NISP L1 PT cheat sheet

CIA triad: Confidentiality (only authorized disclosure), Integrity (accuracy and completeness), Availability (timely, reliable access); a control usually strengthens one and may trade off against another.

Risk = Threat × Vulnerability × Impact. Controls reduce vulnerability (preventive), detect during/after the event (detective), or restore after it (corrective).

Defense in depth layers people, process, and technology controls so a single failure does not cause compromise; no single control is assumed sufficient.

Least privilege, need-to-know, separation of duties, and job rotation are administrative controls that limit insider and error-driven risk.

Data classification (e.g., public, internal, confidential, restricted) drives handling rules; labeling and ownership assignment must follow classification.

Social engineering exploits authority, urgency, fear, and helpfulness. Verification callback on a known number defeats most vishing and CEO-fraud attempts.

Phishing indicators: mismatched display name and domain, lookalike domains, urgency, unexpected attachments, credential-harvesting links; report rather than forward to colleagues.

Security awareness effectiveness is measured by simulation click/report rates and completion data, not by training hours delivered.

OSI layers 1-7: Physical, Data Link, Network, Transport, Session, Presentation, Application; TCP/IP maps to Link, Internet, Transport, Application.

TCP is connection-oriented with a three-way handshake (SYN, SYN-ACK, ACK); UDP is connectionless with no handshake or delivery guarantee.

Stateful firewalls track connection state; stateless ACLs filter per packet. Default-deny inbound plus explicit allow rules is the standard posture.

NAT hides internal addresses but is not a security control; it complicates logging and inbound filtering decisions.

VLANs segment Layer 2 broadcast domains; inter-VLAN traffic must pass a router or firewall to be filtered.

IDS detects and alerts; IPS detects and blocks inline. Signature detection matches known patterns; anomaly detection baselines normal behavior.

Common ports: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 445 SMB, 3389 RDP; 802.1X controls port-based network access.

DNS poisoning, ARP spoofing, and on-path attacks target name resolution and Layer 2 trust; DNSSEC and dynamic ARP inspection mitigate them.

Hardening baseline: remove unused services and accounts, disable default credentials, apply vendor security configurations, and keep OS and applications patched.

Patch tiers: critical security updates are applied on a short defined cycle; emergency out-of-band patching applies to actively exploited vulnerabilities.

Antimalware types: signature-based, heuristic/behavioral, and EDR, which records endpoint telemetry and supports response actions such as isolation.

Application allowlisting permits only approved executables; it blocks unapproved malware even when signatures are unknown.

Full-disk encryption protects data at rest if a device is lost or stolen; it does not protect data while the host is running and unlocked.

Host firewall rules and endpoint logging (process creation, logon events) are primary evidence sources for host investigation.

Windows Event ID 4624 = successful logon, 4625 = failed logon, 4688 = process creation; Linux authentication is logged in /var/log/auth.log or secure.

Mobile and BYOD controls: device encryption, screen lock, remote wipe, and separation of corporate data via containerization.

OWASP Top 10 categories include broken access control, injection, insecure design, security misconfiguration, and vulnerable components; injection occurs when untrusted input reaches an interpreter.

Prepared statements with parameter binding stop SQL injection; input validation and output encoding stop cross-site scripting (XSS).

Access control must be enforced server-side on every request; hiding a URL or UI element is not an access control.

SDLC security gates: threat modeling at design, SAST on source, DAST on running applications, dependency scanning on third-party components.

Secrets (API keys, passwords) belong in a secrets manager or environment configuration, never in source code repositories.

Data at rest uses encryption and access controls; data in transit uses TLS. Data minimization and retention limits reduce breach impact.

Backup rule 3-2-1: three copies, two media types, one offsite. Restore testing, not backup completion, proves recoverability.

Secure coding requires validating on the server, failing safely without leaking stack traces, and logging security-relevant events.

Authentication proves identity; authorization determines permitted actions; accounting/auditing records what happened. AAA = Authentication, Authorization, Accounting.

Factors: something you know, something you have, something you are. MFA requires two different factor types; two passwords are not MFA.

Access control models: DAC (owner discretion), MAC (labels/clearances), RBAC (roles), ABAC (attributes/policy).

Least privilege and need-to-know limit entitlements; periodic access recertification removes accumulated privilege creep.

Password storage must use salted, slow hashes (bcrypt, scrypt, Argon2, PBKDF2); fast hashes like MD5 or SHA-1 are unsuitable.

Single sign-on via SAML or OIDC centralizes authentication; federated identity relies on a trusted identity provider assertion.

Privileged accounts require separate credentials, vaulting, session logging, and just-in-time elevation; shared admin accounts break accountability.

Account lifecycle: provisioning on join, modification on role change, and prompt deprovisioning on termination; orphaned accounts are a common audit finding.

Symmetric encryption uses one shared key and is fast (AES); asymmetric uses a public/private pair and solves key distribution (RSA, ECC).

Hybrid approach: asymmetric exchange or agreement establishes a symmetric session key; bulk data is then encrypted symmetrically.

Hashing is one-way and fixed-length (SHA-256); it provides integrity, not confidentiality. A MAC adds a shared key for authenticity.

Digital signature = hash of the message encrypted with the sender's private key; verification uses the sender's public key and proves integrity and origin.

PKI chain: root CA signs intermediate CA, which signs end-entity certificates. A certificate binds a public key to an identity and is validated by chain, validity dates, and revocation.

Revocation is checked by CRL (periodic list) or OCSP (real-time query); expired or revoked certificates must be rejected.

Key management lifecycle: generation, distribution, storage, rotation, and destruction; key compromise invalidates all protection the key provided.

TLS provides confidentiality, integrity, and server authentication; certificate warnings indicate a broken trust chain and should not be bypassed.

Core SOC functions: monitoring, triage, investigation, containment, eradication, recovery, and lessons learned; documented playbooks make response repeatable.

Incident response phases: preparation, identification, containment, eradication, recovery, lessons learned. Containment precedes eradication to stop spread.

Change management requires request, risk assessment, approval, testing, and rollback plan; emergency changes are logged and reviewed after the fact.

Vulnerability management cycle: inventory, scan, prioritize by severity and exploitability, remediate, verify. CVSS score alone does not set priority.

Log retention and time synchronization (NTP) are prerequisites for correlation; inconsistent clocks break timeline reconstruction.

Backup and disaster recovery metrics: RTO is maximum tolerable downtime; RPO is maximum tolerable data loss measured in time.

Segregation of duties prevents one person from both making and approving a change or from administering and auditing the same system.

Third-party risk management requires due diligence, contractual security requirements, and periodic reassessment of suppliers.

Detection sources: SIEM correlation, IDS/IPS alerts, EDR telemetry, firewall and proxy logs, authentication logs, and user reports.

SIEM normalizes and correlates logs and generates alerts; tuning reduces false positives but risks missing true positives if over-suppressed.

Indicator types: IP addresses, domains, file hashes, URLs, and behavioral patterns. Atomic indicators are easily changed by attackers; behaviors persist longer.

Malware categories: virus, worm (self-propagating), trojan (disguised), ransomware (encrypts and demands payment), rootkit (hides), spyware (collects).

Incident triage determines scope, severity, and affected assets; evidence must be preserved with chain of custody before remediation destroys it.

Containment options include host isolation, account disablement, network segmentation, and blocking indicators at the perimeter.

Phishing response: quarantine the message, identify all recipients, reset exposed credentials, block the sender/domain, and check for mailbox rules created by attackers.

Post-incident review produces root cause, control gaps, and tracked corrective actions; metrics include time to detect and time to contain.

ISO/IEC 27001 specifies requirements for an information security management system (ISMS); ISO/IEC 27002 provides implementation guidance controls.

NIST Cybersecurity Framework functions: Identify, Protect, Detect, Respond, Recover (plus Govern in newer versions); it is voluntary guidance, not a certification.

PCI DSS applies to organizations storing, processing, or transmitting payment card data; it mandates encryption, access control, logging, and segmentation scope reduction.

GDPR governs personal data of EU data subjects: lawful basis, data subject rights, breach notification generally within 72 hours, and penalties up to 4% of global turnover.

China's Cybersecurity Law, Data Security Law, and Personal Information Protection Law (PIPL) impose classification, cross-border transfer, and consent requirements.

HIPAA protects protected health information in the US; SOX mandates financial reporting controls and IT general controls for public companies.

Compliance is evidence-based: policies, records, audit logs, and test results demonstrate control operation; a certificate alone does not prove effectiveness.

Audit concepts: evidence sampling, segregation of duties, and corrective action plans; nonconformities require root cause and verified closure.