CCST Cybersecurity cheat sheet

CIA triad: Confidentiality = only authorized parties can read data; Integrity = data is accurate and unaltered; Availability = authorized access is timely and reliable.

AAA: Authentication proves identity, Authorization grants permissions to that identity, Accounting/Auditing records what the identity did.

Least privilege: every user, service, and process receives only the rights required for its task, and only for as long as required.

Defense in depth layers independent controls (network, host, application, data) so one failed or bypassed control does not expose the asset.

Symmetric encryption uses one shared secret key for both directions (AES); asymmetric encryption uses a public/private key pair (RSA, ECC) and is computationally slower.

Hashing (SHA-256) is one-way and provides integrity evidence; encryption is reversible with a key and provides confidentiality. A hash alone does not hide data.

MFA requires two or more different factor categories: something you know, something you have, something you are. Two passwords are single-factor.

Non-repudiation comes from a digital signature created with the sender's private key and verified with the sender's public key.

Separation of duties splits a sensitive task across two or more people so no single individual can complete and conceal it alone.

OSI model, layer 7 to 1: Application, Presentation, Session, Transport, Network, Data Link, Physical.

TCP is connection-oriented (SYN, SYN-ACK, ACK) and provides reliable ordered delivery with retransmission; UDP is connectionless, best-effort, and has no handshake.

Common ports: 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 3389 RDP. Telnet and HTTP are cleartext.

A stateful firewall tracks connection state and permits return traffic automatically; a stateless ACL evaluates each packet in isolation against fixed rules.

An IDS monitors and alerts passively; an IPS sits inline and can drop or reset the malicious traffic it detects.

VLANs create separate Layer 2 broadcast domains on shared switching hardware; inter-VLAN traffic must pass through a router or Layer 3 switch.

NAT maps private RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) to public addresses, conserving public IPs and hiding internal addressing.

TLS encrypts application traffic in transit and authenticates the server via certificate, giving confidentiality plus integrity on ports such as 443.

A DMZ is a segmented subnet for internet-facing servers, firewalled off from the internal LAN so a compromised public host does not directly reach internal systems.

EDR continuously records endpoint process, file, registry, and network activity, applies behavioral analytics, and can network-isolate a host on demand.

Signature-based antivirus matches known malware patterns; heuristic/behavioral engines flag suspicious actions, which is what catches unknown or polymorphic variants.

Application allowlisting permits only explicitly approved executables to run; unknown malware is blocked by default because it is not on the list.

Full-disk encryption (BitLocker, FileVault) protects data at rest when a device is lost or stolen; it does not protect data in use or in transit.

A host-based firewall filters traffic to and from a single endpoint by port, protocol, and application, independent of the perimeter firewall.

Patch management covers the OS and third-party applications; unpatched software is the most common initial-access vector in real breaches.

MDM/UEM enforces configuration baselines, encryption, screen lock, and remote wipe on managed laptops, phones, and tablets.

Removable media controls (USB blocking or read-only policy) reduce both data exfiltration and malware introduction through removable drives.

Least functionality on an endpoint means disabling unused services, ports, protocols, and local accounts to shrink the attack surface.

Risk = likelihood (threat exploiting a vulnerability) x impact. Reducing either factor reduces the resulting risk.

SLE = asset value x exposure factor. ALE = SLE x ARO (annualized rate of occurrence).

CVSS base score ranges 0.0-10.0: 0 none, 0.1-3.9 low, 4.0-6.9 medium, 7.0-8.9 high, 9.0-10.0 critical.

CVE is a standardized public identifier for one disclosed vulnerability (for example CVE-2021-44228); a CVSS vector supplies the severity rating for it.

A vulnerability assessment enumerates and rates weaknesses without exploiting them; a penetration test actively exploits weaknesses to demonstrate real impact.

Threat = potential cause of harm; vulnerability = weakness that can be exploited; risk = probability and impact of that exploitation occurring.

Qualitative risk uses ratings such as high/medium/low; quantitative risk uses monetary figures such as SLE and ALE.

Risk treatment options: mitigate (add controls), transfer (insurance, contract), avoid (stop the activity), accept (document and retain).

A zero-day is a vulnerability with no vendor patch available, so signature and patch-based defenses cannot stop it; compensating controls must be used.

NIST SP 800-61 phases: 1 Preparation; 2 Detection and Analysis; 3 Containment, Eradication, and Recovery; 4 Post-Incident Activity.

Order of volatility, most to least: CPU registers and cache, RAM, swap/pagefile, network connections, disk, logs, backups and archival media.

Chain of custody records who collected, handled, and transferred each piece of evidence, plus when and why, keeping it admissible and unaltered.

Containment precedes eradication: isolate the host, disable the account, or block the IP to stop spread before removing the cause.

Lessons learned is the post-incident activity that documents root cause, response effectiveness, and the specific changes to make.

Common indicators of compromise: unusual outbound traffic, new or unexpected privileged accounts, mass file encryption, anomalous login times or geography.

Escalation criteria belong in the IR plan; a suspected data breach is escalated to the IR team and management rather than handled locally.

Tabletop exercises are discussion-based walkthroughs that validate roles, communications, and the IR plan without touching production.

Do not power off a suspected compromised machine when volatile memory evidence is needed; capture RAM first, then isolate at the network layer.