CIPT cheat sheet

The CIA triad: confidentiality limits disclosure, integrity preserves accuracy and completeness, and availability ensures timely, reliable access to data and systems.

Symmetric encryption uses one shared secret key for both encryption and decryption; asymmetric encryption uses a public key to encrypt or verify and a mathematically related private key to decrypt or sign.

Hashing is a one-way function producing a fixed-length digest; it is deterministic and collision-resistant but is not encryption and cannot be reversed.

Salting adds a unique random value to each password before hashing, so identical passwords yield different digests and precomputed rainbow tables fail.

Authentication verifies a claimed identity; authorization determines which resources and actions that identity may use after authentication succeeds.

TLS protects data in transit by negotiating session keys, encrypting traffic, and authenticating the server via a certificate chained to a trusted authority.

A digital certificate binds a public key to an identity and validity period; a public key infrastructure issues, distributes, and revokes these certificates.

Data states are distinct: data at rest resides on storage media, data in transit moves across networks, and data in use is being processed in memory or by a CPU.

Access control models: discretionary (owner decides), mandatory (system labels), role-based (job roles), and attribute-based (contextual attributes such as time, location, device).

GDPR Article 25 requires data protection by design and by default, including pseudonymization, minimization, and transparency embedded into processing from the outset.

GDPR Article 32 requires technical and organizational measures for confidentiality, integrity, availability, and resilience, including encryption and regular testing of effectiveness.

GDPR Article 30 requires controllers to maintain records of processing activities covering purposes, data and subject categories, recipients, transfers, retention, and safeguards.

GDPR Article 35 requires a data protection impact assessment before processing likely to result in high risk, describing the processing, necessity, risks, and mitigations.

A controller determines the purposes and means of processing; a processor acts only on the controller's documented instructions under an Article 28 contract.

The DPO (Articles 37-39) monitors compliance, advises on obligations, cooperates with supervisory authorities, and serves as their contact point.

Cavoukian's seven Privacy by Design principles: proactive not reactive, privacy as the default, privacy embedded into design, full functionality, end-to-end security, visibility and transparency, and respect for user privacy.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

Vendor due diligence covers security posture, sub-processor chains, breach notification terms, audit rights, retention and deletion commitments, and transfer safeguards.

STRIDE classifies threats as Spoofing identity, Tampering with data, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.

Defense in depth layers independent preventive, detective, and corrective controls so a single control failure does not expose the whole system.

Least privilege grants each user, service, and process only the rights required for its function, shrinking the impact of compromise or misuse.

Pseudonymization replaces direct identifiers with pseudonyms; the data stays personal data because re-identification remains possible using separately held additional information.

Anonymization must be irreversible; if any party can single out, link, or infer an individual, the data remains personal data under Recital 26.

k-anonymity requires each record to be indistinguishable from at least k-1 others on quasi-identifiers; it does not defend against homogeneity or background-knowledge attacks.

Tokenization substitutes a sensitive value with a non-sensitive token whose mapping sits in a hardened vault, so a leaked token has no exploitable value.

Injection flaws such as SQL injection and cross-site scripting stem from unvalidated input; parameterized queries and output encoding are the standard mitigations.

Encryption at rest and in transit reduces breach impact, but its effectiveness depends entirely on key management, key separation, and rotation.

Privacy engineering converts legal and policy obligations into verifiable technical requirements, controls, and test cases across the development lifecycle.

Data minimization requires collecting and retaining only personal data that is adequate, relevant, and necessary for the stated purpose.

Purpose limitation binds each data element to the purpose for which it was collected and blocks incompatible secondary reuse absent a lawful basis.

Privacy-enhancing technologies include encryption, differential privacy, secure multiparty computation, homomorphic encryption, and synthetic data generation.

Differential privacy adds calibrated noise to query outputs; the epsilon parameter bounds privacy loss, with smaller epsilon meaning stronger privacy and less utility.

Privacy requirements should be elicited during design, traced to controls, and validated in testing rather than retrofitted after deployment.

Data loss prevention tools classify sensitive data and enforce policies that block, encrypt, or log its movement across endpoints, email, and networks.

Consent management platforms record consent state, purpose, timestamp, and version, and propagate withdrawal signals to downstream systems.

Automated data mapping and records of processing feed retention schedules, deletion workflows, and subject rights fulfillment.

Schrems II (2020) invalidated the EU-US Privacy Shield; transfers now rely on standard contractual clauses plus a transfer impact assessment and supplementary measures.

Cloud shared responsibility divides duties: the provider secures the underlying infrastructure, while the customer secures data, identities, configuration, and access.

Shadow IT, including unsanctioned SaaS and personal accounts, creates unmanaged data flows, unreported processing, and an unpatched attack surface.

IoT devices commonly ship with weak default credentials, infrequent firmware updates, and continuous sensor collection that is difficult to inventory and govern.

Re-identification risk grows with data volume, granularity, and linkage to auxiliary datasets, so de-identification strength must be reassessed as data accumulates.

EU ePrivacy rules require consent for storing or accessing information on a user's device except for strictly necessary purposes, covering cookies and device identifiers.

Key management spans generation, distribution, storage, rotation, revocation, and destruction, and requires separation of duties from data custodians.

Legacy systems may lack encryption, logging, granular access control, or vendor patch support, extending compliance exposure and limiting remediation options.

Biometric data used for unique identification is special category data under GDPR Article 9 and requires an Article 9 condition plus Article 35 assessment in most cases.