NISP Level 2 cheat sheet

CIA triad: Confidentiality prevents unauthorized disclosure, Integrity prevents unauthorized modification, Availability ensures timely and reliable access; each control should be mapped to at least one of these properties.

Defense in depth layers administrative, technical, and physical controls so that a single control failure does not cause total compromise; compensating controls substitute when a primary control is infeasible.

Risk = Threat × Vulnerability × Impact; risk treatment options are mitigate, transfer, avoid, and accept, and residual risk must be documented and formally accepted by an accountable owner.

Security governance assigns accountability through policies (management intent), standards (mandatory specifics), procedures (step-by-step), and guidelines (recommended); policies are approved at executive level, not by technical staff.

Separation of duties and least privilege limit single-point abuse; job rotation and mandatory vacation detect collusion that separation alone cannot prevent.

Quantitative risk analysis uses SLE = Asset Value × Exposure Factor, ALE = SLE × ARO; qualitative analysis uses ordinal scales and is preferred when reliable loss data is unavailable.

Due diligence is the ongoing verification that controls work; due care is the reasonable standard of behavior expected of a prudent organization. Negligence claims hinge on failing due care.

Business continuity focuses on keeping critical functions running during disruption, while disaster recovery focuses on restoring IT infrastructure after a major outage; RTO is maximum tolerable downtime, RPO is maximum tolerable data loss.

OSI layer mapping: switches and VLANs operate at Layer 2, IP routing at Layer 3, TCP/UDP at Layer 4; ARP spoofing and MAC flooding are Layer 2 attacks, IP spoofing is Layer 3, SYN flood is Layer 4.

TCP three-way handshake (SYN, SYN-ACK, ACK) is exploited by SYN floods; SYN cookies and rate limiting mitigate without requiring stateful backlog growth.

Firewall types: packet-filtering inspects headers only, stateful inspection tracks connection state, application-layer proxies/gateways inspect payloads; a DMZ segments internet-facing services from the internal network.

IPsec modes: transport mode protects payload with original IP header exposed, tunnel mode encapsulates the entire original packet; AH provides integrity and authentication but no confidentiality, ESP provides confidentiality.

802.1X port-based network access control authenticates devices before granting LAN access using supplicant, authenticator, and authentication server roles.

VLAN hopping exploits trunk negotiation (DTP) or double-tagged 802.1Q frames; disabling unused ports, disabling DTP, and setting native VLAN to an unused ID mitigate it.

DNS attacks include cache poisoning, tunneling for data exfiltration, and amplification via open resolvers; DNSSEC provides origin authentication and integrity but not confidentiality.

Network segmentation, microsegmentation, and zero-trust architectures assume breach and enforce per-flow authorization rather than trusting perimeter location.

Hardening baseline: remove unnecessary services, disable default accounts, apply least-privilege permissions, enforce patch SLAs, and enable host logging forwarded to a central collector.

Windows access control uses SIDs, ACLs with DACL (access) and SACL (auditing); integrity levels and UAC mediate privilege elevation; SeDebugPrivilege is a high-value escalation target.

Linux file permissions use owner/group/other with read(4), write(2), execute(1); SUID/SGID binaries and world-writable directories are common privilege escalation vectors.

Mandatory access control frameworks (SELinux, AppArmor) confine processes beyond discretionary permissions, limiting damage from compromised services.

Patch management lifecycle: inventory, risk-rank, test, deploy, verify; zero-day exposure is reduced by virtual patching at the network or WAF layer.

Endpoint detection and response monitors process behavior, file integrity, and network connections, enabling detection of fileless and living-off-the-land attacks that signatures miss.

Boot integrity via UEFI Secure Boot and TPM measured boot (PCR values) detects tampering with bootloaders and is a prerequisite for full-disk-encryption trust chains.

Log retention and time synchronization (NTP) are prerequisites for host forensic timelines; volatile evidence (memory, connections) must be captured before shutdown.

OWASP Top 10 categories include broken access control, injection, insecure design, security misconfiguration, and vulnerable components; injection is prevented by parameterized queries, not input blacklists.

SQL injection defenses: prepared statements with bound parameters, least-privilege database accounts, and stored-procedure whitelisting; escaping alone is insufficient for all contexts.

XSS types: reflected, stored, and DOM-based; output encoding matched to context plus Content Security Policy mitigate, while HttpOnly cookies protect session tokens from script access.

CSRF defense requires unpredictable anti-CSRF tokens or SameSite cookies; checking the Referer header alone is bypassable.

SSDLC integrates threat modeling at design, static analysis (SAST) in code, dynamic analysis (DAST) in test, and dependency scanning in build; shift-left reduces remediation cost.

Data classification (public, internal, confidential, restricted) drives handling, encryption, and retention rules; data minimization and purpose limitation reduce breach impact.

Secure deserialization and integrity checks on untrusted data prevent remote code execution; allowlists of permitted classes are preferred to blocklists.

Input validation should be positive (allowlist) and performed server-side; client-side validation is a usability aid only and never a security control.

Symmetric algorithms: AES (128/192/256-bit keys) is the standard; DES (56-bit) and 3DES are deprecated. Symmetric is fast but requires secure key distribution.

Asymmetric algorithms: RSA and ECC provide key exchange and digital signatures; ECC achieves comparable security with much shorter keys (256-bit ECC ≈ 3072-bit RSA).

Hashing (SHA-256, SHA-3) provides integrity, not confidentiality; passwords must use salted, slow KDFs (bcrypt, scrypt, Argon2), never plain hashes or reversible encryption.

Digital signature = hash of message encrypted with sender's private key; verification uses sender's public key and provides authentication, integrity, and non-repudiation, but not confidentiality.

PKI trust: a certificate binds identity to a public key and is signed by a CA; validation checks signature chain, validity period, revocation (CRL/OCSP), and name matching.

Modes of operation: ECB leaks patterns and should not be used; CBC requires unpredictable IVs; GCM provides authenticated encryption (confidentiality plus integrity).

Authentication factors are knowledge, possession, and inherence; MFA requires factors from different categories, and two passwords are not MFA.

Key management lifecycle: generation, distribution, storage, rotation, revocation, destruction; key escrow and HSM protection address availability and compromise respectively.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned; containment strategy depends on whether evidence preservation or business continuity dominates.

Order of volatility: CPU registers and cache, memory, network state, running processes, disk, backups; capture most volatile evidence first.

Chain of custody documents who handled evidence, when, and why; without it, evidence may be ruled inadmissible. Forensic imaging uses write blockers and hash verification.

SOC tiers: Tier 1 triage and alert validation, Tier 2 investigation and response, Tier 3 threat hunting and advanced analysis; escalation criteria must be predefined.

SIEM correlates logs and generates alerts; SOAR automates response playbooks; both depend on accurate time sync and complete log sources.

Indicator types: atomic (IP, hash), behavioral (process lineage), and strategic (TTPs); TTP-based detection survives attacker infrastructure changes.

MTTD (mean time to detect) and MTTR (mean time to respond/recover) are the core operational metrics; reducing MTTD requires visibility, reducing MTTR requires automation and playbooks.

Backup strategy 3-2-1: three copies, two media types, one offsite; immutable or air-gapped backups defend against ransomware encryption of connected storage.

Vulnerability assessment identifies and ranks weaknesses; penetration testing exploits them to demonstrate business impact. A pentest without scoping and rules of engagement is unauthorized.

Scanning types: unauthenticated (external view) versus authenticated (deep host view); false positives require manual validation before remediation tickets.

CVSS base score combines exploitability (attack vector, complexity, privileges, user interaction) and impact (confidentiality, integrity, availability); temporal and environmental metrics adjust it.

Risk assessment methodologies include qualitative (risk matrix), quantitative (ALE), and hybrid; ISO 31000 and NIST SP 800-30 provide process frameworks rather than fixed formulas.

Threat modeling frameworks: STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) and attack trees; performed at design time.

Control types: preventive, detective, corrective, deterrent, compensating; control categories: technical, administrative, physical. A control can belong to one type and one category.

Audit evidence should be sufficient, competent, and relevant; sampling risk and materiality determine how much evidence is needed.

Third-party risk: vendor questionnaires, SOC 2 Type II reports (period of operation) versus Type I (point-in-time design), and contractual security requirements.

China Cybersecurity Law (2017) establishes network operator obligations, MLPS (multi-level protection scheme) grading, and data localization expectations for critical information infrastructure operators.

China Data Security Law (2021) introduces data classification by importance and a national core data category with stricter export and processing controls.

China Personal Information Protection Law (2021) requires informed consent, purpose limitation, separate consent for sensitive personal information, and cross-border transfer mechanisms.

GDPR principles: lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability; penalties up to 4% of global annual turnover.

ISO/IEC 27001 specifies requirements for an information security management system (ISMS) with risk-based controls in Annex A; ISO/IEC 27002 provides implementation guidance, not certifiable requirements.

MLPS 2.0 defines five protection levels; Level 3 and above require periodic assessment and enhanced monitoring; grading depends on harm to national, social, and individual interests.

PCI DSS applies to any entity storing, processing, or transmitting cardholder data, with 12 requirement domains and defined SAQ types based on transaction volume and method.

NIST Cybersecurity Framework functions: Identify, Protect, Detect, Respond, Recover (plus Govern in CSF 2.0); it is voluntary guidance, not a certification standard.

Zero trust principles: never trust implicitly, verify explicitly, assume breach; enforcement relies on identity-aware proxies, microsegmentation, and continuous device posture assessment.

Cloud shared responsibility: provider secures infrastructure (of the cloud), customer secures data, identity, configuration, and access (in the cloud); misconfiguration is the leading cloud risk.

Container security: image scanning, minimal base images, no root in containers, signed images, and runtime detection; Kubernetes RBAC and network policies limit lateral movement.

AI/ML security includes adversarial input, data poisoning, model extraction, and prompt injection against LLM applications; output filtering and least-privilege tool access reduce impact.

Supply chain security: SBOM (software bill of materials), dependency pinning, signature verification (Sigstore), and vendor attestation address compromised build pipelines.

Ransomware trends: double and triple extortion (encryption plus data leak plus DDoS), initial access via phishing, exposed RDP/VPN, and unpatched edge devices; immutable backups are the key recovery control.

Deception technology (honeypots, honeytokens) provides high-fidelity alerts with low false positives because legitimate users have no reason to interact with them.

Privacy-enhancing technologies: differential privacy, homomorphic encryption, secure multi-party computation, and data masking enable analysis without exposing raw personal data.