SC cheat sheet

Risk = Threat x Vulnerability x Asset Value; SLE = Asset Value x Exposure Factor; ALE = SLE x ARO.

Qualitative analysis ranks risks by ordinal scales; quantitative analysis assigns monetary values to loss expectancy.

Risk treatment options: mitigate, transfer, avoid, accept; residual risk remains after controls are applied.

Due care is acting on known risk; due diligence is the ongoing investigation that informs that action.

CIA triad: confidentiality (disclosure), integrity (alteration), availability (access); non-repudiation and authenticity are supporting properties.

BCP focuses on sustaining critical business functions; DRP focuses on restoring IT systems after disruption.

RTO is the maximum acceptable downtime; RPO is the maximum acceptable data loss measured in time.

Separation of duties prevents one person from completing a high-risk transaction alone; least privilege limits rights to those needed.

Data classification levels typically map to handling rules: public, internal/private, confidential, restricted/secret.

Data roles: owner (accountable, sets classification), custodian (implements controls), user (follows policy), processor (acts on owner's behalf).

Data states: at rest (storage encryption), in transit (TLS/IPsec), in use (memory protection, secure enclaves).

Scoping and tailoring reduce control overhead; data remanence requires clearing, purging, or destruction rather than deletion.

Retention limits define minimum and maximum storage periods; destruction methods include shredding, degaussing, and cryptographic erase.

PII is any data that can identify an individual directly or in combination; PHI is health data tied to an individual.

Asset inventory baseline: identify assets, assign ownership, classify, label, and define handling and retention rules.

Tokenization substitutes a surrogate value for sensitive data; masking obscures data while preserving format for testing.

Bell-LaPadula (confidentiality): no read up, no write down; Biba (integrity): no read down, no write up.

Common Criteria uses EALs 1-7; higher EAL means more assurance evidence, not necessarily more functionality.

TCB components: reference monitor enforces access, is always invoked, and must be tamper-proof and verifiable.

Trusted computing base boundaries, security perimeter, and covert channels (storage and timing) define system trust assumptions.

Cryptographic goals: confidentiality (encryption), integrity (hash/MAC), authenticity (signature), non-repudiation (digital signature).

Symmetric ciphers (AES, 3DES) are fast and use shared keys; asymmetric (RSA, ECC) solve key distribution but are slower.

Hashing (SHA-2/3) is one-way and collision-resistant; HMAC adds a shared key to a hash for integrity and authenticity.

Defense in depth layers controls; a single point of failure violates redundancy goals in resilient architecture.

OSI layers: physical, data link, network, transport, session, presentation, application; TCP/IP collapses to link, internet, transport, application.

TLS provides confidentiality, integrity, and server authentication; it does not by itself authenticate the client unless mutual TLS is used.

IPsec uses AH (integrity/authentication) and ESP (confidentiality); transport mode protects host-to-host, tunnel mode protects gateways.

Network segmentation and VLANs limit broadcast domains and contain lateral movement; DMZ hosts externally facing services.

Firewall types: packet filter (L3/L4), stateful inspection (tracks sessions), application proxy (L7 inspection).

Common ports: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 3389 RDP.

Wireless: WPA2/WPA3 use AES-CCMP; WEP is broken; 802.1X provides port-based network access control.

DDoS mitigation uses rate limiting, scrubbing centers, and anycast distribution; DNS poisoning targets resolver cache integrity.

Authentication factors: something you know, have, are; MFA requires two or more distinct factor types.

Access control models: DAC (owner discretion), MAC (labels/clearance), RBAC (role-based), ABAC (attribute/policy-based).

SSO reduces credential sprawl but concentrates risk; federation uses standards like SAML and OIDC to trust external IdPs.

Kerberos uses a KDC, TGT, and service tickets; time synchronization is required to prevent replay.

Identity lifecycle: provisioning, review, deprovisioning; orphaned accounts are a common audit finding.

Password storage uses salted, slow hashes (bcrypt, Argon2, PBKDF2); plain or fast hashes (MD5, SHA-1) are unacceptable.

Least privilege and need-to-know are enforced through role design and periodic access recertification.

Biometric error rates: FAR (false accept) and FRR (false reject); CER/EER is the point where they are equal.

Vulnerability scanning identifies known weaknesses; penetration testing validates exploitability with authorized simulated attacks.

Test types: black-box (no knowledge), white-box (full knowledge), gray-box (partial knowledge).

SAST analyzes source code without execution; DAST tests running applications; IAST combines runtime instrumentation.

Coverage metrics: code coverage, function coverage, and branch coverage indicate how much logic tests exercise.

Sampling types: statistical (random, representative) vs non-statistical (judgmental, convenience); sample size affects confidence.

SOC reports: SOC 1 (financial controls), SOC 2 (trust services criteria), SOC 3 (public summary).

Log review and continuous monitoring support detection; audit trails must be protected from tampering.

Remediation prioritization uses severity, exploitability, and asset criticality, not raw count of findings.

Incident response phases: preparation, detection/analysis, containment, eradication, recovery, lessons learned.

Evidence handling: maintain chain of custody, preserve order of volatility (memory before disk before backups), use write blockers.

Backup types: full, incremental (changes since last backup), differential (changes since last full); test restores regularly.

Change management requires approval, testing, rollback plan, and documentation before production deployment.

Logging sources include hosts, network devices, applications, and identity systems; centralized SIEM correlates events.

Physical controls: CPTED principles, mantraps, biometric access, environmental controls (HVAC, fire suppression).

Malware categories: virus, worm, trojan, ransomware, rootkit, logic bomb; each has distinct propagation and persistence traits.

Patch management cadence balances risk of unpatched systems against risk of untested changes.

SDLC phases: requirements, design, development, testing, deployment, maintenance; security activities belong in every phase.

OWASP Top 10 categories include injection, broken access control, cryptographic failures, and security misconfiguration.

Input validation uses allowlists; output encoding prevents cross-site scripting; parameterized queries prevent SQL injection.

Threat modeling (STRIDE: spoofing, tampering, repudiation, information disclosure, denial of service, elevation) identifies design risks early.

Secure coding practices: least privilege in code, fail-safe defaults, defense in depth, and avoiding hardcoded secrets.

DevSecOps integrates automated security checks (SAST, dependency scanning, secrets scanning) into CI/CD pipelines.

Software supply chain risk includes third-party libraries, build systems, and dependency provenance (SBOM).

Environment separation (dev, test, prod) prevents test data and credentials from leaking into production.