CPENT cheat sheet

Authority, asset scope, timing and permitted methods must be consistent.

Collect only the evidence needed under actual handling conditions.

Separate observed results, inference, severity and business priority.

Close out artifacts, access, data and residual changes with accountable ownership.

Passive versus active depends on the actual contact path.

Discovery does not expand scope or prove current ownership.

An open port or banner is not proof of exploitability.

Record qualified observations, uncertainty and relevant source/timing information.

OWASP Top 10 is the standard vocabulary for application weaknesses.

Parameterised queries prevent SQL injection; output encoding prevents XSS.

Authorisation must be checked server-side on every request.

XSS executes script in the victim's browser; CSRF abuses the victim's session.

Classify data first, then apply encryption, masking, DLP and disposal rules by class.

Harden from a documented baseline image: minimal services, default-deny host firewall, secure boot.

With conventional requested modes 0666/0777, umask 027 yields 0640 files and 0750 directories.

SUID/SGID binaries must be inventoried as escalation paths; avoid shared root.

EDR adds behaviour detection and response beyond signature antivirus.

Third-party applications are as important to patch as the operating system.

Identification, authentication, authorisation and accounting are four distinct steps.

MFA needs two different factor categories, not two instances of one.

RBAC suits stable job roles; ABAC suits context-dependent, fine-grained rules.

Kerberos uses a KDC with TGT and service tickets for SSO.

Symmetric ciphers handle bulk data; asymmetric ciphers solve key distribution and signatures.

Signing uses a specified signature scheme with the signer’s private key; verification and custody are essential to origin evidence.

ECB leaks patterns; use authenticated modes such as GCM or encrypt-then-MAC.

Asset inventory and configuration baselines underpin every operational control.

Changes need an appropriate authorization path, recovery planning and relevant evidence.

Emergency changes still require retrospective documentation within a defined window.

Monitor log sources for silence, not just for events.

Distinguish historical Revision 2 phases from current NIST incident-response guidance integrated with broader risk management.

Containment precedes eradication in almost every scenario.

Capture volatile evidence (memory, connections) before disk and before power-off.

Validate findings and prioritize with exposure and business impact.

CVSS severity is not a complete organizational risk score.

Assessments and testing require appropriate authorization and scope.

Verify remediation and review documented exceptions.

Directory paths require actual effective-rights and dependency evidence.

Passwords, hashes, tickets and protocol exchanges have different roles.

Relay feasibility depends on more than a single disabled setting.

Report demonstrated versus inferred impact and protect credential evidence.

A crash is not proof of reliable code execution on every version.

Architecture, encoding and actual execution conditions matter.

DEP/NX, ASLR and other mitigations address distinct conditions.

Report bounded observed consequences and supported corrective/retest evidence.

Assessment authority is specific to owner, target and method.

Wireless, cloud and firmware observations have limited implications.

Preserve original samples and protect extracted sensitive state.

Remediation must account for supported physical and service dependencies.