CND cheat sheet

Reconnaissance sequence: passive footprinting/OSINT → ping sweep for host discovery → port scan (SYN half-open, FIN, XMAS, NULL) → service/version detection and banner grabbing.

SYN flood exhausts the backlog of half-open connections; countermeasures are SYN cookies, larger backlog queues, and ingress/egress filtering of spoofed source addresses.

Amplification factor = response size ÷ request size; DNS, NTP (monlist), and memcached reflection produce factors from tens to thousands against a spoofed victim IP.

ARP spoofing poisons the IP-to-MAC cache to enable on-path attacks; mitigations are Dynamic ARP Inspection with DHCP snooping, port security, and static ARP entries for critical hosts.

VLAN hopping works via switch spoofing (DTP negotiation) or double tagging; countermeasures are disabling unused ports, disabling DTP/auto-trunking, and never using VLAN 1 as the native VLAN.

Smurf and fraggle attacks send ICMP or UDP traffic to a directed broadcast with a spoofed source; defense is disabling directed broadcast and enabling unicast RPF.

On-path (MITM) attacks require ARP/DNS poisoning, a rogue access point, or BGP hijacking; strict TLS certificate validation and HSTS are the primary defenses.

Defense in depth assumes every layer can fail: segmentation, least privilege, hardening, monitoring, and response are layered so no single control is trusted alone.

AAA separates authentication (prove identity), authorization (grant rights), and accounting (record activity); RADIUS uses UDP 1812/1813 and TACACS+ uses TCP 49.

Least privilege, separation of duties, job rotation, and mandatory vacations are administrative controls that both limit and detect insider misuse.

802.1X port-based access control uses three roles - supplicant (client), authenticator (switch or AP), and authentication server (RADIUS) - exchanging EAP messages.

NAC decision rule: posture-check the device (patch level, antivirus/EDR, encryption) before assigning a VLAN; non-compliant devices are placed in a remediation or quarantine VLAN.

Password policy baselines: minimum length (≥12 for user accounts), banned-password checks, history/reuse prevention, maximum age tied to risk, and account lockout thresholds.

Data classification drives handling rules: public → internal → confidential → restricted; each level maps to required encryption, retention, and DLP enforcement.

Change management requires a request, impact analysis, approval, testing, rollback plan, and post-implementation review; unmanaged change is a recurring audit finding.

Configuration baselines such as CIS Benchmarks or DISA STIGs are applied via Group Policy or configuration management and verified by continuous configuration scanning.

Stateless packet-filter firewalls evaluate each packet against L3/L4 ACLs with no session memory, so return traffic must be explicitly permitted.

Stateful firewalls maintain a session table and automatically allow return traffic belonging to an established, permitted flow.

ACL evaluation is top-down, first-match-wins, with an implicit deny at the end; place the most specific rules highest and log the deny-all entry.

Screened-subnet DMZ: Internet → external firewall → DMZ public services → internal firewall → internal network; DMZ hosts may not initiate connections inward.

IPsec: AH (protocol 51) provides integrity and authentication only; ESP (protocol 50) adds confidentiality via encryption; tunnel mode encapsulates and hides the entire original packet, transport mode protects only the payload.

IPsec IKE phase 1 establishes the ISAKMP SA (UDP 500, NAT-T 4500); phase 2 negotiates the IPsec SAs that protect data traffic.

IDS is out-of-band (SPAN port or TAP) and only alerts; IPS is inline and can drop traffic, so its false-positive rate directly affects availability.

A WAF inspects HTTP/HTTPS at layer 7 using negative (signature) or positive (allow-list) models to block injection, XSS, and malicious bots.

NAT/PAT conserves addresses and obscures internal topology but is not an access control; egress filtering must be configured separately.

Windows stores local account hashes in SAM and domain hashes in NTDS.dit; disable LM hashing, restrict cached domain logons, and protect LSASS from credential dumping.

Windows hardening set: UAC enabled, AppLocker or WDAC, BitLocker with TPM, host firewall on, SMB signing enforced, SMBv1 removed, patching via WSUS/Intune.

Linux permissions are three rwx triplets (owner/group/other); umask subtracts from default modes; SUID/SGID binaries run with elevated rights and must be inventoried.

Linux mandatory access control: SELinux (enforcing/permissive modes, security contexts) and AppArmor (path-based profiles) constrain processes beyond standard discretionary permissions.

EDR collects process, file, registry, and network telemetry, applies behavioral analytics, and supports host isolation and rollback during response.

Antivirus detection types are signature, heuristic, and behavioral; signature-only engines miss polymorphic, packed, and fileless malware.

Mobile: MDM controls the entire device including remote wipe, while MAM containerizes only application data; BYOD programs favor MAM plus jailbreak/root posture checks.

IoT controls: replace default credentials, segment devices onto an isolated VLAN, disable unused services, patch firmware, and restrict outbound traffic to required destinations.

SQL injection defense is parameterized queries or prepared statements so input can never become executable SQL; input validation and least-privilege database accounts are supporting controls.

XSS types are reflected (returned in the response), stored (persisted server-side), and DOM-based (client-side); defense is context-aware output encoding plus Content Security Policy.

CSRF defense: unpredictable anti-CSRF tokens validated server-side, SameSite cookie attributes, and never allowing state change on GET requests.

Authentication/session failures: enforce MFA, set idle and absolute session timeouts, use HttpOnly and Secure cookie flags, and rate-limit or block breached passwords.

Testing tools: SAST analyzes source code early (white-box), DAST tests a running application externally (black-box), SCA flags vulnerable dependencies, IAST instruments runtime.

Symmetric encryption (AES) handles bulk data efficiently; asymmetric (RSA/ECC) handles key exchange and signatures; a digital signature is the message hash encrypted with the sender's private key.

Password storage uses a salted, deliberately slow KDF (bcrypt, scrypt, Argon2, PBKDF2); plain hashing and reversible encryption are unacceptable.

Data protections: encryption at rest (AES-256) and in transit (TLS 1.2+/1.3), tokenization replaces sensitive values with non-sensitive tokens, and DLP enforces classification rules.

Type 1 hypervisors run directly on hardware (ESXi, Hyper-V); type 2 hypervisors run as an application on a host OS with lower performance and a larger attack surface.

Virtualization risks: VM escape breaking isolation, hyperjacking of the management console, VM sprawl, stale snapshots, and resource contention; segment and harden the management network.

Cloud service models shift responsibility: IaaS (customer manages OS and upward), PaaS (customer manages app and data), SaaS (customer manages data and identity only).

Shared responsibility: the provider secures facilities, hardware, and the hypervisor; the customer secures identity, data, configurations, and patching at the layers it owns.

CASB enforces policy between users and cloud services (discovery, DLP, tokenization, access control); SASE converges SD-WAN with cloud-delivered security services.

Wireless progression: WEP (RC4, static IVs - broken) → WPA/TKIP → WPA2/AES-CCMP → WPA3/SAE with forward secrecy and protected management frames.

WPA2-Enterprise uses 802.1X/EAP with per-user credentials and a RADIUS server; WPA2-Personal uses a shared pre-shared key that cannot be rotated per user.

Rogue AP, evil twin, and deauthentication attacks are countered with WIPS, 802.11w management-frame protection, server certificate validation on the supplicant, and WPS disabled.

Data sources ranked by cost: flow records (NetFlow/IPFIX/sFlow) < text logs (syslog, Windows Event Forwarding) < full packet capture (PCAP).

NetFlow records conversation metadata (5-tuple, bytes, timestamps) cheaply at scale but omits payload; PCAP retains payload at high storage and privacy cost.

SIEM pipeline: collection → parsing/normalization → correlation rules → alerting → retention; NTP time synchronization is mandatory for cross-source correlation.

Syslog defaults to UDP 514 (cleartext, unreliable); TLS-protected syslog uses TCP 6514; SNMPv3 adds authentication and privacy that v1/v2c community strings lack.

Detection methods: signature (known pattern, low false positives, misses novel attacks), anomaly (baseline deviation, catches unknown threats, high false positives), and UEBA behavior analytics.

Hunting indicators: regular-interval beaconing, unusual ports or protocols, DNS tunneling (long or high-volume TXT/NULL queries), and large off-hours data transfers.

Baseline normal first, then alert on deviation; tune thresholds so the false-positive volume stays within the analyst queue's capacity.

NIST SP 800-61 lifecycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.

Containment options: isolate the host from the network, disable the account, block the malicious IP/domain at the perimeter, or segment the VLAN; choose based on spread risk versus business impact.

Eradication removes the root cause (malware, exploited vulnerability, rogue account); recovery restores from known-good backups and validates the system before reconnecting.

Evidence collection follows the order of volatility: CPU registers/cache → RAM and swap → network state → disk → remote logs → backups and archives.

Chain of custody plus recorded hash values preserve admissibility; never analyze original media, always work from a verified image.

The IR plan defines roles, escalation paths, and a communication plan covering internal staff, legal, public relations, and regulatory breach-notification deadlines.

Post-incident activity: lessons learned, root-cause analysis, control improvements, and updated playbooks; track dwell time and time-to-contain as metrics.

Forensic imaging is a bit-for-bit copy made through a write blocker; SHA-256 hashes taken before and after must match to prove integrity.

Acquisition order follows RFC 3227 order of volatility; on Windows, memory artifacts include hiberfil.sys, pagefile.sys, and crash dump files.

NTFS artifacts: $MFT (file records), $LogFile and $UsnJrnl (journals), $Bitmap (allocation), plus slack and unallocated space holding deleted content.

Windows artifacts: Event 4624 successful logon, 4625 failed logon, 4688 process creation, 4720 account created; Prefetch, Amcache, and ShimCache reveal program execution.

Linux artifacts: /var/log/auth.log, wtmp/btmp, .bash_history, cron entries, SUID files, and file timestamps (mtime, atime, ctime).

Timeline analysis correlates MACB timestamps with log events to reconstruct attacker actions; anti-forensics includes timestomping, log wiping, and steganography.

Mobile extraction levels: logical (backup/API), file system, and physical (chip-off/JTAG), increasing in completeness and difficulty.

Admissibility requires evidence that is relevant, authentic, complete, and lawfully obtained; expert testimony is evaluated against reliability standards such as Daubert.

The BIA establishes the MTD; RTO must be less than or equal to MTD, and RPO defines the maximum tolerable data loss measured in time.

Availability = MTBF ÷ (MTBF + MTTR); raising MTBF (redundancy, quality components) or lowering MTTR (spares, automation, runbooks) improves availability.

Backup types: full (all data), incremental (changes since the last backup of any type), differential (changes since the last full backup).

Restore chain: full plus latest differential requires two sets; full plus every incremental since the last full requires many sets and is slower and more fragile.

RAID is disk-failure redundancy, not a backup: RAID 0 stripe (no redundancy), 1 mirror, 5 stripe plus single parity, 6 stripe plus double parity, 10 mirror plus stripe.

Recovery sites: hot (fully equipped, near-zero RTO, highest cost), warm (partial, hours to days), cold (shell, weeks); a mirrored site provides active-active redundancy.

Test types in increasing rigor: checklist review, tabletop/walkthrough, simulation, parallel processing, full interruption.

BCP addresses keeping critical business functions running; DRP addresses restoring technology infrastructure - the DRP is a subset of the BCP.

Risk = likelihood × impact; qualitative analysis uses rating scales, quantitative analysis assigns monetary values using SLE, ALE, and ARO.

SLE = asset value × exposure factor; ALE = SLE × ARO (annualized rate of occurrence).

Risk treatments: mitigate (apply controls), transfer (insurance or contracts), avoid (stop the activity), accept (documented with owner sign-off); transfer does not remove accountability.

Control categories: preventive, detective, corrective, deterrent, compensating, recovery; control types: administrative, technical/logical, physical.

Threat modeling: STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) identifies threats; attack trees decompose paths; DREAD ranks them.

Vulnerability assessment identifies and ranks weaknesses (credentialed versus uncredentialed scans); penetration testing validates exploitability and real business impact.

CVSS base score ranges 0.0–10.0 and combines exploitability and impact metrics; temporal and environmental scores adjust the base for real conditions.

Decision rule: a control's cost should not exceed the ALE reduction it delivers; any residual risk must be documented and accepted by the asset owner.