CP-C cheat sheet

The CIA triad names the three core security objectives: confidentiality (only authorized parties can read data), integrity (data is accurate and complete), and availability (systems respond when needed); one control can serve more than one objective.

Risk score = likelihood × impact. This qualitative formula ranks risks so treatment effort goes to the highest-scoring items first.

Inherent risk is the exposure before controls; residual risk is what remains after controls are applied. The difference quantifies the protection actually delivered.

Authentication confirms identity; authorization decides which actions that identity may perform; accounting (logging/auditing) records what was done, by whom, and when.

A policy states management intent and mandatory rules; a standard specifies mandatory requirements such as algorithms or configurations; a procedure documents the step-by-step sequence and responsible roles.

1 byte = 8 bits. Binary prefixes scale by 1024: 1 KiB = 1024 bytes, 1 MiB = 1024 KiB, 1 GiB = 1024 MiB.

The OSI reference model has seven layers, numbered physical (1), data link (2), network (3), transport (4), session (5), presentation (6), application (7).

Data has three states - at rest, in transit, and in use - and each requires different controls: storage encryption, transport encryption such as TLS, and memory/access controls respectively.

An IPv4 address is 32 bits written as four dotted-decimal octets; an IPv6 address is 128 bits written in hexadecimal groups.

RFC 1918 private IPv4 ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16; they are not routed on the public internet and need NAT for external access.

Usable hosts in a subnet = 2^h − 2, where h is the number of host bits, because the network and broadcast addresses are reserved. A /24 therefore has 254 usable addresses.

TCP is connection-oriented and opens with a three-way handshake (SYN, SYN-ACK, ACK); UDP is connectionless and provides no delivery, ordering, or duplicate suppression guarantee.

Common default ports: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 3389 RDP. Firewall and security-group rules are usually written against these defaults.

HTTP status classes: 2xx success, 3xx redirection, 4xx client error (e.g., 404), 5xx server error (e.g., 500).

Idempotent methods - GET, PUT, DELETE, HEAD - produce the same server state when repeated; POST is not idempotent, so retrying it can create duplicate records.

Third normal form requires second normal form plus no transitive dependencies: every non-key column depends on the key, not on another non-key column.

Defense in depth layers independent controls across network, host, application, and data so one failed or bypassed control does not expose the asset.

Least privilege grants each user, service, or process only the access required for its function, and only for as long as required.

MFA requires two or more different factor types from knowledge, possession, and inherence; two passwords are one factor type and do not qualify.

Fail closed denies access when a control fails; fail open permits it. Choose fail closed for security-critical systems, fail open only where safety or availability dominates.

The 3-2-1 backup heuristic: at least three copies of data, on two different media types, with one copy offsite or offline; the offline copy defends against ransomware encryption.

Patch lifecycle order: identify, classify by severity, test, deploy, verify installation, report status. Skipping test increases outage risk from a bad patch.

Clock synchronization via NTP is a prerequisite for log correlation; without it, event timelines across hosts cannot be reliably reconstructed.

Separation of duties prevents any single person from initiating, approving, and recording the same sensitive transaction, reducing both fraud and undetected error.

Governance sets direction (risk appetite, policies, roles, oversight); management executes it through planning, operation, and monitoring of day-to-day activities.

Change management sequence: request, assess risk and impact, approve, implement with a back-out plan, verify, then record the outcome.

An SLA is the external service commitment to the customer; an OLA is an internal agreement between support teams; an underpinning contract is with an external supplier.

PDCA (Plan-Do-Check-Act) is the Deming continuous-improvement cycle: plan the change, run it small, check results against expectations, then standardize or correct.

Acceptance criteria must be objectively testable (stated response time, error rate, threshold), which distinguishes them from goals or aspirations.

A retention period is set by legal, regulatory, and business need; data should be deleted or anonymized once the period expires to reduce exposure.

Audit records should capture who did what, when, and from where, be tamper-evident, and be kept for the defined retention period to remain usable as evidence.

Job rotation and mandatory vacation are controls that surface concealed fraud or error by removing long-term exclusive control of a function from one person.