DSTC cheat sheet

CIA triad: Confidentiality protects unauthorized disclosure, Integrity protects unauthorized modification, Availability protects timely and reliable access.

Risk = Threat x Vulnerability x Impact; a threat without a matching vulnerability produces no risk.

Defense in depth layers preventive, detective, and corrective controls so a single control failure does not expose the asset.

Threat actors by capability: script kiddie < hacktivist < organized crime < insider < nation-state; nation-state actors typically hold the highest capability and persistence.

Malware categories: virus requires a host and user action, worm self-propagates across networks, trojan disguises as legitimate software, ransomware denies access until payment.

Social engineering exploits human trust; phishing, vishing (voice), and smishing (SMS) differ only in delivery channel.

Vulnerability vs exploit vs payload: vulnerability is the weakness, exploit is the method that abuses it, payload is what executes after exploitation.

Zero-day means no vendor patch exists at time of exploitation; compensating controls (segmentation, least privilege) reduce exposure until patched.

Threat intelligence types: strategic (executive trends), tactical (TTPs), operational (campaign details), technical (IOCs such as hashes and IPs).

OSI layers for controls: L3/L4 firewalls filter IP/port, L7 proxies inspect application content, NAC enforces at L2 admission.

Stateful firewall tracks connection state and permits return traffic; stateless ACLs must explicitly permit both directions.

DMZ segments internet-facing services from internal networks; a compromise in the DMZ should not grant direct internal access.

IDS detects and alerts (passive), IPS detects and blocks inline; placement determines whether it sees north-south or east-west traffic.

VPN types: site-to-site connects networks, remote-access connects users; IPsec uses AH for integrity and ESP for encryption.

TLS provides confidentiality and integrity in transit but not non-repudiation; certificate validation prevents MITM.

Network segmentation and microsegmentation limit lateral movement; VLANs separate at L2 while subnets/routing separate at L3.

802.1X authenticates devices/users before granting port access; a supplicant, authenticator, and authentication server are required.

Common ports: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 3389 RDP; unexpected open ports indicate misconfiguration or backdoors.

EDR records endpoint telemetry (process, file, network, registry) and supports detection plus response actions such as isolation.

Antivirus signature-based detection misses unknown malware; heuristic and behavioral detection catch novel variants.

Application allowlisting permits only approved executables and blocks everything else; it is stronger than blocklisting against unknown threats.

Host hardening: disable unused services, remove default accounts, apply least privilege, patch OS and applications, enforce full-disk encryption.

Patch management lifecycle: inventory, risk-rank, test, deploy, verify; unpatched endpoints are the most common initial-access vector.

File integrity monitoring detects unauthorized changes to critical files and supports compliance evidence.

Sandboxing isolates execution so malicious behavior is contained; containerization is isolation, not a security boundary by itself.

USB and removable media controls reduce data exfiltration and malware introduction; device control enforces allow/deny by class.

AAA: Authentication proves identity, Authorization grants permissions, Accounting logs activity.

Authentication factors: something you know, have, are; MFA requires two or more different factor types, not two of the same type.

Access control models: DAC owner grants access, MAC labels enforce system policy, RBAC uses roles, ABAC uses attributes/policy conditions.

Least privilege grants minimum access needed; separation of duties prevents one identity from completing a sensitive transaction alone.

SSO centralizes authentication and reduces credential sprawl; federation extends trust across organizations via standards such as SAML and OIDC.

Password storage must use salted, slow hashes (bcrypt, Argon2, PBKDF2); fast hashes like MD5/SHA-1 are unsuitable for passwords.

Privileged access management vaults admin credentials, enforces just-in-time elevation, and records privileged sessions.

Identity lifecycle: provisioning, review/recertification, deprovisioning; orphaned accounts are a common audit finding.

Kerberos uses tickets (TGT, service tickets) for authentication; pass-the-hash and Kerberoasting abuse ticket/credential mechanisms.

Incident response phases: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned.

Containment options: isolate host, block IP, disable account, segment network; choose based on blast radius versus business impact.

Evidence handling preserves order of volatility: memory and network state before disk, disk before backups and logs.

Chain of custody documents who handled evidence, when, and how; breaks can render evidence inadmissible.

Detection sources: SIEM correlation, EDR alerts, IDS/IPS, netflow, honeypots, user reports; corroborate across sources before declaring an incident.

Incident severity drives escalation; classify by data sensitivity, scope, and business impact rather than alert volume alone.

MTTD measures time to detect, MTTR measures time to respond/recover; both are key IR performance metrics.

Post-incident review produces root cause and control improvements; repeat incidents often trace to unaddressed findings.

SOC tiers: Tier 1 triage, Tier 2 investigation, Tier 3 advanced hunting/response; escalation flows upward with evidence.

SIEM aggregates logs, correlates events, and generates alerts; log sources must be normalized and time-synchronized via NTP.

False positive is a benign event flagged as malicious; false negative is malicious activity missed, which is generally the costlier error.

Vulnerability management: discover assets, scan, prioritize by exploitability and asset criticality, remediate, verify.

CVSS scores severity but not business risk; contextual factors such as exposure and data sensitivity adjust priority.

Change management requires request, approval, test, implementation, and rollback plan; emergency changes require retroactive review.

Backup strategy: 3-2-1 rule (3 copies, 2 media types, 1 offsite); restore testing validates recoverability, not just backup completion.

Threat hunting is hypothesis-driven proactive search for undetected adversary activity, distinct from alert-driven monitoring.

Playbooks/runbooks standardize repeatable response steps and reduce mean time to respond.

Security governance sets direction via policies, standards, procedures, and guidelines; policies are mandatory, guidelines are recommended.

Risk treatment options: mitigate, transfer (insurance), avoid, accept; residual risk remains after controls are applied.

Risk assessment approaches: qualitative (likelihood/impact scales) versus quantitative (ALE = SLE x ARO; SLE = asset value x exposure factor).

Compliance frameworks: ISO 27001 (ISMS), NIST CSF (Identify, Protect, Detect, Respond, Recover), PCI DSS (cardholder data), HIPAA (health data), GDPR (EU personal data).

Data roles: controller determines purpose, processor acts on controller's behalf; both carry obligations under privacy regulations.

Audit evidence must be current, complete, and traceable; control testing verifies design and operating effectiveness.

Third-party risk management requires due diligence, contractual security clauses, and periodic reassessment of vendors.

BCP sustains business functions; DRP restores IT after disruption; RTO is maximum tolerable downtime, RPO is maximum tolerable data loss.

Data classification (public, internal, confidential, restricted) drives handling, retention, and access requirements.

Non-repudiation proves an action occurred and cannot be denied, typically via digital signatures.

Authentication verifies identity; authorization determines permitted actions; auditing records what occurred.

Attack surface is the sum of exposed entry points; reducing it lowers the number of exploitable paths.

Phishing defenses combine user awareness, email authentication (SPF, DKIM, DMARC), and link/attachment inspection.

Supply-chain attacks compromise trusted software or vendors to reach downstream victims, bypassing perimeter defenses.

Threat modeling (e.g., STRIDE) enumerates spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.

Zero trust removes implicit trust based on network location; every request is authenticated and authorized explicitly.

NAT translates addresses but is not a security control; it hides internal addressing incidentally only.

DNS security: DNSSEC provides origin authentication and integrity, not confidentiality; DNS filtering blocks malicious resolution.

Wireless security progression: WEP (broken) < WPA/TKIP (weak) < WPA2/AES-CCMP < WPA3 (SAE).

Proxy vs reverse proxy: forward proxy fronts clients outbound, reverse proxy fronts servers inbound.

Honeypots are decoy systems that detect and study attackers without exposing production assets.

Principle of least functionality: hosts run only required services, ports, and software.

Logging on hosts should capture authentication events, privilege changes, and process creation where feasible.

Secure boot and measured boot verify boot-chain integrity; they help detect bootkits and tampering.

Mobile device management enforces encryption, screen lock, remote wipe, and app control on endpoints.

Rootkits hide at kernel or firmware level and may evade user-mode tools; integrity checks and offline scanning help detect them.

Session management: short timeouts, secure cookies, and token rotation reduce session hijacking risk.

Credential stuffing replays breached username/password pairs; rate limiting and MFA mitigate it.

FIDO2/WebAuthn hardware keys resist phishing because they bind credentials to the legitimate origin.

Just-in-time access grants privileges temporarily and revokes automatically, shrinking the standing-privilege window.

Directory services (e.g., LDAP, AD) centralize identity; tiered admin models prevent lower-tier compromise from reaching domain control.

Indicators of compromise are artifacts (hashes, IPs, domains); indicators of attack describe adversary behavior and intent.

Triage questions: what happened, what is affected, is it ongoing, what is the potential impact.

Eradication removes the root cause (malware, vulnerability, account); recovery restores normal operations and validates integrity.

Communication plans during incidents define internal and external notification paths, including regulatory breach deadlines.

Tabletop exercises test response plans without live systems and reveal gaps in roles and procedures.

Log retention must satisfy legal and regulatory requirements; retention shorter than investigation windows loses evidence.

Alert tuning reduces false positives but risks false negatives; validate tuning against known attack scenarios.

Configuration baselines (e.g., CIS Benchmarks) define secure states; drift detection alerts on deviation.

Penetration testing validates exploitable weaknesses; it differs from vulnerability scanning, which enumerates potential issues.

Patch SLAs are set by severity; internet-facing critical vulnerabilities typically carry the shortest remediation window.

Segregation of duties in change management prevents developers from deploying unreviewed code to production.

Data retention schedules define how long data is kept and when it must be securely destroyed.

Privacy principles: lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity, accountability.

Business impact analysis identifies critical processes and dependencies that drive RTO and RPO targets.

Exception/risk acceptance must be documented, time-bound, and approved by accountable management.

Metrics and reporting (KPIs/KRIs) demonstrate control effectiveness to governance bodies.

Confidentiality controls include encryption, access control, and classification; integrity controls include hashing and version control.

Insider threats bypass perimeter defenses because the actor holds legitimate access; monitoring and least privilege are primary mitigations.

Denial-of-service attacks target availability; volumetric, protocol, and application-layer variants require different mitigations.

Advanced persistent threat (APT) is characterized by long dwell time, stealth, and focused objectives rather than speed.

Egress filtering restricts outbound traffic, disrupting command-and-control and data exfiltration.

Network taps and SPAN ports provide passive traffic copies for monitoring without inline disruption.

IPsec transport mode protects host-to-host payload; tunnel mode encapsulates the entire original packet.

Load balancers and WAFs protect availability and application-layer attacks; a WAF is not a substitute for secure coding.

Endpoint detection coverage gaps (unmanaged or offline devices) create blind spots; asset inventory is a prerequisite.

Privilege escalation on hosts often exploits unpatched local services or misconfigured permissions.

Host-based firewalls add a per-device filtering layer independent of network controls.

Macro and script-based attacks require restricting execution and disabling unneeded scripting engines.

Account lockout thresholds balance brute-force resistance against denial-of-service via deliberate lockouts.

Service accounts should be non-interactive, uniquely named, and rotated; shared service accounts break accountability.

Access reviews verify that entitlements still match job roles; stale access is a frequent audit exception.

Federation trust requires metadata exchange and signature validation; misconfigured trust enables assertion forgery.

Volatile data order: CPU/cache, memory, network connections, running processes, disk, remote logs, archival media.

Containment must be balanced against preserving evidence; aggressive actions can destroy forensic artifacts.

Incident classification distinguishes event, alert, incident, and breach based on confirmed impact and data exposure.

Regulatory breach notification clocks often start at discovery, not at confirmation, so early escalation matters.

Use cases in a SIEM define what correlation logic looks for; coverage gaps map to unmonitored attack techniques.

Time synchronization is essential for correlation; skewed clocks break event ordering and forensics.

Vulnerability scan credentials enable authenticated scanning, which finds more issues than unauthenticated scans.

Purple teaming pairs offense and defense to validate detection coverage against real techniques.

Control types: preventive, detective, corrective, deterrent, compensating; classification guides control selection.

Independent audit provides assurance separate from management self-assessment.

Contractual compliance obligations (e.g., PCI DSS for card data) apply regardless of organizational size.

Policy exceptions must map to a compensating control to keep residual risk within tolerance.