NISP Level 1 - Security Awareness cheat sheet

The CIA triad defines three protection goals: Confidentiality (only authorized parties can read data), Integrity (data is accurate and unaltered), and Availability (data and systems are accessible when needed).

Confidentiality is enforced by encryption, access control lists, and classification labels; integrity by hashing, checksums, version control, and digital signatures; availability by redundancy, backups, and DDoS protection.

Authentication verifies identity; authorization determines what an authenticated identity may do; accounting/auditing records what was done. These are three distinct controls, not synonyms.

Defense in depth means layering independent controls (technical, administrative, physical) so that failure of one control does not expose the asset.

Least privilege: every user, process, and service receives only the minimum rights required for its task, for the minimum time needed.

A security awareness program's measurable outputs are phishing simulation click rates, report rates, and training completion percentages, not attendance counts.

Risk = likelihood × impact. Risk treatment options are mitigate, transfer (e.g., cyber insurance), avoid, and accept; acceptance must be documented by an accountable owner.

Threat, vulnerability, and risk are distinct: a threat is a potential cause, a vulnerability is a weakness, and risk is the combination of threat exploiting vulnerability with impact.

Length dominates complexity: each added character multiplies brute-force effort, so a long passphrase outperforms a short string with symbol substitutions.

Password reuse is the primary enabler of credential stuffing; a breach at one site lets attackers replay the same pair across other services.

Multi-factor authentication combines at least two of: something you know, something you have, something you are. Two passwords are not two factors.

Phishing-resistant MFA (FIDO2/passkeys, hardware tokens bound to the origin) resists real-time relay attacks that SMS codes and push approvals do not.

Password managers generate unique high-entropy secrets per site and remove the need for human memorization; the vault is protected by one strong master passphrase plus MFA.

Accounts should be locked or rate-limited after repeated failed attempts; lockout thresholds trade brute-force resistance against denial-of-service risk.

Shared and generic accounts break accountability because actions cannot be attributed to an individual; service accounts should be non-interactive and least-privileged.

Credential exposure is detected by breach-notification services and by checking authentication logs for impossible travel, new devices, or unusual access times.

Sender address spoofing is possible because SMTP has no built-in authentication; SPF, DKIM, and DMARC are the three DNS-based controls that counter it.

SPF authorizes sending IPs; DKIM cryptographically signs messages; DMARC tells receivers what to do when SPF/DKIM alignment fails and provides reporting.

Display-name spoofing and look-alike domains (homoglyphs, added characters) defeat casual inspection; verify the actual domain, not the friendly name.

Urgency, authority, fear, curiosity, and reward are the standard social-engineering levers; a message combining urgency with a request to bypass process is high risk.

Spear phishing is targeted at a specific person using researched details; whaling targets executives; business email compromise impersonates or hijacks an executive or vendor to redirect payments.

Out-of-band verification means confirming a sensitive request through a separate, previously known channel (a known phone number), never a contact detail supplied in the suspicious message.

Hovering over links and inspecting the true destination, and treating unexpected attachments (especially macro-enabled documents and archives) as hostile, are core inspection habits.

Reporting a suspected phishing message through the organization's report button enables mail-team triage and removal of other delivered copies; deleting it silently removes that signal.

HTTPS protects data in transit between browser and server via TLS; it does not indicate that the site's content or operator is trustworthy.

Public Wi-Fi is untrusted by default; a VPN creates an encrypted tunnel that protects traffic from local eavesdropping and rogue access points.

Browser indicators: the padlock means the connection is encrypted, and the certificate must match the exact hostname; look-alike domains remain the main risk.

Mobile app permissions are the primary privacy control: a flashlight app requesting contacts and location is a mismatch and should be denied or uninstalled.

App installation should come from official stores; sideloading from unknown sources bypasses platform review and is a common malware vector on mobile.

Mobile device management and BYOD policies separate work from personal data (containerization), enforce screen locks, and enable remote wipe of corporate data.

Jailbreaking or rooting removes platform security controls (sandboxing, code signing) and increases malware exposure.

Session hygiene: log out of sensitive services on shared devices, avoid 'remember me' on public computers, and keep browsers and OS patched to close known exploits.

Malware categories: virus (attaches to files), worm (self-propagates over networks), trojan (disguised as legitimate), spyware (collects data), adware, rootkit (hides), and ransomware (encrypts or exfiltrates and extorts).

Ransomware double extortion combines encryption with prior data theft, so paying does not prevent publication of stolen data and is discouraged.

Macro-enabled Office documents and script files (.js, .vbs, .hta, .lnk) are common initial-access payloads; disabling macros by policy blocks a large share of them.

Endpoint detection and response detects behavioral indicators (mass file renaming, shadow-copy deletion) that signature antivirus misses.

Ransomware actors commonly delete volume shadow copies to prevent local recovery; offline or immutable backups are the reliable recovery path.

Prevention baseline: patched OS and applications, endpoint protection, application allow-listing, disabled macros, and least-privilege accounts (no routine admin rights).

If ransomware is suspected: disconnect the affected device from the network, do not power off if forensics or memory evidence matters, and report immediately per policy.

Phishing email and exposed remote-access services (RDP, VPN) are the two most frequently reported ransomware initial-access routes.

Data classification tiers (public, internal, confidential, restricted) determine handling, storage, sharing, and retention rules; unclassified data defaults to the highest protection.

Personal data is any information relating to an identified or identifiable person; special categories (health, biometrics, ethnicity) require stricter handling.

Privacy principles: lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.

Encryption at rest protects stored data if a disk or backup is lost; encryption in transit protects it on the network. Both are needed for sensitive data.

Data minimization reduces breach impact: do not collect or retain personal data without a defined purpose and retention period.

Cross-border transfers and third-party sharing require contractual safeguards and, under many regimes, a documented legal basis.

Data subject rights commonly include access, correction, deletion, restriction, and portability; organizations need a process and response deadline to honor them.

Removable media and personal cloud storage are common data-leak paths; policy should define approved storage locations and prohibit sensitive data on unapproved services.

Physical access to a device usually equals control of the device: an attacker with physical access can boot alternate media, read disks, or install hardware implants.

Tailgating and piggybacking bypass badge controls; mantraps, turnstiles, and visitor escort rules address them.

Clean desk and clear screen policies prevent shoulder surfing and document theft; lock screens automatically after a short idle period.

Environmental controls: fire suppression (clean agent for server rooms), temperature and humidity monitoring, water-leak detection, and UPS/generator backup power.

Cabling and network ports in public areas should be disabled or protected to prevent unauthorized network connections.

Asset inventory and asset tagging support accountability; lost or stolen devices must be reported immediately so they can be remotely wiped.

Disposal of media requires destruction (shredding, degaussing, cryptographic erase); deleted files and simple formatting do not remove data.

Visitor management records identity, time, and escort; badges should be visible and returned at exit.

Report suspected incidents immediately through the defined channel; speed limits damage, and the reporter's judgment of severity is not the gate for reporting.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned.

Containment options include isolating the host from the network, disabling the account, blocking the sender or domain, and revoking sessions and tokens.

Preserve evidence: do not delete files, reformat, or reimage before the incident team authorizes it; note times, actions, and observed indicators.

Never attempt independent investigation or contact the attacker; both can destroy evidence and escalate the incident.

An emergency contact list should include the security team, IT service desk, and facility security, and be available offline in case systems are down.

Post-incident review produces root cause and corrective actions with owners and dates; without it, the same incident recurs.

Regulatory and contractual notification deadlines may apply (e.g., breach notification to authorities or customers) and are triggered by the incident timeline, not by full investigation completion.

A policy states mandatory rules and intent; a standard specifies required controls; a procedure gives step-by-step instructions; a guideline is recommended practice.

Acceptable use policy defines permitted use of organizational systems and the absence of an expectation of privacy on company devices.

Common regulatory themes: GDPR (EU personal data, lawful basis, breach notification within 72 hours where required), HIPAA (US health data), PCI DSS (card data), SOX (financial reporting controls).

Compliance does not equal security: an audit passing a control checklist does not prove resistance to a real attack.

Non-disclosure agreements and data-processing agreements govern third-party handling of confidential and personal data.

Policy violations and security incidents must be distinguished; both follow defined escalation paths, and disciplinary action follows HR policy.

Records retention schedules must satisfy both legal minimums and privacy storage-limitation requirements; keeping data longer than needed increases risk.

Employees are typically required to acknowledge policies at onboarding and periodically; acknowledgement supports enforceability.

Recovery Point Objective (RPO) is the maximum acceptable data loss measured in time; Recovery Time Objective (RTO) is the maximum acceptable downtime.

The 3-2-1 rule: at least three copies of data, on two different media, with one copy offsite or offline.

Immutable or offline backups (air-gapped, object-lock, tape) resist ransomware encryption of connected backup systems.

Backups must be tested by restore drills; an untested backup is an assumption, not a recovery capability.

Business impact analysis identifies critical processes and their dependencies, and sets RTO/RPO per process, not uniformly for the organization.

A business continuity plan covers keeping critical functions running during disruption; a disaster recovery plan covers restoring IT systems and data.

Full, incremental, and differential backups differ in restore complexity and storage cost; incremental restores need the full chain, differentials need the last full plus latest differential.

Backup media and repositories must be protected with the same access controls and encryption as production data, since they contain the same sensitive information.