SCYM cheat sheet
SCYM · Keep the key ideas within reach.
Unverified blueprint area 1 - general security and risk fundamentals
CIA triad: confidentiality guards against unauthorized disclosure, integrity against unauthorized modification, availability against loss of timely, reliable access.
Qualitative risk is a function of likelihood and impact; a common shorthand is risk = threat × vulnerability × impact.
Quantitative risk formulas: SLE = asset value × exposure factor; ALE = SLE × annualized rate of occurrence.
Digital signature = hash of the message encrypted with the sender's private key; it gives integrity, origin authentication and non-repudiation, but not confidentiality.
Symmetric algorithms (AES, ChaCha20) are fast and suit bulk data but need secure key distribution; asymmetric algorithms (RSA, ECC) solve key exchange but are far slower.
A cryptographic hash (SHA-256) is one-way and collision-resistant; it provides integrity evidence and never provides confidentiality by itself.
Control categories are technical, administrative and physical; control types are preventive, detective, corrective, deterrent and compensating.
Defense in depth assumes any single control can fail, so preventive, detective and corrective layers are combined.
Unverified blueprint area 2 - identity, authentication and access control
MFA requires two or more factors from different categories (know, have, are); two passwords or two knowledge questions are single-factor.
Store passwords with a salted, deliberately slow key-derivation function such as bcrypt, scrypt or Argon2 rather than a fast hash like plain SHA-256.
OAuth 2.0 is an authorization delegation framework issuing access tokens; OpenID Connect layers authentication on top by adding a signed ID token (JWT).
SAML 2.0 exchanges XML assertions between an identity provider and a service provider, typically for browser-based single sign-on.
RBAC assigns permissions to roles and users to roles; ABAC evaluates attributes and policy at request time and is finer-grained.
Kerberos issues a ticket-granting ticket from the key distribution center, then service tickets per resource; all participants must have time synchronized within the configured skew.
Least privilege and separation of duties limit the blast radius of a compromised account and prevent one person from completing a sensitive transaction alone.
Session tokens must be high-entropy, sent only over TLS, scoped narrowly, and invalidated server-side at logout or privilege change.
Unverified blueprint area 3 - network architecture, protocols and traffic security
TCP connection setup is SYN, SYN-ACK, ACK; UDP is connectionless with no ordering, retransmission or delivery guarantee.
IPv4 usable hosts in a subnet = 2^(32 − prefix length) − 2; /24 gives 254 usable, /25 gives 126, /26 gives 62.
Stateful firewalls track connection state and allow return traffic for established sessions; stateless ACLs evaluate each packet independently.
ARP spoofing forges MAC-to-IP bindings to enable on-path interception; dynamic ARP inspection and static ARP entries mitigate it.
DNSSEC signs records so resolvers can verify origin authenticity and integrity, but it does not encrypt queries or responses.
IPsec AH provides integrity and authentication only; IPsec ESP provides confidentiality plus optional integrity and authentication.
TLS 1.3 completes a 1-RTT handshake, mandates ephemeral (EC)DHE for forward secrecy, and removes RSA key transport and static Diffie-Hellman.
TLS sits between the transport and application layers, so it protects application payloads but leaves IP and TCP headers visible.
Unverified blueprint area 4 - operations, incident response and governance
Incident response phases: preparation; detection and analysis; containment, eradication and recovery; post-incident activity and lessons learned.
Order of volatility for evidence collection: CPU registers and cache, RAM, network state, disk storage, then backups and archival media.
Chain of custody is an unbroken documented record of who handled evidence and when; hash evidence (e.g., SHA-256) at acquisition to prove integrity.
RTO is the maximum tolerable downtime; RPO is the maximum tolerable data loss; the maximum tolerable downtime bounds the RTO.
A business impact analysis identifies critical processes and dependencies and drives recovery tiering and DR investment.
Change management sequence: request, risk assessment and approval, testing, implementation, documentation, with a tested back-out plan.
NTP-synchronized clocks are a prerequisite for reliable log correlation, Kerberos authentication and forensic timeline reconstruction.
Under the GDPR, controllers must notify the supervisory authority of a personal data breach within 72 hours of becoming aware of it.