NISP Level 1 - Security Operations cheat sheet

CIA triad: Confidentiality (authorized disclosure only), Integrity (accuracy and completeness), Availability (timely, reliable access). Non-repudiation and authenticity are supporting properties.

Defense in depth layers controls so no single failure grants full compromise; the weakest link determines overall system security.

Bell-LaPadula enforces confidentiality: no read up (simple security property), no write down (*-property). Biba enforces integrity with the reverse: no read down, no write up.

Clark-Wilson enforces integrity through well-formed transactions and separation of duties between users and transformation procedures.

Brewer-Nash (Chinese Wall) prevents conflicts of interest by dynamically restricting access based on prior access history.

Least privilege, separation of duties, need-to-know, and fail-safe defaults reduce attack surface and limit blast radius.

Threat + vulnerability + impact = risk; a control reduces likelihood or impact, never the threat actor's intent.

Reference monitor must be tamper-proof, always invoked, and verifiable; TCB is the portion of a system enforcing security policy.

Common criteria rates assurance via EALs 1-7; higher EAL means more rigorous evaluation, not necessarily more features.

GDPR applies to processing of EU data subjects' personal data regardless of the controller's location; lawful basis, data subject rights, 72-hour breach notification to the supervisory authority.

China's Cybersecurity Law, Data Security Law, and Personal Information Protection Law form the core triad; MLPS 2.0 (等级保护) mandates graded protection levels 1-5 with level 3+ requiring periodic assessment.

PCI DSS v4.0 has 12 requirement families covering network security, encryption, access control, monitoring, and testing; SAQ type depends on card data handling.

ISO/IEC 27001 certifies an ISMS; ISO/IEC 27002 provides implementation guidance; ISO/IEC 27701 extends to privacy management.

SOX Section 404 requires management assessment of internal controls over financial reporting; ITGCs support that assertion.

HIPAA Security Rule covers administrative, physical, and technical safeguards for ePHI in the US; Privacy Rule governs use and disclosure.

NIST CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond, Recover. NIST SP 800-53 provides control catalog; 800-171 covers CUI.

Compliance is adherence to a requirement set; it is a baseline, not proof of adequate security. Audit evidence must be reproducible and retained.

Authentication factors: something you know, have, are; MFA requires two or more distinct factor types, not two instances of one type.

AAA = Authentication (who), Authorization (what), Accounting (what happened). Access control models: DAC, MAC, RBAC, ABAC, RuBAC.

RBAC assigns permissions to roles, roles to users; role explosion is a known scaling risk. ABAC evaluates attributes of subject, resource, action, and environment.

SAML 2.0 is XML-based browser SSO; OAuth 2.0 is delegated authorization, not authentication; OpenID Connect adds an identity layer over OAuth.

Kerberos uses a KDC (AS + TGS) and time-limited tickets; clock skew beyond the tolerance (commonly 5 minutes) breaks authentication.

Password storage must use salted, slow hashes (bcrypt, scrypt, Argon2, PBKDF2); never reversible encryption or unsalted fast hashes.

Privileged access management: just-in-time elevation, session recording, vaulting of credentials, and periodic recertification of entitlements.

Federation relies on a trust relationship between IdP and SP; identity proofing strength should match the assurance level required (e.g., NIST SP 800-63 IAL/AAL).

Zero trust replaces implicit network trust with per-request verification based on identity, device posture, and context.

OSI layers: 3 routing, 4 transport (TCP/UDP ports), 7 application. Stateful firewalls track connection state; stateless ACLs evaluate each packet independently.

Next-gen firewalls add application identification, IPS, and TLS inspection; WAF protects HTTP(S) applications at layer 7 against injection, XSS, and similar.

IDS detects and alerts; IPS detects and blocks inline. Signature detection misses novel attacks; anomaly detection produces higher false positives.

DMZ segments externally reachable services from internal networks; dual-homed hosts and strict inter-zone rules limit lateral movement.

IPsec: AH provides integrity/authentication only; ESP provides confidentiality plus integrity. IKE negotiates SAs; transport mode vs tunnel mode differ in header protection.

TLS 1.2/1.3 protect data in transit; certificate validation, HSTS, and disabling legacy protocols (SSLv3, TLS 1.0/1.1) are baseline hardening.

802.1X with EAP controls wired and wireless port access; WPA2/WPA3 Enterprise uses per-user credentials rather than a shared PSK.

Common attacks: ARP spoofing, DNS cache poisoning, VLAN hopping, on-path interception, DDoS (volumetric, protocol, application layer).

Network segmentation and microsegmentation reduce east-west exposure; egress filtering limits command-and-control traffic.

Hardening baseline: remove unnecessary services, disable default accounts, apply least privilege, enforce patch SLAs, enable host firewall and logging.

EDR provides continuous endpoint telemetry, behavioral detection, and response actions; antivirus signature matching alone is insufficient against fileless and living-off-the-land techniques.

Windows: Group Policy/Intune baselines, LAPS for local admin passwords, Credential Guard, AppLocker/WDAC, audit policy for logon and privilege events.

Linux: SELinux/AppArmor mandatory access control, sudoers least privilege, file permissions and umask, SSH key-based auth with root login disabled.

Patch management lifecycle: inventory, classify by severity, test, deploy, verify, and document exceptions with compensating controls.

Application allowlisting and script-blocking mitigate execution of unapproved binaries; PowerShell logging and AMSI support detection.

Server hardening includes CIS Benchmarks, minimal installed roles, encrypted boot volumes, and centralized time synchronization for log correlation.

Full-disk encryption protects data at rest on lost devices; secure boot and measured boot defend boot integrity.

OWASP Top 10 categories include broken access control, cryptographic failures, injection, insecure design, security misconfiguration, and SSRF.

SQL injection is prevented by parameterized queries and least-privilege database accounts, not by input escaping alone. XSS is mitigated by output encoding and CSP.

SSDLC embeds threat modeling at design, SAST in code, DAST in test, SCA for dependencies, and security gates in CI/CD.

Data classification (public, internal, confidential, restricted) drives handling, retention, encryption, and access requirements.

Data states: at rest, in transit, in use (memory). DLP inspects egress channels; tokenization replaces sensitive values with non-sensitive surrogates.

CSRF defenses use anti-CSRF tokens and SameSite cookies; broken access control requires server-side authorization checks on every request.

Secure defaults and fail-safe behavior: deny by default, avoid verbose error messages, and keep secrets out of source code (use a vault).

Logging and monitoring of application events must avoid recording secrets or full cardholder data; mask sensitive fields.

Symmetric ciphers (AES, ChaCha20) are fast and use one shared key; asymmetric (RSA, ECC) solve key distribution and enable signatures.

AES key sizes 128/192/256; RSA key sizes commonly 2048+ (3072 recommended); ECC offers equivalent strength at shorter lengths.

Hashes (SHA-256, SHA-3) provide integrity and are one-way; MD5 and SHA-1 are deprecated for security use. HMAC adds a shared key to a hash.

Digital signature = hash encrypted with signer's private key; verification uses the public key and provides integrity, authenticity, and non-repudiation.

Key lifecycle: generation, distribution, storage, rotation, retirement, destruction. Keys must never be stored alongside the data they protect.

PKI: CA issues certificates binding identity to public key; CRL and OCSP handle revocation. Certificate pinning and chain validation matter.

Modes of operation: GCM provides authenticated encryption; ECB leaks patterns and should not be used for multi-block data. IVs/nonces must be unique per key.

Perfect forward secrecy comes from ephemeral key exchange (ECDHE); compromise of long-term keys does not reveal past sessions.

Post-quantum migration: inventory long-lived confidentiality data now and plan hybrid key exchange.

SOC tiers: Tier 1 triage, Tier 2 investigation, Tier 3 threat hunting/response; escalation criteria and playbooks define handoffs.

Change management requires request, risk assessment, approval, test, implementation, and rollback plan; emergency changes get retrospective review.

Incident response lifecycle: preparation, detection and analysis, containment, eradication, recovery, lessons learned (NIST SP 800-61).

Evidence handling preserves chain of custody: hash on collection, write-blockers, documented transfers, and secure storage.

Log sources: endpoint, network, identity, cloud, application; centralized SIEM with normalized time (UTC) and retention aligned to policy.

Security metrics: MTTD, MTTR, alert volume, false positive rate, patch latency, and coverage of monitored assets.

Threat intelligence feeds (IOC, TTP) enrich detection; MITRE ATT&CK maps adversary behavior to defensive coverage.

Runbooks and tabletop exercises validate response capability; playbook automation (SOAR) reduces manual triage time.

Detection techniques: signature, anomaly, behavioral, and threat hunting across logs and telemetry.

Use cases: brute force, impossible travel, privilege escalation, data exfiltration, malware beaconing, unauthorized configuration change.

SIEM correlation rules combine events across sources; tuning reduces alert fatigue while preserving coverage.

Containment options: isolate host, disable account, block IP/domain, revoke tokens; choose based on business impact and evidence preservation.

Communication plan includes internal stakeholders, legal, PR, and regulators; notification timelines depend on jurisdiction (e.g., GDPR 72 hours).

Post-incident review produces root cause, control gaps, and tracked corrective actions with owners and dates.

Forensic order of volatility: CPU/registers, memory, network state, disk, remote logs, backups.

Incident severity classification drives escalation; define P1-P4 criteria by scope, data sensitivity, and business impact.

Lifecycle: asset inventory, scan, validate, prioritize, remediate, verify, report. Scanning without remediation is not vulnerability management.

CVSS base score reflects intrinsic severity; temporal and environmental scores adjust for exploit maturity and local context. EPSS estimates exploitation probability.

CISA KEV catalog identifies vulnerabilities known to be exploited; prioritize KEV entries over raw CVSS ranking.

Scan types: unauthenticated (external view), authenticated (host-level detail), agent-based, and web application scanning.

False positives and false negatives must be triaged; exceptions require documented compensating controls and expiration dates.

Patch SLAs commonly tier by severity, e.g., critical within 15 days, high within 30, medium within 90; adjust to risk appetite.

Vulnerability vs exploit vs threat: a vulnerability is a weakness, an exploit is the method, a threat is the actor or event.

Continuous scanning and asset discovery catch shadow IT; report trends and aging of open findings to management.

Risk = likelihood × impact. Qualitative (high/medium/low) and quantitative (ALE = SLE × ARO) approaches; SLE = asset value × exposure factor.

Risk treatment options: mitigate, transfer (insurance), avoid, accept. Residual risk must be documented and approved by the risk owner.

Risk register records asset, threat, vulnerability, likelihood, impact, score, owner, treatment, and review date.

Threat modeling methods: STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation) and attack trees.

Audit types: internal, external, certification, compliance. Evidence must be sufficient, reliable, and relevant.

Control types: preventive, detective, corrective, deterrent, compensating. Control categories: administrative, technical, physical.

Audit findings are rated by risk; management responses include remediation plan, owner, and target date.

Business impact analysis feeds risk assessment by identifying critical processes and tolerable downtime.

RTO = maximum tolerable downtime; RPO = maximum tolerable data loss. Both derive from BIA and drive recovery design.

Backup types: full, incremental (changes since last backup), differential (changes since last full). Restore time differs by chain length.

3-2-1 rule: three copies, two media types, one offsite; add immutable/offline copy for ransomware resilience.

Backups must be encrypted, access-controlled, and tested by restore drills; untested backups are unverified assumptions.

BCP scope covers people, facilities, suppliers, and communications; DR focuses on IT systems recovery.

Recovery strategies: hot site (near-zero downtime), warm site (partial), cold site (minimal), plus cloud failover and pilot light.

Crisis management includes activation criteria, command structure, and stakeholder communication plan.

Exercise types: tabletop, simulation, parallel test, full failover. Results update the plan and validate RTO/RPO.

CIA triad is the standard baseline; integrity failures include unauthorized modification and loss of provenance.

Access control models differ by who sets policy: owner (DAC), system (MAC), role (RBAC), attributes (ABAC).

Security architecture should assume breach and design for containment, detection, and recovery.

Policies, standards, procedures, and guidelines form a hierarchy; policy states intent, procedure states steps.

Risk appetite defines acceptable residual risk; risk tolerance sets thresholds for action.

Regulation is legally binding; standard is a consensus specification; framework is a structured approach.

Data residency and cross-border transfer rules vary by jurisdiction; map data flows before designing controls.

Records retention and legal hold requirements override routine deletion schedules.

Contractual obligations (e.g., customer security addenda) can exceed statutory minimums.

Compliance mapping between frameworks reduces duplicate evidence collection.

Session management: short-lived tokens, secure cookie flags, idle and absolute timeouts, revocation on privilege change.

Privileged accounts require stronger authentication and separate administrative identities.

Access reviews should be periodic, risk-based, and documented with approver identity.

Directory services (AD, LDAP) centralize identity; SSO reduces credential sprawl but concentrates risk.

Account lifecycle: provisioning, modification, deprovisioning; orphaned accounts are a common audit finding.

Firewall rule hygiene: default deny, documented business justification, periodic review, and removal of stale rules.

VPNs extend trust; split tunneling and endpoint posture checks affect exposure.

DNS security: DNSSEC for integrity, filtering for malicious domains, monitoring for tunneling.

Wireless security: strong encryption, rogue AP detection, guest network isolation.

Network monitoring: NetFlow, packet capture, IDS alerts; baseline normal traffic to detect anomalies.

Privilege management: remove local admin rights, use just-in-time elevation, audit privileged actions.

Logging must include process creation, authentication events, and configuration changes.

Endpoint encryption keys must be escrowed for recovery but protected from unauthorized access.

Server baseline drift detection compares current configuration to approved state.

Secure decommissioning includes data sanitization per media type and certificate/key revocation.

Input validation should be allowlist-based and enforced server-side.

Secrets management: vault, rotate, audit access; never commit secrets to repositories.

API security: authentication, rate limiting, schema validation, and authorization per object.

Secure code review and dependency scanning catch issues before deployment.

Data retention and secure disposal reduce exposure and regulatory risk.

Key management standards: FIPS 140-3 for module validation, KMIP for key lifecycle interoperability.

Encryption at rest must protect keys separately from data, ideally in HSM or KMS.

Certificate lifecycle: request, validate, issue, deploy, renew, revoke.

Random number generation must use a cryptographically secure source.

Crypto agility allows algorithm replacement without redesigning systems.

Operational runbooks define repeatable tasks and escalation paths.

Asset inventory is a prerequisite for monitoring, patching, and risk assessment.

Configuration management baselines reduce drift and support audit.

Vendor and third-party risk management covers supplier access and data handling.

Security awareness training reduces phishing susceptibility and is measurable.

Alert triage criteria: severity, asset criticality, data sensitivity, and known exploitation.

Incident documentation must be contemporaneous and retained per policy.

Containment should preserve evidence and avoid destroying logs.

Regulatory notification decisions require legal review and documented rationale.

Lessons learned should produce measurable control improvements.

Asset criticality affects remediation priority alongside CVSS.

Authenticated scans provide more accurate results than unauthenticated scans.

Scanning windows should avoid production impact and be coordinated with change management.

Exception management requires risk acceptance by the asset owner.

Metrics: mean time to remediate, percentage of assets scanned, open critical findings.

Risk assessment should be repeatable and documented with assumptions.

Quantitative analysis requires reliable asset valuation and incident frequency data.

Audit scope defines boundaries, criteria, and evidence requirements.

Findings should be traceable to criteria and supported by evidence.

Management review closes the loop between assessment and action.

BIA identifies critical processes, dependencies, and recovery priorities.

Backup schedules must align with RPO; restore testing validates RTO.

Immutable backups and offline copies defend against ransomware encryption.

DR plans require defined roles, contact lists, and activation authority.

Exercises should include suppliers and communication channels, not just IT systems.