CSPI cheat sheet

Risk = likelihood × impact; a threat with no vulnerability is not risk, and a vulnerability with no credible threat is not risk.

SLE = asset value × exposure factor (EF as a decimal percent of value lost in one event); ALE = SLE × ARO.

A control is economically justified when its annual cost is less than the ALE reduction it produces.

Risk handling options are mitigate, transfer, avoid, and accept; acceptance is documented by the asset owner, not by the security team.

Residual risk = total risk minus mitigated risk; it always remains after controls and requires formal management sign-off.

Qualitative analysis uses ordinal scales and a likelihood/impact matrix; quantitative analysis uses monetary values and better supports cost-benefit defense.

CIA triad: confidentiality = disclosure only to authorized subjects; integrity = accuracy and completeness; availability = timely, reliable access.

BIA outputs drive recovery design: RTO must be ≤ MTD, RPO defines maximum tolerable data loss, and both determine backup and failover architecture.

Due care is acting reasonably to protect assets; due diligence is verifying, documenting, and reassessing that those actions are adequate.

Document hierarchy: policy (mandatory management intent) > standard (mandatory specific requirement) > procedure (step-by-step instruction) > guideline (recommended, non-mandatory).

Senior management approves policy and owns risk decisions; operations implements and enforces it.

Frameworks: ISO/IEC 27001 (certifiable ISMS), NIST CSF (identify, protect, detect, respond, recover, plus govern in 2.0), COBIT (IT governance), SOC 2 (trust services criteria).

Regulations: GDPR (EU personal data, 72-hour breach notification), HIPAA (US health data), SOX (financial reporting controls), PCI DSS (cardholder data, contractually enforced).

When laws or jurisdictions conflict, apply the stricter requirement unless a documented legal determination says otherwise.

Third-party governance: pre-engagement due diligence, contractual security and right-to-audit clauses, tiering by data sensitivity, and periodic reassessment.

Data classification tiers drive labeling, handling, retention, and access rules; the data owner classifies and accepts risk, the custodian implements controls.

Mandatory vacation and job rotation are administrative detective controls that expose fraud schemes requiring continuous concealment.

Ethics obligations rank society and the public infrastructure above employer, customer, and self-interest; conflicts of interest must be disclosed and recused.

Secure design principles: least privilege, separation of duties, fail-safe defaults, complete mediation, open design, economy of mechanism, least common mechanism, psychological acceptability.

Control categories: technical, operational, managerial, physical. Control functions: preventive, detective, corrective, deterrent, compensating, recovery.

Bell-LaPadula protects confidentiality (no read up, no write down); Biba protects integrity (no read down, no write up); Clark-Wilson uses well-formed transactions and separation of duties.

A reference monitor must mediate every access, be tamper-proof, and be verifiable; the TCB is the implementation of that concept.

Layered controls by OSI: physical/data link (locks, 802.1X, port security), network (firewalls, IPsec), transport (TLS), application (WAF, authentication, input validation).

Symmetric encryption is fast and used for bulk data; asymmetric encryption solves key distribution and enables signatures; hashing gives integrity, not confidentiality; salting defeats precomputed rainbow tables.

Digital signature = hash of the message encrypted with the sender's private key, providing integrity, origin authentication, and non-repudiation.

Cloud shared responsibility: provider secures the cloud (physical, hypervisor); customer secures what is in the cloud (data, identity, configuration); the split shifts from IaaS to PaaS to SaaS.

Zero Trust removes implicit trust from network location: every request is authenticated, authorized by policy, and continuously re-evaluated based on identity and device posture.

IR life cycle: preparation → detection and analysis → containment, eradication, and recovery → post-incident activity (lessons learned feeding preparation).

Containment precedes eradication; choosing isolation over shutdown preserves volatile evidence and avoids tipping off a persistent adversary.

Order of volatility: registers and cache → RAM → swap and temp files → network and process state → disk → remote logs → archival backups; collect the most perishable first.

Forensic integrity: image through a write blocker, hash before and after, verify hashes match, and record every custody transfer in an unbroken chain.

Signature-based IDS matches known patterns with low false positives but misses novel attacks; anomaly-based IDS baselines normal behavior and detects new activity with more false positives.

Backups: full = all data; differential = changes since the last full; incremental = changes since the last backup of any type. Restore needs full + latest differential, or full + all incrementals.

Centralize logs, synchronize clocks with NTP, retain per policy, and correlate in a SIEM; logs are the primary detective and investigative evidence source.

Vulnerability management cycle: inventory → scan → prioritize by exploitability and asset criticality → remediate or mitigate → verify by rescan; patching is one remediation path.

Tabletop exercises validate plans and roles without production disruption; full failover tests give the strongest assurance of recovery capability.