ACIA Capstone cheat sheet

Risk = likelihood × impact; annualized loss expectancy (ALE) = single loss expectancy (SLE) × annualized rate of occurrence (ARO).

Residual risk = inherent risk − risk mitigated by controls; risk is accepted only when residual risk falls within the stated tolerance.

Risk treatment options are exactly four: mitigate, transfer, avoid, accept; acceptance requires documented authority and a review date.

Control types: preventive (blocks), detective (identifies), corrective (restores), deterrent (discourages), compensating (substitutes when the primary control is infeasible).

Separation of duties prevents one principal from holding both authorization and execution capability; least privilege limits each role to the minimum necessary.

Policy hierarchy: policy (mandatory intent) → standard (specific requirements) → procedure (step-by-step) → guideline (recommended).

Common frameworks: ISO/IEC 27001 for an ISMS, NIST CSF for functions (Identify, Protect, Detect, Respond, Recover), SOC 2 for trust services criteria.

A third-party risk tier is assigned by data sensitivity and access level; higher tiers require stronger attestations and more frequent reassessment.

Audit evidence must be sufficient, competent, and timely; a control that is designed well but not operating is an operating-effectiveness deficiency.

Authentication factors are knowledge, possession, and inherence; two factors from different categories constitute MFA, two from the same category do not.

SSO with SAML or OIDC centralizes authentication; the identity provider asserts identity and the service provider consumes the assertion.

OAuth 2.0 is an authorization delegation framework, not an authentication protocol; OpenID Connect adds an identity layer on top of OAuth 2.0.

RBAC grants by role; ABAC evaluates attributes (subject, resource, environment) at request time and supports finer-grained, context-aware decisions.

Access recertification frequency should scale with risk: privileged and third-party accounts are reviewed more often than standard employee accounts.

Privileged access management uses vaulting, just-in-time elevation, session recording, and credential rotation to limit standing administrative rights.

Federation trust is directional: the identity provider signs assertions, and the relying party validates the signature and conditions such as audience and expiry.

Zero trust replaces implicit network trust with per-request verification of identity, device posture, and context before granting access.

OSI layers: 3 network (routing, IP), 4 transport (TCP/UDP ports), 7 application (HTTP, DNS); a stateful firewall filters at layers 3–4, a WAF at layer 7.

A DMZ segments internet-facing services from the internal network; traffic between zones passes through a controlling device, not directly.

NAT translates private addresses to public ones; it conserves IPv4 space but is not a security control by itself.

IPsec ESP provides confidentiality and integrity of payload; AH provides integrity and authentication but no confidentiality.

TLS handshake establishes a session key via asymmetric cryptography, then bulk data is protected with symmetric encryption.

Network segmentation limits lateral movement; microsegmentation applies per-workload policy instead of perimeter-only controls.

DDoS defenses: volumetric attacks are absorbed by upstream scrubbing or anycast distribution; application-layer attacks need behavioral filtering.

802.1X port-based access control authenticates a device to the network before granting VLAN access, supporting NAC.

Shared responsibility: the provider secures the cloud (facilities, hypervisor, managed service internals); the customer secures what is in the cloud (data, identities, configurations).

IaaS, PaaS, and SaaS shift the boundary of customer-managed controls; the customer's responsibility shrinks from OS upward as the model moves toward SaaS.

A security group is instance-level stateful filtering; a network ACL is subnet-level stateless filtering that evaluates ordered allow and deny rules.

Object storage exposure is most often caused by public bucket or container policies and missing block-public-access settings.

Hypervisor escapes and VM sprawl are virtualization risks; hardening includes patching the hypervisor and isolating management planes.

Cloud posture management continuously compares deployed configuration against baselines and flags drift; it is detective, not preventive.

Secrets should be stored in a managed secret store with rotation, never in source code, container images, or environment variables committed to repositories.

Container images require scanning for known vulnerabilities, minimal base images, and signed images verified at admission.

Symmetric encryption (AES) is fast and used for bulk data; asymmetric encryption (RSA, ECC) is slower and used for key exchange and signatures.

Hashing is one-way and provides integrity; salting defeats precomputed rainbow tables and is required for password storage with a slow KDF such as Argon2 or bcrypt.

Digital signature = hash of the message encrypted with the sender's private key; verification uses the sender's public key and proves integrity, authenticity, non-repudiation.

Data states: at rest (storage encryption), in transit (TLS, IPsec), in use (memory encryption, confidential computing, secure enclaves).

Data classification drives handling: public, internal, confidential, and restricted tiers determine encryption, retention, and sharing requirements.

Key management lifecycle: generation, distribution, storage, rotation, retirement, destruction; separation of key custodian duties from data owner duties.

Tokenization replaces sensitive values with non-sensitive tokens; unlike encryption, the token has no mathematical relationship to the original value.

MAC provides integrity and authenticity but not confidentiality; HMAC combines a hash function with a shared secret.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned.

Containment options include isolating the host, disabling the account, blocking the indicator, and segmenting the network; the choice trades blast radius against evidence preservation.

Order of volatility: CPU registers and cache, memory, network state, running processes, disk, backups and archives; collect the most volatile first.

Evidence handling requires a documented chain of custody, hash verification of images, and write-blocking for forensic acquisition.

Detection sources: SIEM correlation of logs, EDR telemetry, IDS/IPS alerts, and threat intelligence feeds; tuning reduces false positives but can raise false negatives.

Indicators of compromise are artifacts (hashes, IPs, domains); indicators of attack are behaviors; TTP-based detection is more durable than artifact matching.

MTTD measures time to detect; MTTR measures time to respond and recover; both are reported against defined severity tiers.

Tabletop exercises validate roles, communications, and decision rights without touching production systems.

CVSS base score reflects intrinsic severity (0.0–10.0); environmental and temporal scores adjust for context and threat activity.

Remediation priority should combine severity, exploitability (for example, CISA KEV listing), asset criticality, and exposure rather than CVSS alone.

Vulnerability scanning finds known issues; penetration testing validates exploitability; both complement SAST, DAST, and SCA in the SDLC.

SAST analyzes source code without execution; DAST tests a running application from the outside; SCA identifies vulnerable third-party dependencies.

Threat modeling (for example, STRIDE) is performed at design time; it enumerates threats per trust boundary before code is written.

A false positive is a reported finding that is not real; a false negative is a missed real vulnerability and is the more dangerous error.

Secure SDLC gates: security requirements, design review, code review, security testing, and release approval, each with defined exit criteria.

Patch management cycle: inventory, assess, test, deploy, verify; emergency change paths exist for actively exploited vulnerabilities.

Defense in depth layers controls so a single failure does not compromise the asset; each layer assumes the others may fail.

Fail-safe defaults: a failed control should deny access (fail closed) for confidentiality-critical systems and permit safe operation for safety-critical systems.

A trusted computing base is the minimal set of components that must be correct for the system's security; smaller TCB means a smaller attack surface.

Reference monitor properties: complete mediation, tamper resistance, and verifiability.

Isolation mechanisms: process separation, sandboxing, virtualization, and containers; each reduces the impact of a compromised component.

Attack surface reduction removes unnecessary services, ports, accounts, and code paths rather than merely monitoring them.

Security architecture artifacts: data flow diagrams, trust boundaries, and control matrices that map each requirement to an implemented control.

Single points of failure are identified by dependency analysis; redundancy and diversity mitigate them, but diversity must extend to vendors and code bases.

Case analysis sequence: identify the asset and business impact, determine the applicable control and framework, then evaluate the evidence against the requirement.

When a scenario conflicts on requirements, the more restrictive regulatory obligation governs unless a documented exception is approved.

Distinguish the root cause from the symptom: the finding describes the observed condition, the root cause explains why the control failed.

A compensating control is acceptable only if it provides equivalent risk reduction and is documented with an owner and expiry.

Quantify exposure with ALE and compare to control cost; a control whose annual cost exceeds the ALE reduction it delivers is not justified on that basis alone.

Cross-domain cases usually hinge on identity: a misconfigured role or over-privileged service account frequently explains a data-exposure finding.

Validate that remediation addresses the whole class of issue, not just the single reported instance, before closing the finding.

Evidence sufficiency test: would an independent auditor reach the same conclusion from the artifacts provided without asking follow-up questions?

Risk register entries capture asset, threat, vulnerability, likelihood, impact, owner, treatment, and review date.

A risk appetite is the amount of risk the organization is willing to pursue; risk tolerance is the acceptable variation around that appetite.

Business impact analysis determines recovery time objective (RTO) and recovery point objective (RPO), which drive continuity and backup design.

Compliance mapping shows how one control satisfies multiple framework requirements; it reduces duplicate evidence collection.

Exception management requires a documented justification, a named risk owner, a compensating control, and a defined expiration.

Segregation of duties conflicts are detected by comparing role assignments against a defined conflict matrix.

Key risk indicators are leading metrics; key performance indicators are lagging; both should be tied to defined thresholds and escalation paths.

Identity lifecycle: provisioning, modification, review, deprovisioning; orphaned accounts are those remaining after the joiner-mover-leaver process fails.

Passwordless and FIDO2 authenticators resist phishing because the credential is bound to the origin and cannot be replayed to a lookalike site.

Conditional access evaluates signals such as device compliance, location, and risk score before granting a session.

Service accounts should be non-interactive, scoped to a single function, rotated on a schedule, and inventoried; shared accounts break accountability.

Just-in-time access grants elevated rights for a bounded window and revokes automatically, reducing standing privilege.

Kerberos: the authentication service issues a ticket-granting ticket; the ticket-granting service issues service tickets; the KDC is the trust anchor.

Directory synchronization errors can leave stale accounts enabled; reconciliation between the authoritative source and the directory is a detective control.

IDS is passive and alerts; IPS is inline and can block; placement inside the perimeter misses encrypted or internal-only traffic.

DNS security: DNSSEC provides origin authentication and integrity of records but not confidentiality; DNS over HTTPS provides transport confidentiality.

A reverse proxy terminates client connections and forwards to back-end servers, hiding internal topology.

VLAN hopping and ARP spoofing are layer-2 risks mitigated by port security, dynamic ARP inspection, and private VLANs.

Wireless: WPA3 uses SAE to resist offline dictionary attacks; WPA2-PSK is vulnerable to handshake capture and offline cracking.

VPN concentrators must be patched aggressively; internet-facing remote-access appliances are a frequent initial-access vector.

Egress filtering blocks outbound traffic to unapproved destinations, limiting command-and-control and data exfiltration.

Identity is the primary cloud perimeter: over-permissive roles and long-lived access keys are the most common cloud exposure.

Infrastructure as code should be scanned before deployment; drift detection compares runtime state to the declared state.

Cloud logging requires centralization across accounts and regions, with immutable storage and defined retention.

Snapshot and image sharing can expose data; shared machine images and public snapshots must be reviewed for sensitive content.

Serverless functions inherit the execution role's permissions; least privilege must be applied to the function role, not just the caller.

Multi-tenant isolation depends on the provider's hypervisor and network controls; customer-side controls begin at the guest OS or service configuration.

Deletion protection and versioning guard against accidental or malicious object deletion in cloud storage.

Encryption modes: ECB reveals patterns and should not be used; CBC requires a random IV and a MAC; GCM provides authenticated encryption.

Perfect forward secrecy derives ephemeral session keys so compromise of a long-term key does not decrypt past sessions.

Key escrow enables recovery but creates a high-value target; split-knowledge and dual control reduce the risk.

Data loss prevention inspects content in motion, at rest, and in use, matching patterns such as identifiers and classification labels.

Data remanence: overwriting, degaussing, and physical destruction are the sanitization options; the choice depends on media type.

Certificate lifecycle: issuance, validation, renewal, revocation via CRL or OCSP; expiry is a common availability failure.

Pseudonymization replaces identifiers so data cannot be attributed to a subject without additional separately held information; it is reversible, unlike anonymization.

Severity classification drives escalation: business impact and data sensitivity determine the response tier, not the alert volume.

Log retention must exceed the longest plausible detection window; attackers often dwell for weeks before discovery.

Eradication removes the root cause (malware, vulnerable service, compromised credential); recovery restores service and verifies integrity.

A post-incident review produces corrective actions with owners and due dates; without follow-through, the same incident recurs.

Threat hunting starts from a hypothesis about attacker behavior, not from an alert queue.

Deception controls such as honeytokens generate high-fidelity alerts with low false-positive rates.

Communication during an incident must include legal, privacy, and executive stakeholders when regulated data may be involved.

Input validation is enforced server-side; client-side validation is a usability aid, not a security control.

Parameterized queries prevent SQL injection; output encoding prevents cross-site scripting; neither substitutes for the other.

Authentication and session management flaws include weak password reset, missing logout invalidation, and predictable session identifiers.

Access control must be enforced on every request server-side; insecure direct object references arise when authorization checks rely on client-supplied identifiers.

Dependency risk: transitive libraries are included in the software bill of materials and monitored for new advisories after release.

Secrets scanning in repositories and build pipelines catches credentials before they reach production.

Vulnerability SLAs should be tiered by severity and exposure, with the shortest window for internet-facing critical findings.

Threat modeling data flow: external entities, processes, data stores, data flows, and trust boundaries; threats are enumerated where flows cross boundaries.

Defense in depth does not mean duplicating identical controls; layered controls should differ in mechanism so one bypass does not defeat all.

Secure design principles include least privilege, economy of mechanism, open design, complete mediation, and psychological acceptability.

A demilitarized zone, a hardened jump host, and a management network are architectural patterns, not products.

Cryptographic agility means the architecture can replace algorithms and keys without redesigning the system.

High availability and security interact: failover paths must enforce the same controls as the primary path, or they become the weak link.

Architecture review should occur before implementation; retrofitting controls after build is more costly and less effective.

Map each case fact to a domain: an unexplained data export points to data protection and IAM; a missed alert points to detection and logging.

Prioritize findings by risk to the business, not by the order in which they were discovered.

When evidence is incomplete, state the assumption explicitly and identify what artifact would confirm or refute it.

A control gap in one domain often has a governance root cause, such as an undefined owner or an unenforced standard.

Recommended remediation should specify the control, the owner, the timeline, and the verification method.

Distinguish a design deficiency (the control cannot achieve the objective) from an operating deficiency (the control exists but was not performed).

Cross-framework cases: satisfy the strictest applicable requirement and map the others to it to avoid duplicate controls.

Risk assessment approaches: quantitative uses monetary values; qualitative uses ordinal scales; semi-quantitative combines both.

Control testing samples should be representative and documented; a sample that misses the population's risk profile weakens the conclusion.

Policy exceptions must be time-bound; an exception without an expiry becomes permanent by default.

Regulatory obligations differ by data type and jurisdiction; the applicable law follows the data subject and the data location, not the headquarters.

Vendor contracts should include breach notification timelines, audit rights, and data return or destruction terms.

Maturity models rate process capability on defined levels; a higher level requires repeatable, measured, and continuously improved process.

Authentication proves identity; authorization determines permitted actions; accounting records what was done.

Password storage must use a salted, slow hash; fast hashes such as MD5 or SHA-1 are unsuitable regardless of salting.

Account lockout thresholds trade brute-force resistance against denial-of-service risk against legitimate users.

Session tokens must be random, transmitted only over TLS, scoped, and invalidated on logout and privilege change.

Federation metadata exchange establishes trust; certificate rollover must be coordinated or authentication fails.

Privileged accounts should not be used for routine email or browsing; tiered administration separates high-privilege from low-privilege sessions.

TCP three-way handshake (SYN, SYN-ACK, ACK) is the basis for SYN flood detection and for stateful firewall session tracking.

TLS certificate validation checks chain of trust, hostname match, validity period, and revocation status.

Network address translation and port forwarding expose internal services; each forwarded port is an attack surface entry.

Honeypots detect scanning and lateral movement but must be isolated so they cannot be used as a pivot.

Bandwidth and connection-rate baselines enable anomaly detection for exfiltration and denial of service.

Wireless rogue access points are detected by monitoring the RF spectrum and comparing against an authorized inventory.

Cloud audit logs record control-plane actions; data-plane access may require separate service logs to be enabled.

Cross-account role assumption should require an external ID and least-privilege trust policy to prevent confused-deputy attacks.

Ephemeral workloads should receive short-lived credentials from an instance or workload identity rather than stored keys.

Backup isolation in the cloud requires separate credentials and accounts so ransomware cannot delete both primary and backup.

Resource tags drive ownership, cost, and security policy; untagged resources are frequently unmonitored.

Provider-managed encryption keys reduce operational burden; customer-managed keys give control over rotation and revocation.

Confidentiality, integrity, and availability are protected by different mechanisms; encryption addresses confidentiality and, with authentication modes, integrity.

Key length and algorithm strength must be assessed against current guidance; legacy algorithms such as DES and RC4 are deprecated.

A digital certificate binds a public key to an identity and is validated by a certificate authority's signature.

Data retention schedules must be enforceable; retaining data beyond need increases breach impact and legal exposure.

Secure multi-party and homomorphic techniques allow computation on protected data but carry performance and complexity costs.

Classification labels must propagate to derived data, exports, and backups, or protection is bypassed.

Detection engineering converts threat intelligence into tested rules; untested rules produce either noise or blind spots.

Time synchronization across sources is required for correlation; skewed clocks break event ordering.

Preserving volatile evidence before rebooting a host is essential; a reboot destroys memory-resident indicators.

Incident severity may escalate as scope becomes clear; the initial classification is provisional.

Regulatory breach notification clocks may start at discovery, not at confirmation, so early legal involvement is required.

Lessons-learned actions should be tracked to closure in the same system as other corrective actions.

Exploitability scoring considers attack vector, complexity, privileges required, and user interaction; a network-vector, no-interaction flaw ranks higher.

Vulnerability aging metrics reveal whether remediation SLAs are actually met.

Penetration test scope must define targets, rules of engagement, timing, and escalation contacts before testing begins.

Secure code review focuses on trust boundaries, authentication, authorization, and data handling paths.

Build pipeline security includes signed commits, protected branches, and artifact provenance.

Re-testing after remediation confirms the fix; closing a finding without verification risks a false sense of security.

A control matrix maps each requirement to a control, its implementation, and its evidence source.

Zero trust architecture components: policy engine, policy administrator, and policy enforcement point.

Physical security layers: perimeter, building, interior, and asset; each layer assumes the previous one may be breached.

Environmental controls include fire suppression, temperature and humidity monitoring, and power redundancy.

Cloud and on-premises architectures should apply consistent control objectives even when the implementations differ.

Design reviews should test failure modes: what happens when the identity provider, logging, or key management service is unavailable.

Read the case for the business objective first; the security recommendation must support it, not contradict it.

Identify the control that failed, the framework requirement it maps to, and the evidence that demonstrates the failure.

Distinguish a policy violation from a control design flaw; they require different remediation.

Quantify the finding's impact where possible; qualitative statements are weaker without a stated exposure estimate.

Sequence recommendations by dependency: identity and logging fixes often must precede detection improvements.

State residual risk after the proposed remediation and who accepts it.

Risk treatment must be recorded with an owner; an unowned risk is effectively unmanaged.

Compliance is a point-in-time attestation; continuous monitoring provides evidence between audits.

Data processing agreements define controller and processor roles and obligations for personal data.

Internal audit independence requires that auditors do not design or operate the controls they assess.

Metrics for a security program include patch SLA attainment, incident counts by severity, and control test pass rates.

Board reporting should express risk in business terms, including financial and regulatory exposure.

Role mining derives roles from actual access patterns; excessive role proliferation increases review burden.

Attribute-based policies can enforce separation of duties at request time by evaluating conflict rules.

Identity proofing strength should match the assurance level required by the resource being accessed.

Break-glass accounts must be monitored, alerted on use, and rotated after each use.

Access reviews should capture the reviewer's decision and the evidence reviewed, not just a checkbox.

Deprovisioning must cover downstream applications, not only the primary directory account.

Firewall rule hygiene: remove any-any rules, document each rule's owner and purpose, and review on a schedule.

Network flow logs reveal lateral movement and exfiltration patterns that packet-level alerts may miss.

Load balancers and CDNs terminate TLS; the back-end connection must also be protected or the segment is exposed.

Out-of-band management networks must be separated from production traffic and access-controlled.

Time-based and geo-based access rules reduce exposure but can be bypassed; they are compensating, not primary, controls.

Configuration baselines for network devices should be enforced and drift-checked.

Cloud-native identity providers should enforce MFA for all administrative roles and for console access.

Public exposure checks should run continuously; a single misconfigured storage policy can expose the entire dataset.

Container orchestration secrets should be mounted at runtime from a secret store, not baked into images.

Network policy in orchestrated environments should default to deny between namespaces.

Cloud cost anomalies can indicate cryptomining or resource abuse and belong in the detection program.

Decommissioning must include revocation of keys, deletion of data per retention policy, and removal of trust relationships.

Encryption in transit must cover internal service-to-service traffic, not only client-to-edge connections.

Key rotation limits the data exposed by a single key compromise; rotation must be tested, not just scheduled.

Data masking and redaction protect sensitive values in non-production and analytics environments.

Integrity monitoring detects unauthorized modification of stored data and configuration.

Backup encryption must use keys independent of the production key management system.

Privacy requirements such as data minimization and purpose limitation constrain what may be collected and retained.