CCSM Elite R82 cheat sheet

Reference monitor: three properties are completeness (all accesses mediated), isolation (tamper-proof), and verifiability (provably correct); the TCB enforces it.

Bell-LaPadula protects confidentiality: no read up (simple security property), no write down (*-property), plus discretionary and strong-star variants.

Biba protects integrity: no read down, no write up; Clark-Wilson instead enforces well-formed transactions and separation of duty.

Common Criteria: EAL1-EAL7 rates assurance depth, not product quality or feature set; EAL4 is the typical commercial target.

TCSEC divisions D (minimal), C (discretionary, C1/C2), B (mandatory, B1/B2/B3), A (verified, A1); B1 is the first level requiring labels.

Trusted computing base design principles: least privilege, fail-safe defaults, complete mediation, open design, economy of mechanism, psychological acceptability.

Covert channel types: storage (shared resource) versus timing (clock or response latency); bandwidth is measured in bits per second.

TOGAF ADM phases A-H run architecture vision through migration planning and change management; SABSA maps security to business drivers.

Single loss expectancy SLE = asset value x exposure factor; annualized loss ALE = SLE x annualized rate of occurrence (ARO).

Risk treatment options: mitigate, transfer (insurance), avoid, accept; residual risk is what remains after treatment.

Quantitative analysis uses monetary values; qualitative uses ordinal scales (low/medium/high) and is faster but not directly cost-justifiable.

Control value = ALE before control minus ALE after control minus annual cost of the control.

Risk register fields: asset, threat, vulnerability, likelihood, impact, owner, treatment, residual risk, review date.

ISO 31000 and NIST RMF (SP 800-37) both iterate: categorize, select, implement, assess, authorize, monitor.

Business impact analysis yields RTO (recovery time) and RPO (recovery point); MTD is the maximum tolerable downtime.

Governance separation: board/executives set risk appetite, management owns controls, audit provides independent assurance.

Data lifecycle: create, store, use, share, archive, destroy; each phase needs its own controls and owner accountability.

Roles: data owner (classification and approval), data custodian (technical handling), data steward (quality and semantics), user (compliance).

Classification schemes drive handling: public, internal, confidential, restricted; labels must follow the data across copies and backups.

Scoping and tailoring reduce control overhead: baseline set, then tailor per system impact level (NIST SP 800-53).

Retention is set by legal/regulatory drivers; destruction must be verifiable (certificate of destruction) and match the media type.

Sanitization: overwrite for reuse, degauss for magnetic media, cryptographic erase for self-encrypting drives, physical shredding/incineration for highest assurance.

Data remanence is residual data after nominal deletion; SSD wear-leveling makes single-pass overwrite unreliable.

Asset inventory ties hardware, software, and data to owners; unclassified or unowned assets are the common audit finding.

Authentication factors: something you know, have, are; plus location and behavior as contextual factors; MFA requires two different types.

Access control models: DAC (owner discretion), MAC (labels/clearance), RBAC (role-based, best for churn), ABAC (attributes/policy).

SSO protocols: SAML 2.0 for browser federation, OAuth 2.0 for delegated authorization, OIDC adds an identity layer (ID token) on OAuth.

Kerberos: KDC issues TGT, then service tickets; tickets are time-limited and rely on symmetric keys and loosely synchronized clocks.

Identity lifecycle: proofing, provisioning, entitlement review, deprovisioning; orphaned accounts are the top access risk.

Least privilege plus separation of duties; privileged access management vaults credentials and records sessions.

Password storage: salted, slow hashes (bcrypt, scrypt, Argon2); never reversible encryption; NIST 800-63B favors length over composition rules.

Federation trust is established by signing keys and metadata exchange; certificate/key rotation is the usual outage cause.

Vulnerability scan finds candidate weaknesses; penetration test proves exploitability; both differ from a control audit.

Test types: black box (no knowledge), gray box (partial), white box (full); scope and rules of engagement must be written and signed.

False positive = reported issue that is not real; false negative = missed real issue; tune to reduce both, track them as metrics.

CVSS base score covers exploitability and impact; temporal and environmental metrics adjust it; CVSS is not a risk score by itself.

Sampling: statistical (random, supports inference) versus non-statistical (judgmental, convenience); audit evidence must be sufficient and appropriate.

Coverage metrics for testing programs: percentage of assets scanned, mean time to remediate by severity, retest pass rate.

Synthetic transactions and log review validate detective controls; tabletop exercises validate response plans without production impact.

Chain of custody and hashing of evidence preserve admissibility for forensic or disciplinary use.

Incident response phases: preparation, detection and analysis, containment/eradication/recovery, post-incident lessons learned.

Containment choices: isolate host, block indicator, disable account; preserve volatile evidence (memory, connections) before powering off.

SIEM correlation plus SOAR playbooks; detection engineering uses MITRE ATT&CK techniques as a coverage map.

Backup rule 3-2-1: three copies, two media types, one offsite; immutable or air-gapped copies defeat ransomware encryption.

Change management: request, impact assessment, approval, test, backout plan, implementation, review; emergency changes are retro-approved.

DR metrics: RTO (time to restore), RPO (data loss tolerance), MTTR (mean repair), MTBF (mean between failures).

Log retention must match legal hold and investigation needs; centralized, time-synchronized (NTP) logs are the baseline.

Segregation of duties in operations: the person who deploys is not the person who approves production access.

SDLC security gates: threat modeling at design, SAST in code, SCA for dependencies, DAST in test, RASP/WAF at runtime.

Threat modeling frameworks: STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation) and attack trees.

OWASP Top 10 categories include broken access control, injection, cryptographic failures, insecure design, and SSRF.

SAST analyzes source/bytecode without running it (early, high false positives); DAST tests a running app (later, runtime-visible issues).

Input validation: allowlist over denylist; parameterized queries stop SQL injection; output encoding stops XSS.

Secrets must not live in source or images; use a vault or managed identity with rotation; scan repositories for committed keys.

DevSecOps shifts controls left and automates them in CI/CD; a failed gate must block promotion, not just warn.

Supply chain: SBOM (SPDX, CycloneDX), dependency pinning, signature verification, and provenance attestation.

OSI layers 1-7: physical, data link, network, transport, session, presentation, application; map each control to its layer.

TLS handshake authenticates the server via certificate chain, negotiates cipher suite, derives session keys; TLS 1.3 removed static RSA key exchange.

IPsec modes: transport (host-to-host, payload protected) versus tunnel (gateway-to-gateway, whole packet encapsulated); AH has no encryption, ESP does.

Segmentation: VLANs at layer 2, subnets and ACLs at layer 3, security groups and microsegmentation at the workload level.

Firewall types: packet filter (L3/L4), stateful inspection (connection table), application proxy/WAF (L7 content awareness).

Wi-Fi: WPA2/WPA3 with AES-CCMP; 802.1X with EAP authenticates users/devices; WPS and WEP are deprecated and unsafe.

DNS risks: cache poisoning, tunneling for exfiltration, DDoS amplification; mitigations are DNSSEC, response policy zones, and rate limiting.

Zero trust replaces perimeter trust with per-request verification of identity, device posture, and least-privilege access.