS requirements), NIST CSF (Identify, Protect, Detect, Respond, Recover), CIS Controls (prioritized safeguards).
Risk treatment options: mitigate, transfer (insurance), avoid, accept; residual risk is what remains after controls.
Qualitative risk uses ordinal scales; quantitative risk uses asset value, exposure factor, and annualized loss expectancy.
SLE = Asset Value x Exposure Factor; ALE = SLE x Annualized Rate of Occurrence.
Regulations: GDPR (EU personal data), HIPAA (US health), PCI DSS (card data), SOX (financial reporting controls).
Policies are management intent; standards are mandatory specifics; procedures are step-by-step; guidelines are recommendations.
Audit evidence includes logs, configurations, and access reviews; least-privilege and periodic recertification support compliance.
Business continuity (sustains operations) differs from disaster recovery (restores after disruption); RTO and RPO define recovery targets.
Network Security Concepts and Fundamentals
Encryption at rest protects stored data; encryption in transit protects data on the wire; both are needed for full confidentiality.
Digital certificate binds a public key to an identity and is signed by a certificate authority; trust chains to a root CA.
Symmetric key distribution problem is solved by key exchange (e.g., Diffie-Hellman) or asymmetric wrapping.
Access control models: DAC (owner discretion), MAC (labels/clearances), RBAC (roles), ABAC (attributes).
AAA protocols: RADIUS and TACACS+ centralize authentication, authorization, and accounting for network devices.
A vulnerability is a weakness; an exploit is the method that leverages it; a threat actor is the entity that may exploit it.
Network Security Threats and Vulnerabilities
Reconnaissance precedes attack: port scanning, banner grabbing, and OSINT gather target information.
Session hijacking steals an active session token; mitigations include TLS, short session lifetimes, and token binding.
Buffer overflow exploits unchecked input length; mitigations include bounds checking, ASLR, and DEP.
Insider threats bypass perimeter controls; monitoring, least privilege, and separation of duties reduce exposure.
Supply-chain risk arises from compromised vendors, firmware, or dependencies; verify provenance and integrity.
Social engineering exploits human trust; verification procedures and awareness training reduce susceptibility.
Network Security Architecture and Design
Network tiers: core, distribution, access; security zones group assets by trust level and enforce policy at boundaries.
Bastion host is a hardened, monitored jump point for administrative access to protected segments.
Honeypots/honeynets attract and observe attackers; they are decoys, not production controls.
Wireless design: separate guest SSID, WPA3 or WPA2-Enterprise, and rogue AP detection.
Cloud shared-responsibility model: provider secures the cloud infrastructure; customer secures data, identities, and configurations.
Redundancy and diversity (multiple paths, vendors) reduce correlated failure in HA designs.
Network Security Implementation and Operations
ACL best practice: explicit deny at the end, least-permissive rules, and logging on sensitive entries.
VLAN hopping mitigations: disable unused ports, set native VLAN to an unused ID, and avoid trunk negotiation (DTP).
DHCP snooping and dynamic ARP inspection prevent rogue DHCP and ARP spoofing on switched networks.
Endpoint hardening: disable unused services, enforce host firewall, apply EDR, and manage local admin rights.
Backup strategy: 3-2-1 rule (three copies, two media, one offsite); test restores regularly.
Secure remote access uses MFA plus VPN or ZTNA; direct exposed management interfaces are avoided.
Network Security Monitoring and Incident Response
SIEM ingests, normalizes, correlates, and alerts; SOAR automates response playbooks.
Network flow data (NetFlow/IPFIX) reveals traffic patterns without full packet capture.
Full packet capture supports deep forensics but is storage-intensive; retention policy balances cost and need.
Baseline normal behavior to detect anomalies; deviations trigger investigation.
Incident severity classification drives escalation and notification timelines.
Post-incident review documents lessons learned and updates controls and playbooks.
Network Security Governance, Risk, and Compliance
Data classification (public, internal, confidential, restricted) drives handling and control requirements.
Third-party risk management assesses vendor security posture and contractual obligations.
Access reviews and recertification ensure entitlements remain justified over time.
Compliance mapping aligns controls to multiple frameworks to avoid duplicate effort.
Security awareness training and acceptable-use policy reduce human-factor risk.
Metrics and KPIs demonstrate control effectiveness and support continuous improvement.