CCIS cheat sheet

CIA triad: Confidentiality = authorized disclosure only; Integrity = authorized modification only; Availability = timely, reliable access. Each control maps to at least one leg.

Control classes by effect: preventive (blocks), detective (identifies), corrective (restores), deterrent (discourages), compensating (substitutes for a primary control), recovery (rebuilds).

Defense in depth layers people, process, and technology controls so that no single failure causes a breach; a single control failure must not be sufficient for compromise.

Due care = reasonable steps to protect assets; due diligence = ongoing verification that controls work. Negligence claims hinge on documented due care.

Policy hierarchy: policy (mandatory intent) > standard (specific requirements) > procedure (step-by-step) > guideline (recommended). Audit against standards, not guidelines.

Quantitative risk: SLE = asset value x exposure factor; ALE = SLE x ARO. Control is cost-justified when annual cost is below the ALE reduction it produces.

Segregation of duties splits sensitive tasks (e.g., request, approve, deploy) among different people; dual control requires two people to act together.

Data roles: owner (accountable, sets classification), custodian (implements controls), user (follows rules). Data remanence requires sanitization, not deletion.

OSI mapping: hub/switch L1-L2, IP/ICMP L3, TCP/UDP L4, TLS/SSH L5-L7. Firewall filtering at L4 sees ports; next-gen firewalls inspect L7 content.

TCP three-way handshake = SYN, SYN-ACK, ACK. SYN flood exhausts the half-open connection table; SYN cookies mitigate without state.

Stateful firewall tracks connection state; stateless ACLs evaluate each packet independently. A DMZ isolates internet-facing hosts from the internal zone.

IDS detects and alerts (passive); IPS detects and blocks inline. Signature detection matches known patterns; anomaly detection baselines behavior and flags deviation.

VPN: IPsec uses AH (integrity/auth, no encryption) or ESP (encryption plus optional auth); IKE negotiates SAs. TLS VPNs operate at the application/session layer.

Segmentation limits lateral movement; VLANs are logical L2 segments, and inter-VLAN routing must pass a policy enforcement point to be meaningful.

NAT/PAT hides internal addressing but is not a security control. Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.

Wi-Fi: WPA2 uses AES-CCMP; WPA3 uses SAE for offline-dictionary resistance. WEP and TKIP are deprecated. 802.1X authenticates devices to the network.

Authentication factors: something you know (password), have (token), are (biometric). MFA requires two or more different factor types, not two of the same type.

Access control models: DAC (owner discretion), MAC (labels/clearance, e.g., SELinux), RBAC (role-based), ABAC (attributes/policy), RuBAC (rules).

Least privilege and need-to-know constrain entitlements. Privileged access management vaults credentials, brokers sessions, and records privileged activity.

SSO and federation: SAML 2.0 exchanges XML assertions; OAuth 2.0 delegates authorization via tokens; OpenID Connect adds an identity layer over OAuth.

Kerberos: KDC issues a TGT after authentication; the TGT obtains service tickets. Ticket lifetimes and clock skew tolerances govern renewal.

Password storage uses salted, slow hashes (bcrypt, scrypt, Argon2). Account lockout and rate limiting resist online guessing; MFA resists credential theft.

Identity lifecycle: provisioning (joiner), modification (mover), deprovisioning (leaver). Orphaned accounts are a top audit finding; recertification catches them.

Zero trust assumes no implicit trust from network location; every request is authenticated and authorized per session using policy and context.

Hardening baseline: remove unused services, disable default accounts, patch, enforce least privilege, enable host firewall and logging, restrict removable media.

EDR vs. antivirus: signature AV matches known files; EDR records process, file, network, and registry telemetry and supports behavioral detection and response.

Application allowlisting permits only approved executables by hash or publisher; it blocks unknown malware regardless of signature.

Patch management: inventory, risk-rank, test, deploy, verify. Exploit-available and internet-facing flaws get the shortest remediation window.

Windows controls: Group Policy, AppLocker/WDAC, BitLocker, Credential Guard, LAPS. Linux controls: SELinux/AppArmor, sudo, file permissions, SSH key auth.

Least functionality and secure boot chain (UEFI Secure Boot, measured boot) resist bootkits and unauthorized kernel modules.

Sandboxing and container isolation limit blast radius; containers share the host kernel, so kernel exploits cross container boundaries.

Logging on endpoints: process creation, command lines, service installs, and privilege escalation events are high-value detection sources.

Symmetric ciphers: AES (128/192/256-bit keys) is the standard; ChaCha20 is a stream cipher. Symmetric is fast but requires key distribution.

Asymmetric: RSA (factoring) and ECC (discrete log) solve key exchange and signatures, not bulk encryption. Key sizes are not comparable across algorithms.

Hashing (SHA-256, SHA-3) is one-way and collision-resistant; HMAC adds a shared key for integrity and authenticity. MD5 and SHA-1 are broken for collision resistance.

Modes: CBC needs a random IV and padding; GCM provides authenticated encryption (confidentiality plus integrity). Never reuse a nonce with GCM.

Digital signature = hash of message encrypted with signer's private key; verification uses the public key and proves integrity, origin, and non-repudiation.

PKI: CA issues certificates binding identity to public key; chain of trust, CRL/OCSP revocation, and validity dates must be checked.

Key management lifecycle: generate, distribute, store, rotate, escrow/recover, destroy. HSM or KMS protects keys; keys must never be in source code.

Data protection states: at rest (encryption, tokenization, masking), in transit (TLS, IPsec), in use (confidential computing, memory protections).

Incident response phases: preparation; detection and analysis; containment, eradication, recovery; post-incident lessons learned. Containment precedes eradication.

Threat modeling (STRIDE: spoofing, tampering, repudiation, information disclosure, denial of service, elevation) identifies design flaws before deployment.

Kill chain and ATT&CK: adversary tactics (why) and techniques (how). Detection maps to techniques; coverage gaps are measured against the matrix.

Malware types: virus (needs host), worm (self-propagating), trojan (disguised), ransomware (encrypts/extorts), rootkit (hides), logic bomb (triggered).

Indicators of compromise (hashes, IPs, domains) are atomic and short-lived; TTPs are behavioral and durable. Hunt on TTPs first.

Evidence handling: order of volatility (CPU/registers, memory, network, disk, backups), chain of custody, write blockers, hashing for integrity.

Containment options: isolate host, block IP/domain, disable account, segment network. Balance blast radius against attacker awareness.

Communication during incidents: defined roles, legal/privacy notification timelines, and a single approved external channel.

Vulnerability management cycle: discover assets, scan, validate/prioritize, remediate, verify, report. Scanning without remediation tracking is incomplete.

CVSS base score reflects exploitability and impact, not your exposure. Contextual risk adds asset criticality, data sensitivity, and reachability.

CVE identifies a vulnerability; CWE classifies the weakness type; CPE identifies the affected product. EPSS estimates exploitation probability.

Threat types: threat actor (who), threat (potential cause), vulnerability (weakness), risk (likelihood x impact), exposure (unprotected asset).

Risk responses: mitigate, transfer (insurance), avoid (stop activity), accept (documented with owner sign-off).

Authenticated (credentialed) scans find more host-level issues than unauthenticated scans but require privileged accounts and change control.

False positive = reported but not present; false negative = present but not reported. Tune scanners and validate findings before remediation.

Third-party risk: vendor questionnaires, SOC 2 reports, contractual security terms, and continuous monitoring of supplier exposure.

SIEM aggregates logs, normalizes fields, correlates rules, and alerts. Detection quality depends on log coverage and time synchronization (NTP).

SOC tiers: T1 triage and close noise; T2 investigate and contain; T3 hunt and engineer detections. Escalation criteria must be documented.

Alert tuning: reduce false positives by allowlisting known-good behavior and raising rule fidelity; measure mean time to detect and respond.

Shared responsibility: cloud provider secures the cloud (facilities, hypervisor); customer secures what is in the cloud (data, identity, configuration).

Cloud identity is the primary control plane: enforce MFA, least-privilege roles, and avoid long-lived access keys; prefer federation and short-lived credentials.

Storage exposure: block public bucket/object ACLs, enforce encryption, and log data-plane access. Misconfiguration, not provider breach, is the common cause.

Cloud logging sources: control-plane audit logs (e.g., CloudTrail-style), flow logs, DNS logs, and workload logs. Centralize to a log archive account.

Backup and recovery: 3-2-1 rule, immutable or offline copies, and tested restores. Ransomware defense requires at least one copy attackers cannot delete.

Classification drives handling: public, internal, confidential, restricted. Labels determine encryption, retention, and sharing rules.

TLS configuration: disable TLS 1.0/1.1, prefer TLS 1.2/1.3, use strong cipher suites with forward secrecy (ECDHE), and validate certificates.

Perfect forward secrecy: ephemeral key exchange ensures compromise of a long-term key does not decrypt past sessions.

Tokenization replaces data with a non-sensitive token mapped in a vault; unlike encryption, the token has no mathematical relation to the original.

Data masking and pseudonymization reduce exposure for analytics and test data while preserving referential integrity.

Secure deletion: overwrite or crypto-shred (destroy the key). Physical destruction is required for failed media that cannot be sanitized.

Key rotation limits the value of a leaked key; re-encrypt data or use key wrapping/envelope encryption with a master key.

Digital rights and DLP: DLP inspects content in motion, at rest, and in use, matching patterns such as PII or card numbers.

Security awareness training targets phishing, credential hygiene, and reporting; effectiveness is measured by simulation click and report rates.

Business continuity (BCP) sustains operations; disaster recovery (DR) restores IT. RTO = maximum tolerable downtime; RPO = maximum tolerable data loss.

Metrics: MTTD, MTTR, patch compliance percentage, phishing report rate, and control test pass rate. Metrics must be actionable and trended.

Compliance frameworks: ISO 27001 (ISMS), NIST CSF (identify, protect, detect, respond, recover, govern), PCI DSS (card data), HIPAA (health data), GDPR (EU personal data).

Privacy principles: lawful basis, purpose limitation, data minimization, retention limits, subject access and erasure rights.

Audit evidence: policies, logs, tickets, access reviews, and test results. Evidence must be current, attributable, and retained per policy.

Asset inventory and classification underpin every control; unclassified, unowned assets cannot be governed or risk-ranked.

Acceptable use policy defines permitted use of organizational assets and the monitoring notice required for lawful inspection.

Zero trust network access (ZTNA) grants per-application access after identity and device checks; it replaces broad VPN network access with least privilege.

SASE combines network security (SWG, CASB, FWaaS) with WAN edge; SSE is the security-only subset delivered from the cloud.

DDoS layers: volumetric (bandwidth), protocol (SYN flood), application (HTTP floods). Mitigation uses scrubbing centers, anycast, and rate limiting.

DNS security: DNSSEC signs records for integrity; DNS filtering blocks malicious domains; DNS tunneling exfiltrates data over query traffic.

Email defenses: SPF (authorized senders), DKIM (signed message integrity), DMARC (policy plus reporting). All three together resist spoofing.

Network detection: NetFlow/metadata reveals beaconing and lateral movement without full packet capture; full packet capture is storage-intensive.

Wireless attacks: evil twin (rogue AP), deauthentication, rogue DHCP. WPA3-SAE and 802.1X with certificate validation mitigate.

Egress filtering and default-deny outbound rules break command-and-control channels and data exfiltration paths.

Session management: short idle and absolute timeouts, secure cookie flags (HttpOnly, Secure, SameSite), and rotation of session IDs after login.

Privileged accounts should be separate from daily-use accounts; just-in-time elevation with approval and recording limits standing privilege.

Directory services (LDAP/AD) centralize identity; group nesting can silently grant excess rights, so effective permissions must be reviewed.

Credential attacks: password spraying (few passwords, many accounts), credential stuffing (reused leaked pairs), phishing-resistant FIDO2 keys resist both.

Federation trust requires metadata exchange and certificate rotation; expired signing certificates break SSO tenant-wide.

Authorization checks belong server-side; client-side hiding of UI elements is not access control (broken object-level authorization).

Service accounts and API keys need owners, scopes, rotation, and monitoring; non-human identities are frequently over-privileged.

Access recertification: managers attest entitlements periodically; privileged and dormant accounts are reviewed most frequently.

Mobile security: MDM manages devices; MAM protects app data. BYOD requires containerization to separate corporate data from personal.

Virtualization security: hypervisor patching, VM sprawl control, and isolation between guests; snapshots can preserve malware and sensitive data.

Server hardening: minimal installed roles, patched OS and middleware, non-root service accounts, and restricted management interfaces.

File integrity monitoring detects unauthorized changes to critical system and configuration files, supporting compliance and intrusion detection.

Ransomware resilience on endpoints: restrict macro execution, block untrusted binaries, maintain offline backups, and monitor for mass file modification.

Logging and EDR agents must be tamper-protected; attackers disable or uninstall security tooling as an early post-compromise step.

Secure configuration baselines (e.g., CIS Benchmarks) are measured with automated checks; drift from baseline is a finding.

USB and peripheral control prevents data exfiltration and BadUSB attacks; device control policy should default to deny.

Phishing response: quarantine message, identify all recipients, reset compromised credentials, revoke sessions and tokens, then hunt for follow-on access.

Business email compromise indicators: new mailbox rules, impossible-travel logins, MFA changes, and unusual OAuth consent grants.

Ransomware playbook: isolate affected hosts, preserve evidence, identify initial access, restore from clean backups, and check for persistence before reconnecting.

Insider threat: user behavior analytics, least privilege, separation of duties, and monitored access to sensitive repositories.

Threat intelligence types: strategic (leadership), tactical (TTPs), operational (campaigns), technical (IOCs). Feed quality must be validated before automation.

Tabletop exercises test decision-making and communication; they reveal gaps in roles, escalation paths, and legal notification timing.

Forensic imaging: acquire a bit-for-bit copy, hash before and after, document the chain of custody, and analyze the copy, not the original.

Post-incident review produces corrective actions with owners and due dates; without tracked follow-up, recurrence is likely.

Common web weaknesses: injection, broken access control, cryptographic failures, insecure design, misconfiguration, vulnerable components, auth failures.

SAST analyzes source code; DAST tests running applications; SCA checks third-party dependencies; IAST combines runtime instrumentation with testing.

Penetration testing scope defines targets, rules of engagement, timing, and authorization. Testing without written authorization is a legal risk.

Risk register records asset, threat, vulnerability, likelihood, impact, score, owner, treatment, and due date; it is reviewed on a schedule.

Security debt and exception management: accepted risks require expiry dates and periodic re-review, not permanent waivers.

Supply chain risk: verify software provenance, pin dependencies, monitor for compromised build pipelines, and require SBOM visibility.

Vulnerability scoring in context: internet-facing, exploitable, and sensitive-data-adjacent findings outrank higher base scores that are not reachable.

Rescan after remediation to verify closure; unverified fixes are treated as open findings in audit reporting.

Detection engineering: write rules with clear data sources, test against known-good and known-bad data, and version-control rule changes.

Log retention and integrity: centralize, restrict write access, use append-only or WORM storage, and align retention with legal and regulatory needs.

Cloud posture management (CSPM) continuously checks configuration against baselines; workload protection (CWPP) secures running compute.

Infrastructure as code security scans templates before deployment; misconfigured IaC reproduces the same exposure across environments.

Cloud network controls: security groups are stateful and instance-level; network ACLs are stateless and subnet-level. Both must be reviewed.

Container and Kubernetes security: image scanning, signed images, admission control, network policies, and restricted pod security standards.

Incident response in cloud: preserve provider audit logs, snapshot affected volumes, and use provider-native isolation before terminating instances.

Continuous monitoring metrics: coverage of critical log sources, alert volume and closure rate, and time from detection to containment.

Envelope encryption: a data key encrypts data; a master key (KMS/HSM) encrypts the data key. Rotating the master key avoids re-encrypting bulk data.

Key separation: distinct keys for distinct purposes (encryption vs. signing vs. backup) limit the blast radius of a compromised key.

Randomness: use a CSPRNG for keys, IVs, and salts. Predictable randomness breaks keys and nonces regardless of algorithm strength.

Certificate pinning binds a client to a specific public key or certificate; it resists interception but complicates rotation.

Homomorphic and confidential computing protect data in use; standard encryption protects only at rest and in transit.

Steganography hides data inside other media; it is a covert channel, not a confidentiality control, and is detectable by statistical analysis.

Quantum risk: Shor's algorithm breaks RSA and ECC; Grover's halves symmetric strength. Plan crypto-agility and longer symmetric keys.

Data retention and destruction schedules must align with legal holds; litigation holds override normal deletion timelines.

Governance bodies: board sets risk appetite; security steering committee prioritizes; the CISO owns the program. Risk appetite defines acceptable residual risk.

Third-party governance: due diligence before contracting, security requirements in contracts, right-to-audit clauses, and periodic reassessment.

Change management reduces risk by requiring approval, testing, rollback plans, and emergency change procedures with post-hoc review.

Security architecture frameworks (SABSA, TOGAF security) align controls to business requirements; controls without a requirement are unjustified cost.

Maturity models (e.g., CMMI-style levels) measure process maturity from ad hoc to optimized; maturity differs from compliance.

Key risk indicators (KRIs) are leading measures such as open critical findings or patch lag; KPIs measure operational performance.

Incident and breach notification obligations vary by jurisdiction and data type; legal counsel determines scope and timing.

Separation of the security function from IT operations preserves independent oversight and objective control testing.

Proxy and reverse proxy: a forward proxy mediates client egress; a reverse proxy fronts servers, terminating TLS and hiding internal topology.

CASB enforces policy for cloud service usage (shadow IT discovery, data controls); it operates via API or inline proxy.

Network segmentation models: flat (no control), VLAN, subnet with ACLs, and microsegmentation at the workload level with identity-based policy.

TLS inspection breaks end-to-end encryption at a trusted middlebox; it requires certificate distribution and privacy/legal review.

Port security and NAC prevent unauthorized devices from connecting; 802.1X with MAB covers devices that cannot authenticate.

Honeypots and deception detect attackers who probe decoy assets; alerts indicate active reconnaissance with low false-positive rates.

IPsec tunnel vs. transport mode: tunnel encrypts the entire packet including headers; transport encrypts payload only.

BGP and routing security: RPKI validates route origin; route hijacks redirect traffic and are hard to detect without monitoring.

Passwordless and phishing-resistant authentication: FIDO2/WebAuthn binds credentials to origin, defeating real-time phishing proxies.

Conditional access evaluates signals (user, device compliance, location, risk) before granting access; policy conflicts can cause lockout.

Privileged session management records and can terminate live admin sessions; break-glass accounts must be documented and monitored.

Identity proofing establishes that a claimed identity belongs to a real person; levels of assurance scale with the sensitivity of the resource.

Delegation and impersonation features must be logged and time-limited; they are common paths to privilege escalation.

Federated identity risks: overly permissive trust, unvalidated assertions, and stale guest accounts in the tenant.

Machine identity: certificates and workload identities should be short-lived and auto-rotated; static secrets in configuration are a top finding.

Access reviews and entitlement analytics detect privilege creep; compare granted rights to role definitions and flag outliers.

Windows event IDs of note: 4624 logon, 4625 failed logon, 4672 special privileges assigned, 4688 process creation, 4720 account created.

Linux log sources: /var/log/auth.log or secure, auditd, and journald. Audit rules can monitor file access and privileged command execution.

Persistence mechanisms: scheduled tasks, services, run keys, cron jobs, and startup folders. Monitoring these detects implant survival.

Exploit mitigations: ASLR, DEP/NX, stack canaries, and Control Flow Guard raise the cost of memory-corruption exploitation.

Application sandboxing and browser isolation contain rendering-engine exploits and reduce drive-by compromise.

Endpoint detection quality depends on command-line logging; without it, script-based attacks appear only as a parent process.

Host firewall default-deny inbound plus restricted outbound limits both initial access and post-exploitation movement.

System hardening verification uses benchmarks and configuration scanners; exceptions must be documented and risk-accepted.

Attack surface reduction: minimize exposed services, enforce MFA, block legacy protocols, and restrict macro execution from internet-sourced files.

Threat hunting hypothesis format: given adversary technique X, look for data source Y showing behavior Z; validate and convert hits into detections.

Living-off-the-land attacks use legitimate tools (PowerShell, WMI, PsExec); detection relies on command-line and parent-child process anomalies.

Command and control detection: periodic beaconing, rare domains, DNS TXT abuse, and encrypted channels to newly registered domains.

Data exfiltration indicators: large outbound transfers, unusual destinations, compressed archives, and access spikes to sensitive stores.

Incident severity classification drives escalation and notification; define criteria by data sensitivity, scope, and business impact.

Lessons learned should update playbooks, detections, and controls; track corrective actions to closure.

Red team and purple team exercises validate detection and response; purple teaming pairs attackers with defenders in real time.

Qualitative risk uses ordinal scales (low/medium/high); quantitative uses monetary values. Both must document assumptions.

Risk matrix: likelihood x impact. Risk tolerance lines define which combinations require treatment before acceptance.

Inherent risk is before controls; residual risk is after controls. Reporting residual risk without control evidence is misleading.

Vulnerability disclosure: coordinated disclosure gives vendors time to fix; a defined intake process and SLA prevent unmanaged reports.

Bug bounty programs extend testing coverage but require scope, safe-harbor terms, and triage capacity.

Patch prioritization combines CVSS, EPSS, known-exploited status, internet exposure, and asset criticality.

Asset criticality tiers determine remediation SLAs; critical assets get shorter windows than low-impact systems.

Metrics for vulnerability programs: mean time to remediate by severity, reopened findings, and percentage of assets scanned.

Detection sources in cloud: identity logs (sign-ins, role changes), network flow logs, storage access logs, and workload runtime telemetry.

Cloud IAM risk patterns: wildcard permissions, cross-account trust without conditions, and unused roles with high privilege.

Secrets management: vault secrets, inject at runtime, rotate automatically, and scan repositories for committed credentials.

Cloud workload isolation: separate accounts/projects per environment and workload; blast radius shrinks with account boundaries.

Serverless security: function permissions, event-source validation, dependency risk, and short execution limits that constrain attackers.

Cloud incident containment: revoke credentials and sessions, disable compromised identities, isolate workloads, and preserve audit logs before cleanup.

Compliance in cloud: map provider attestations to your obligations; provider compliance does not transfer to customer configurations.

Cost and security correlation: unexpected spend spikes can indicate cryptomining or resource abuse after compromise.

Encryption at rest does not protect against a compromised application with the key; access control and key isolation are required.

TLS certificate validation failures (expiry, hostname mismatch, untrusted chain) must not be bypassed in production clients.

Message authentication: encrypt-then-MAC is preferred; MAC-then-encrypt and encrypt-and-MAC have known pitfalls.

Password-based key derivation uses salts and iteration counts (PBKDF2, scrypt, Argon2) to slow offline guessing.

Format-preserving encryption keeps data usable in fixed-length fields; it complicates key management and should be justified.

Key escrow enables recovery but creates a high-value target; split-knowledge and dual control protect escrow stores.

Data loss prevention policies require classification labels; unlabeled data cannot be reliably protected or blocked.

Secure multi-party and privacy-enhancing techniques (differential privacy, secure enclaves) reduce exposure when processing sensitive data.

Risk assessment steps: identify assets, identify threats and vulnerabilities, determine likelihood and impact, evaluate, treat, and monitor.

Control frameworks: preventive and detective controls should be paired; a detective control without a response process has no value.

Documentation of exceptions must include justification, compensating controls, approver, and expiry date.

Regulatory mapping: one control can satisfy multiple frameworks; map once and reuse evidence to reduce audit burden.

Security budget justification uses risk reduction per dollar; ALE reduction provides the comparison basis.

Roles and responsibilities (RACI) clarify who is accountable for each control; ambiguous ownership is a common audit finding.

Business impact analysis identifies critical processes and dependencies; it drives RTO and RPO targets for recovery.

Awareness and culture metrics (reporting rate, simulation failure rate) indicate whether controls rely on people are effective.

Firewall rule hygiene: default deny, specific rules above general ones, no any-any rules, and periodic review of unused rules.

IDS/IPS placement: north-south at the perimeter, east-west between segments; encrypted traffic requires decryption or host-based detection.

Network access control (NAC) enforces posture (patch level, AV, encryption) before allowing network access.

VPN security: strong authentication, split vs. full tunneling decisions, and logging of connections; exposed VPN appliances are frequently exploited.

DNS over HTTPS/TLS encrypts queries but can bypass enterprise filtering; policy must account for it.

Network time protocol integrity matters for logs, Kerberos, and certificates; spoofed time can break authentication and evidence.

Wireless rogue AP detection compares authorized AP inventory against observed SSIDs and BSSIDs.

Traffic analysis: beaconing detection uses interval regularity and jitter analysis; legitimate software also beacons, so baselining is required.

Authentication vs. authorization: authentication proves identity; authorization decides permitted actions. Confusing them causes access flaws.

Account types: user, service, privileged, guest. Each requires distinct lifecycle, monitoring, and review frequency.

MFA fatigue and push bombing attacks exploit repeated prompts; number matching and phishing-resistant factors mitigate.

OAuth scopes define delegated permissions; over-broad consent grants persist after the initial app install.

Identity governance includes role mining, access requests, approvals, and periodic recertification.

Break-glass accounts require strong protection, monitoring, and documented use; they should not be used for routine work.

Session revocation after credential compromise is essential; tokens and refresh tokens must be invalidated, not just passwords reset.

Directory tiering separates highly privileged identity systems from general-purpose administration to prevent credential theft escalation.

Endpoint patching must include firmware and drivers; unpatched firmware can bypass OS-level protections.

Antivirus exclusions should be minimal and documented; broad exclusions create blind spots attackers exploit.

Application control modes: audit (log only) vs. enforcement (block). Deploy in audit first to build allowlists.

Endpoint backup and recovery: test restores and protect backup credentials; ransomware targets backup infrastructure.

Privilege management on endpoints: remove local admin rights or use just-in-time elevation; local admin is a common escalation path.

EDR response actions: isolate host, kill process, quarantine file, collect memory. Each action has evidence-preservation implications.

Secure remote access to endpoints requires MFA, patched clients, and logging; remote management tools are targeted by attackers.

Configuration drift detection compares endpoints to baseline continuously; one-time hardening decays over time.

Initial access vectors: phishing, valid accounts, exploitation of public-facing applications, removable media, and supply chain compromise.

Credential dumping detection: unusual access to LSASS, SAM, or ntds.dit; monitor for tools and suspicious process access.

Lateral movement indicators: remote service creation, pass-the-hash, RDP from unusual sources, and admin share access.

Privilege escalation detection: new local admin grants, token manipulation, and unpatched local exploits.

Exfiltration over C2 vs. alternative channels (cloud storage, DNS, email); egress monitoring must cover all protocols.

Incident response communication plan: internal escalation, executive briefing, legal/privacy, and external notification channels.

Evidence admissibility depends on documented handling; integrity hashes and logs of who accessed evidence support authenticity.

Recovery validation: confirm malware removal, patch the initial access vector, and monitor closely after restoration.

Vulnerability scanning frequency should reflect change rate and exposure; internet-facing assets scan more often than isolated systems.

Credentialed scan failures are often caused by firewall rules, SMB/WMI restrictions, or expired service accounts.

Configuration compliance scanning differs from vulnerability scanning; both are needed for a complete view.

Risk treatment must consider compensating controls; a control reduces likelihood or impact, and its effectiveness must be evidenced.

Threat modeling at design time is cheaper than remediation after deployment; include data flows and trust boundaries.

Supply chain vulnerabilities (e.g., transitive dependencies) require SBOM tracking and rapid impact analysis when a component is disclosed.

Exploitability validation (proof of concept in a lab) distinguishes theoretical from practical risk before emergency patching.

Report risk in business terms: affected process, data, regulatory exposure, and remediation cost versus impact.

SOC runbooks define triage steps, data sources, escalation contacts, and closure criteria for each alert type.

Detection coverage mapping against ATT&CK identifies blind spots; coverage should be measured by technique, not tool count.

Automation (SOAR) handles enrichment and repetitive response; automated containment actions require guardrails and rollback.

Cloud logging must include both management and data plane events; data plane access is often where exfiltration occurs.

Cloud key management: customer-managed keys provide control but require rotation, access policy, and availability planning.

Cloud network exposure review: public load balancers, open security groups to 0.0.0.0/0, and unauthenticated APIs are top findings.

Backup immutability and cross-account copies defend against ransomware that targets cloud backups.

Monitoring hygiene: alert fatigue reduces response quality; retire noisy rules and measure true-positive rates.

Symmetric key distribution problem is solved by asymmetric key exchange or a KDC; the choice affects scalability and trust model.

Digital certificates bind identity to a public key; self-signed certificates are acceptable only in controlled internal contexts with pinning.

Hash-based integrity alone does not prove origin; an attacker who can modify data can also recompute the hash. HMAC or signatures are required.

Encryption modes and IV/nonce handling are frequent implementation flaws; reuse or predictability breaks confidentiality.

Crypto-agility means algorithms and key lengths can be changed without redesign; hard-coded algorithms create migration risk.

Data classification determines encryption strength and key custody; uniform encryption without classification wastes effort and obscures priority.

Secure enclaves and TPMs protect keys at rest and in use; attestation proves the platform state to a relying party.

Legal and export considerations affect cryptography choices; some jurisdictions restrict algorithm strength or key custody arrangements.

Risk appetite vs. risk tolerance: appetite is the high-level willingness to accept risk; tolerance is the acceptable deviation at the operational level.

Control testing should be independent of the control owner; self-assessment alone is weak evidence.

Security policy exceptions should be time-bound and reviewed; permanent exceptions become de facto policy.

Asset ownership includes accountability for classification, access approval, and periodic review.

Governance reporting should include trend data, open risks, incidents, and compliance status, not just point-in-time metrics.

Business continuity testing (tabletop, simulation, full failover) validates recovery assumptions; untested plans are unproven.

Legal and regulatory change monitoring is a governance function; new obligations must be mapped to controls.

Third-party contract terms should include breach notification timelines, data return/destruction, and subcontractor obligations.

Firewall types: packet filter, stateful, application proxy, next-gen with IPS and app awareness. Each has different inspection depth and performance cost.

Network segmentation validation: test whether traffic actually crosses enforcement points; VLANs alone do not enforce policy.

Intrusion prevention tuning: signature accuracy, performance impact, and false-positive management determine whether inline blocking is viable.

Secure remote access: VPN or ZTNA with MFA, device posture checks, and least-privilege access to specific applications.

Network monitoring baselines normal traffic patterns; deviations such as new ports, protocols, or peers warrant investigation.

Encrypted traffic visibility: metadata analysis, TLS inspection, or endpoint telemetry are the main options; each has tradeoffs.

Wireless security controls: WPA3, 802.1X, rogue AP detection, and guest network isolation.

Network device hardening: disable unused services, use AAA, restrict management access, and patch firmware.

Access control enforcement points: application, database, network, and OS. Each layer must enforce its own authorization.

Role design should be based on job function and least privilege; role explosion reduces manageability and increases risk.

Attribute-based access control evaluates subject, resource, action, and environment attributes; policy complexity must be managed.

Identity federation requires trust configuration, metadata, and certificate lifecycle management.

Authentication assurance levels scale with risk; high-value transactions require stronger proofing and phishing-resistant factors.

Account lockout policies must balance brute-force resistance with denial-of-service risk; rate limiting and MFA reduce reliance on lockout.

Privileged access reviews should be more frequent than standard user reviews and include session recordings.

Identity analytics detect anomalies such as dormant account use, impossible travel, and privilege changes outside change windows.

Endpoint hardening baselines should be versioned and tested; overly aggressive settings can break business applications.

Patch rings (pilot, broad, critical) balance speed and stability; critical vulnerabilities may bypass rings with emergency change.

Endpoint logging must be centralized and protected; local logs can be deleted by an attacker with admin rights.

Application allowlisting requires a process for approving new software and updating hashes when applications update.

Device encryption protects data at rest if a device is lost or stolen; recovery keys must be escrowed securely.

Endpoint detection should cover process, file, registry, network, and memory events; partial coverage creates blind spots.

Remote wipe and device management reduce loss impact; test procedures and confirm they work offline.

Secure boot and measured boot detect tampering at startup; attestation can gate access to sensitive resources.

Phishing simulation metrics: click rate, credential submission rate, and report rate; report rate is the most valuable culture indicator.

Malware analysis: static analysis (strings, hashes) and dynamic analysis (sandbox execution) provide complementary evidence.

Threat intelligence sharing formats: STIX for structure, TAXII for transport; automation requires confidence and context.

Incident triage questions: what is affected, how many systems, what data, is it ongoing, and what is the business impact.

Containment tradeoffs: immediate isolation may alert attackers, while delay increases spread; decide based on scope and criticality.

Root cause analysis distinguishes the initial access vector from the contributing control failures.

Recovery should include validation that the vulnerability was fixed, not just that systems are running.

Crisis communication requires pre-approved messaging and legal review; ad hoc statements create legal and reputational risk.

Vulnerability prioritization frameworks: CVSS for severity, EPSS for exploitation likelihood, and known-exploited lists for active threats.

Scanning scope must include cloud assets, containers, and third-party components; traditional host scanning misses these.

False-positive management includes validation, scanner tuning, and documented exceptions with expiry.

Remediation SLAs should be risk-based and enforced; track exceptions and overdue findings as risk.

Penetration testing should validate exploitable paths, not just list findings; include business impact in reporting.

Threat modeling should be repeated when architecture changes; stale models create false confidence.

Supply chain risk requires vendor security assessment, SBOM review, and monitoring for compromised components.

Risk reporting should show trends and residual risk, not just counts of findings.

SOC metrics: alert volume, true-positive rate, MTTD, MTTR, and coverage of critical log sources.

Log source onboarding must include parsing, normalization, and testing; unparsed logs produce blind spots.

Detection rules should be version-controlled and peer-reviewed; untested rules create false confidence.

Cloud posture management should be continuous; point-in-time checks miss drift and new exposures.

Cloud identity monitoring should cover role changes, MFA changes, and cross-account trust modifications.

Incident response in cloud requires preserving logs and snapshots before remediation; terminating instances can destroy evidence.

Automation guardrails: require approval for destructive actions and log all automated changes.

Backup and recovery testing should include ransomware scenarios and verify immutability and restore time.