CSIS cheat sheet

The CIA triad defines confidentiality as preventing unauthorized disclosure, integrity as preventing unauthorized modification, and availability as ensuring timely and reliable access.

Policy hierarchy: policies state mandatory management intent; standards specify required controls; procedures give step-by-step instructions; guidelines are recommended and non-mandatory.

Due care is the prudence expected of a reasonable professional; due diligence is the ongoing verification and investigation that such care is actually applied.

Separation of duties splits sensitive tasks among different people; least privilege grants only the minimum access needed for a task.

ISO/IEC 27001 specifies requirements for an information security management system; COBIT focuses on IT governance; the NIST Cybersecurity Framework organizes outcomes into Identify, Protect, Detect, Respond, and Recover.

Data classification labels such as public, internal, confidential, and restricted determine handling, access, retention, and disposal requirements.

KPIs measure control effectiveness and goal attainment; KRIs indicate changing risk exposure and should be tied to governance objectives.

Governance accountability rests with senior management and the board, including tone at the top, risk ownership, and independent assurance.

AAA framework: authentication verifies identity, authorization determines permitted actions, and accounting records activity for audit and accountability.

Identification is a claimed identity; authentication verifies that claim; authorization grants access; accounting logs the result.

Authentication factors are something you know, something you have, and something you are; MFA requires different factor types, not multiple instances of one type.

Access control models: DAC lets owners set permissions; MAC uses labels and clearances; RBAC grants by role; ABAC evaluates user, resource, action, and environment attributes.

Kerberos uses a KDC, a Ticket Granting Ticket, and service tickets; it requires time synchronization and supports single sign-on without resending passwords.

Federation protocols: SAML exchanges assertions for web single sign-on; OAuth 2.0 delegates authorization; OpenID Connect adds an authentication layer over OAuth 2.0.

Passwords should be stored with a unique salt and a slow hash such as bcrypt, scrypt, or Argon2; reversible encryption is not suitable for password storage.

Privileged access management uses vaulting, session recording, just-in-time elevation, and approval workflows to control administrative accounts.

Biometric accuracy is described by false acceptance rate, false rejection rate, and crossover error rate; a lower crossover error rate indicates better accuracy.

Symmetric encryption uses one shared secret key and is fast for bulk data; asymmetric encryption uses a public/private key pair and is slower but supports key exchange and digital signatures.

AES is a symmetric block cipher; RSA security depends on integer factorization; ECC provides comparable strength with smaller keys; SHA-2 and SHA-3 are approved hash families, while MD5 and SHA-1 are deprecated for security use.

Hashing is one-way and should resist collisions; salting prevents precomputed rainbow-table attacks; HMAC combines a secret key with a hash to provide integrity and authenticity.

A digital signature applies the signer's private key to a message hash; verification uses the public key and provides integrity, authentication, and non-repudiation, but not confidentiality by itself.

PKI includes certificate authorities, registration authorities, certificates, CRLs, and OCSP; a certificate binds an identity to a public key and has validity and revocation status.

Key lifecycle management covers generation, distribution, storage, rotation, recovery, and destruction; HSMs protect keys and separation of duties limits key custody.

Perfect forward secrecy uses ephemeral key exchange so compromise of long-term keys does not compromise previously established session keys.

Key escrow enables recovery but creates a high-value single point of compromise; crypto agility allows replacement of algorithms and keys without redesigning the system.

TLS protects data in transit; encryption at rest protects stored data; each encryption operation should use a unique IV or nonce appropriate to the mode.

Firewall types include packet filters, stateful inspection firewalls, application proxies, and next-generation firewalls; a default-deny rule is the baseline for perimeter control.

A stateful firewall tracks connection state and permits return traffic for established sessions; a stateless firewall filters each packet independently against static rules.

An IDS monitors and alerts passively; an IPS is inline and can block or drop malicious traffic in real time; detection may be signature-based or anomaly-based.

A DMZ is a segmented network between the internet and internal networks that hosts public-facing services, limiting exposure if those services are compromised.

Network segmentation, VLANs, and microsegmentation reduce lateral movement; zero trust treats every request as untrusted until authenticated and authorized.

IPsec operates at the network layer and uses AH for integrity/authentication and ESP for confidentiality; TLS VPNs protect traffic at higher layers.

IEEE 802.1X authenticates devices or users before granting port access using a supplicant, an authenticator, and an authentication server such as RADIUS.

DDoS defenses include rate limiting, traffic scrubbing, anycast distribution, and upstream filtering; DDoS attacks may be volumetric, protocol-based, or application-layer.

DNSSEC provides integrity and authenticity of DNS data but not confidentiality; DNS filtering and cache-poisoning defenses protect name resolution.

Defense in depth layers preventive, detective, and corrective controls across people, process, and technology so failure of one control does not expose the whole system.

Secure design principles include least privilege, separation of duties, fail-safe defaults, economy of mechanism, complete mediation, open design, least common mechanism, and psychological acceptability.

The trusted computing base is the set of components critical to security; a reference monitor mediates all access and should be tamper-proof, always invoked, and small enough to verify.

Threat modeling identifies threats against data flows and trust boundaries; STRIDE classifies spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.

Architecture frameworks include TOGAF for enterprise architecture, SABSA for security architecture, and Zachman for enterprise ontology; they guide structured design and traceability.

Cloud shared responsibility splits security duties between provider and customer; CASB and CSPM tools provide visibility and policy enforcement for cloud services.

Isolation techniques include hypervisors, sandboxes, containers, namespaces, and cgroups; isolation limits the impact of a compromised component.

Reducing attack surface means removing unnecessary services, ports, accounts, and code; trust boundaries should be explicitly documented in data-flow diagrams.

Risk is commonly expressed as likelihood multiplied by impact; inherent risk exists before controls and residual risk remains after controls are applied.

Quantitative risk formulas: SLE = asset value × exposure factor; ALE = SLE × annualized rate of occurrence.

Qualitative risk methods use ranked scales, risk matrices, Delphi techniques, and scenario analysis when monetary estimates are unreliable.

Risk treatment options are avoid, mitigate, transfer, and accept; acceptance requires documented management approval and awareness of residual risk.

A risk register records risk description, owner, likelihood, impact, rating, treatment, controls, residual risk, and review date.

Risk appetite is the amount of risk management is willing to pursue; risk tolerance is the acceptable variation around that appetite; risk capacity is the maximum risk the organization can bear.

Business impact analysis identifies critical processes and dependencies and sets RTO, RPO, and maximum tolerable downtime.

Control types include preventive, detective, corrective, compensating, and deterrent; third-party risk management evaluates vendors, contracts, and supply-chain exposure.

GDPR governs personal data of EU data subjects and requires lawful basis, data subject rights, and generally breach notification within 72 hours of awareness.

HIPAA protects protected health information in the United States; PCI DSS applies to organizations that store, process, or transmit cardholder data; SOX addresses financial reporting controls; GLBA covers financial privacy; FERPA protects education records.

Privacy principles include lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.

Cross-border data transfers may rely on adequacy decisions, standard contractual clauses, binding corporate rules, or explicit consent depending on jurisdiction.

Evidence must be relevant, authentic, complete, and handled with a documented chain of custody showing who collected, accessed, transferred, and stored it.

Legal hold suspends normal deletion and retention schedules; e-discovery identifies, preserves, collects, and produces electronically stored information.

Intellectual property categories are copyright, trademark, patent, and trade secret; each has different protection duration and disclosure requirements.

Assurance reporting includes SOC 1 for financial controls, SOC 2 for trust services criteria, SOC 3 for public reporting, and ISO/IEC 27001 certification for an ISMS.

NIST incident response phases are preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity.

Preparation includes plans, playbooks, communication trees, tools, training, and tabletop exercises before an incident occurs.

Detection and analysis use SIEM correlation, indicators of compromise, alert triage, severity classification, and escalation criteria.

Containment may isolate hosts, disable accounts, block indicators, segment networks, or preserve evidence; the chosen strategy balances damage limitation with evidence preservation.

Eradication removes malware, closes the initial access path, and remediates vulnerabilities; recovery restores trusted systems and validates normal operation.

Digital forensics follows order of volatility: CPU registers and cache, memory, network state, running processes, disk, then archival media; write blockers and hashing preserve integrity.

BCP and DR planning use business impact analysis, RTO, RPO, alternate sites, backups, and tested recovery procedures.

Operational metrics include mean time to detect, mean time to respond, mean time between failures, and incident recurrence; lessons learned should update controls and playbooks.

Secure SDLC integrates security activities into requirements, design, coding, testing, deployment, and maintenance; shifting left addresses defects earlier and at lower cost.

OWASP Top 10 categories include injection, broken authentication, sensitive data exposure, XML external entities, broken access control, security misconfiguration, cross-site scripting, insecure deserialization, vulnerable components, and insufficient logging.

Input validation should use allowlists; output encoding prevents cross-site scripting; parameterized queries prevent SQL injection; CSRF tokens protect state-changing requests.

Testing methods include SAST on source or bytecode, DAST against running applications, IAST during execution, SCA for dependencies, and penetration testing for adversarial validation.

Secrets such as API keys and database passwords must not be hardcoded; use a secrets vault, rotation, least-privilege service accounts, and audit access.

Data protection includes encryption in transit and at rest, tokenization, masking, DLP, and classification-based access controls.

API security requires authentication, authorization, rate limiting, schema validation, input size limits, and logging of security-relevant events.

Privacy by design embeds data minimization and purpose limitation into systems; secure disposal and tested backups protect data throughout its lifecycle.