SecurityX cheat sheet

Quantitative risk math: SLE = Asset Value × Exposure Factor; ALE = SLE × Annualized Rate of Occurrence. ALE is annualized expected loss, never a per-incident figure.

Risk treatment options are mitigate, transfer, avoid, and accept. Residual risk is what remains after treatment and must be documented and formally accepted by management.

Availability = MTBF ÷ (MTBF + MTTR). Availability improves either by raising mean time between failures or by lowering mean time to repair.

RTO bounds tolerable downtime, RPO bounds tolerable data loss, and MTD is the total tolerable outage; RTO is always less than or equal to MTD.

GDPR requires notifying the supervisory authority of a personal data breach within 72 hours of awareness; maximum penalties are EUR 20 million or 4% of global annual turnover, whichever is greater.

HIPAA Breach Notification Rule requires notifying affected individuals without unreasonable delay and no later than 60 days after discovery of a breach of unsecured PHI.

NIST Risk Management Framework sequence: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor (NIST SP 800-37).

PCI DSS scope includes every system that stores, processes, or transmits cardholder data and every system that can impact the security of that environment; tokenization and segmentation reduce scope.

Assurance reports: SOC 1 covers controls relevant to financial reporting (ICFR); SOC 2 covers the Trust Services Criteria and is Type I (point in time) or Type II (period); SOC 3 is a general-use summary.

Zero trust removes implicit trust derived from network location: each request is authenticated and authorized by a policy decision point and enforced at a policy enforcement point, enforcing least privilege per session.

Cloud shared responsibility: the provider secures physical facilities and the virtualization layer; the customer's responsibility expands from data and identity in SaaS to OS, runtime, and applications in IaaS.

Traffic direction matters: north-south traffic crosses the perimeter (firewalls, WAF, gateways); east-west traffic moves laterally inside the data center and is addressed by microsegmentation and host firewalls.

VLAN hopping exploits double-tagged 802.1Q frames or switch spoofing via DTP; mitigations are disabling DTP and auto-trunking, placing unused ports in an unused VLAN, and never using VLAN 1 as the native VLAN.

RAID redundancy map: RAID 0 stripes with no redundancy, RAID 1 mirrors, RAID 5 uses single distributed parity (n-1 capacity, one disk failure), RAID 6 uses double parity (n-2, two failures), RAID 10 mirrors and stripes.

Recovery site ordering by RTO: hot site (near-zero downtime, fully equipped), warm site (hardware present, data restore in hours to days), cold site (space and power only, weeks to restore).

Control function categories: preventive, detective, corrective, deterrent, compensating, and directive. Control nature (physical, technical, administrative) is a separate classification axis.

Hybrid encryption pattern: asymmetric cryptography authenticates endpoints and exchanges key material; symmetric ciphers such as AES then protect the bulk data because they are far faster.

SASE converges networking and security as a cloud-delivered service, combining SD-WAN with SWG, CASB, ZTNA, and firewall-as-a-service; CASB alone brokers and inspects traffic to cloud applications.

STRIDE maps directly to control classes: Spoofing to authentication, Tampering to integrity, Repudiation to logging and non-repudiation, Information disclosure to confidentiality, Denial of service to availability, Elevation of privilege to authorization.

SAST (white-box static source analysis, runs early in CI), DAST (black-box testing of a running application), IAST (instrumented runtime testing), and SCA (third-party dependency and CVE analysis) answer different questions and are complementary.

Injection defense rule: parameterized queries separate code from data; allowlist input validation constrains format; least-privilege database accounts bound the blast radius.

XSS defense is context-aware output encoding plus Content Security Policy; input validation alone is insufficient because stored payloads are re-rendered in other contexts.

CSRF defense requires per-request anti-CSRF tokens or SameSite cookies; the same-origin policy does not stop CSRF because the browser sends the request, not the attacker's script.

Integrity primitives differ: a plain hash gives integrity only, an HMAC adds shared-key authenticity, and a digital signature adds non-repudiation through asymmetric keys; none of them alone provides confidentiality.

Password storage uses a unique salt plus a deliberately slow key derivation function such as PBKDF2, bcrypt, scrypt, or Argon2; Argon2id is memory-hard and resists GPU cracking.

TLS 1.3 requires forward secrecy via ephemeral (EC)DHE, removes static RSA key transport, and drops RC4, CBC-mode ciphers, and TLS compression.

Memory-safety mitigations: ASLR randomizes address layout, DEP/NX prevents execution from writable data pages, and stack canaries detect overflow before a return address is used.

CI/CD security gates include secret scanning, dependency SCA, IaC scanning, and artifact signing (for example Sigstore/cosign) before deployment.

NIST SP 800-61r2 incident response lifecycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity (lessons learned).

Evidence collection follows the order of volatility: CPU registers and cache, then RAM, then swap and page files, then network state and remote logs, then disk, then backups and archival media.

Forensic integrity rule: acquire with a write blocker, hash with SHA-256 at seizure and re-verify before analysis, and record every transfer in an unbroken chain of custody.

Kill Chain versus ATT&CK: the seven-stage kill chain (reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives) is a linear adversary model; ATT&CK is a behavioral tactic and technique knowledge base used to map detections.

CVSS v3.1 base score bands: 0.0 none, 0.1-3.9 low, 4.0-6.9 medium, 7.0-8.9 high, 9.0-10.0 critical; temporal and environmental metrics modify the base score for real context.

Backup types: full copies all selected data, incremental copies changes since the last backup of any type, differential copies changes since the last full; an incremental restore needs the full plus every incremental in the chain.

3-2-1 backup rule: at least three copies, on two different media, with one offsite; the modern extension is one copy immutable or offline to defeat ransomware.

Detection trade-offs: a false positive flags benign activity as malicious and wastes analyst time, a false negative misses real activity; tuning thresholds shifts the balance between them, and MTTD/MTTR measure program performance.

Containment strategies include network isolation or quarantine, removal of the affected host, and compensating monitoring; containment actions must preserve evidence for later analysis.

Annualized Loss Expectancy (ALE)

Single Loss Expectancy (SLE)

Recovery Point Objective (RPO)

Recovery Time Objective (RTO)

GDPR breach notification window

Data controller versus processor

NIST Risk Management Framework steps

SOC 1 versus SOC 2 reports

Zero trust core principle

Cloud shared responsibility model

RAID 5 versus RAID 6

Screened subnet and DMZ

Microsegmentation

Hot, warm, and cold sites

Control function categories

SASE versus CASB

STRIDE threat categories

SAST versus DAST

Parameterized queries

HMAC versus digital signature

Purpose of a password salt

TLS 1.3 key exchange

Perfect forward secrecy

Same-origin policy

Order of volatility

Chain of custody

Full versus incremental backup

CVSS base score ranges

Cyber Kill Chain stages

False positive versus false negative

Tabletop exercise

EDR versus traditional antivirus