CISSP cheat sheet

Risk = likelihood × impact; ALE = SLE × ARO, where SLE = asset value × exposure factor.

Risk treatment options are mitigate, transfer, avoid, and accept; accepting with no action is sometimes called risk rejection.

RTO is the maximum tolerable downtime; RPO is the maximum tolerable data loss; MTD is the total time before impact becomes unacceptable, and RTO must be shorter than MTD.

Due care is the standard of reasonable protection actually applied; due diligence is the ongoing verification (audits, reviews) that it is being applied.

Control types: directive (policy), preventive, detective, corrective, deterrent, recovery, and compensating.

Quantitative analysis uses monetary values (AV, EF, SLE, ALE); qualitative analysis uses ordinal rankings or scales.

A data controller determines the purpose and means of processing; a processor acts only on the controller's documented instructions.

The BIA identifies critical business functions and dependencies and drives the selection of RTO and RPO values for the DR plan.

Risk appetite is the amount of risk an organization is willing to accept; risk tolerance is the acceptable variation around that appetite.

The data owner is a senior manager accountable for classification and access decisions; the custodian implements controls; the steward handles quality and metadata; the user follows handling rules.

NIST SP 800-88 sanitization levels are clear (logical, media reusable), purge (strongest logical protection), and destroy (physical destruction).

Degaussing does not reliably sanitize flash or solid-state media; cryptographic erasure destroys the key that protects the data.

Data remanence is residual data left after nominal deletion; countermeasures are overwriting, degaussing, crypto-erasure, and physical destruction.

Data states are at rest (storage encryption), in transit (TLS, IPsec), and in use (memory, secure enclaves); each state needs its own controls.

A typical classification hierarchy is public, internal, confidential, and restricted; the label dictates handling, labeling, and destruction requirements.

Retention periods are set by legal, regulatory, and contractual requirements, and destruction must be documented and verifiable.

Asset lifecycle: acquisition, inventory and ownership, classification, handling, monitoring, and decommissioning with sanitization.

Bell-LaPadula enforces confidentiality with no read up and no write down; Biba enforces integrity with no read down and no write up.

A reference monitor must be tamper-proof, always invoked (complete mediation), and small enough to be verified; the TCB is the totality of protection mechanisms.

Operation modes: dedicated (single classification), system high (clearance held but not all need-to-know), compartmented (need-to-know but not all cleared), multilevel (both enforced by the system).

Covert channels are storage (writing to a shared resource) or timing (modulating delay); mitigations include bandwidth limiting, noise, and resource partitioning.

A digital signature provides integrity, authentication, and non-repudiation but not confidentiality; it is created with the sender's private key and verified with the public key.

Common Criteria assurance levels run EAL1 to EAL7, where EAL7 is formally verified design and testing; a higher EAL reflects assurance of stated claims, not absolute strength.

Symmetric algorithms (AES-128/256, ChaCha20) are fast but need secure key distribution; asymmetric algorithms (RSA, ECC, Diffie-Hellman) solve distribution and enable key exchange.

Fail-safe defaults deny access unless explicitly permitted; fail-secure preserves confidentiality on failure, while fail-open is chosen when safety or availability dominates.

A TPM stores keys and measurements for attestation; an HSM performs cryptographic operations inside tamper-resistant hardware.

OSI layers are Physical, Data Link, Network, Transport, Session, Presentation, and Application; the TCP/IP model collapses the top three into one Application layer.

IPsec AH provides integrity, origin authentication, and anti-replay but no encryption; ESP provides confidentiality plus optional integrity; transport mode is host-to-host, tunnel mode is gateway-to-gateway.

TLS provides confidentiality and integrity for application traffic and server authentication, but it does not by itself provide non-repudiation.

802.1X provides port-based network access control using EAP; WPA3 replaces the WPA2 PSK handshake with SAE, adding forward secrecy.

A stateful firewall tracks session state; a proxy firewall terminates and inspects the connection; a WAF inspects HTTP at Layer 7.

A network IDS is passive and alerts, an IPS is inline and blocks, and a honeypot is a deception system used for detection and intelligence.

Segmentation uses VLANs at Layer 2, ACLs and routing at Layer 3, and microsegmentation per workload; a DMZ hosts internet-facing services between two firewalls.

DNSSEC provides origin authentication and integrity for DNS records through signatures; it does not encrypt queries.

ARP spoofing enables on-LAN man-in-the-middle attacks; mitigations include dynamic ARP inspection and port security.

Authentication factors are knowledge, possession, and inherence, with location and behavior sometimes added; MFA requires different factor types, not multiple instances of one type.

Biometric accuracy: FAR is the false acceptance rate, FRR the false rejection rate, and the crossover error rate is where they are equal, with a lower CER meaning better accuracy.

MAC enforces access via labels and clearances; DAC leaves decisions to the resource owner; RBAC grants through roles; ABAC evaluates subject, object, action, and environment attributes.

Kerberos uses a KDC that issues a TGT after initial authentication, then service tickets; it is symmetric-key based and time-sensitive due to clock skew limits.

SAML is XML-based browser SSO federation; OAuth 2.0 delegates authorization via access tokens and is not an authentication protocol; OIDC adds an identity layer with a JWT ID token.

RADIUS combines authentication and authorization and encrypts only the password; TACACS+ separates the AAA functions and encrypts the entire payload.

Provisioning lifecycle: joiners are provisioned to least privilege, movers have old rights removed before new ones are added, and leavers are deprovisioned promptly.

Separation of duties prevents single-person fraud; least privilege and need-to-know limit access; privileged accounts require PAM, vaulting, and just-in-time elevation.

SSO reduces credential sprawl but concentrates risk, since compromise of the primary identity exposes every federated resource.

A vulnerability assessment identifies and ranks weaknesses; a penetration test exploits them to demonstrate impact and requires written authorization and defined scope.

A false positive reports a vulnerability that does not exist; a false negative misses one that does, and is generally the more dangerous error.

CVSS scores severity from 0 to 10 using base metrics (AV, AC, PR, UI, S, C, I, A) adjusted by temporal and environmental metrics.

Black-box testing assumes no prior knowledge, white-box testing provides full code and configuration knowledge, and gray-box testing provides partial knowledge.

SAST analyzes source code without executing it; DAST probes a running application externally; IAST uses runtime instrumentation during testing.

DR test progression by increasing risk: read-through, walkthrough/tabletop, simulation, parallel processing, then full interruption.

SOC 2 Type I reports control design at a point in time; Type II reports operating effectiveness over a period; SOC 3 is a public general-use report.

Log review must be performed independently of system administrators, logs must be time-synchronized via NTP, and retention must match policy and legal hold.

Synthetic monitoring exercises availability and transaction paths from a user perspective without requiring real users.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

Order of volatility runs from CPU registers and cache, to RAM, swap and pagefile, network state, disk, then backups and archival media.

Chain of custody records who handled evidence, when, and why; forensic images are hashed to prove integrity and analysis is performed on copies.

A full backup copies all data; an incremental copies changes since the last backup of any type; a differential copies changes since the last full; restore needs the last full plus the latest differential.

RAID provides availability and redundancy, not backup or offsite retention; hot sites resume quickly, warm sites need setup, cold sites are shells.

Change management sequence: request, impact analysis, CAB approval, testing, implementation, verification, and a documented back-out plan.

Fire classes pair with agents: water for ordinary combustibles, CO2 or clean agent for energized electrical equipment, and halon is ozone-depleting.

A UPS carries short outages; a generator covers extended ones; dual power feeds and diverse telecom paths provide redundancy.

A SIEM correlates and alerts on log events, DLP detects or blocks data exfiltration, and UEBA baselines behavior to flag anomalies.

SDLC phases are requirements, design, development, testing, deployment, maintenance, and disposal; security activities belong in every phase, not only testing.

SQL injection is prevented primarily by parameterized queries and prepared statements plus input validation; XSS is prevented by output encoding and content security policy.

DevSecOps shifts security left with automated SAST, DAST, and dependency scanning in the CI/CD pipeline, and secrets stored in vaults rather than code.

CMMI has five levels (initial, managed, defined, quantitatively managed, optimizing); BSIMM and SAMM measure software security practices.

Aggregation combines low-sensitivity data into a sensitive result; inference deduces hidden data from available data; polyinstantiation stores multiple versions to block inference.

Database transaction properties are ACID: atomicity, consistency, isolation, and durability.

Open-source components require license compliance and vulnerability tracking via an SBOM; COTS acquisitions need security clauses and source escrow for continuity.

Version control, baselining, and peer code review enforce change control and prevent unauthorized or accidental modification.

A backdoor is a hidden access path, a rootkit conceals itself at privileged level, and file integrity monitoring detects unauthorized code changes.