CyberOps Associate cheat sheet

CIA triad mapping: Confidentiality = encryption and access control; Integrity = hashing and digital signatures; Availability = redundancy, backups, and failover.

Qualitative risk = Threat × Vulnerability × Impact. Risk treatment options are mitigate, transfer, avoid, and accept.

Authentication factors: something you know (password/PIN), something you have (token, smart card), something you are (biometrics). MFA requires two or more different categories, not two instances of one.

Symmetric encryption (AES) uses one shared secret key and is fast, so it protects bulk data; asymmetric encryption (RSA, ECDSA) uses a public/private key pair and is used for key exchange and signatures.

Hashing (SHA-256) is one-way, produces a fixed-length digest, and detects any change to the input; HMAC adds a shared secret so the digest also proves authenticity.

Malware behavior classes: virus needs a host file and user action; worm self-propagates without a host; trojan disguises itself as legitimate software; ransomware encrypts data for extortion.

Access control models: DAC (resource owner grants access), MAC (labels and clearance levels), RBAC (access by job role), ABAC (access by attributes such as time, location, department).

Zero-day exploit: attacks a vulnerability with no vendor patch and no public signature, so signature-based AV/IDS detection is unreliable and behavior-based analysis is required.

SIEM function: aggregate and normalize logs from firewalls, IDS/IPS, servers, and endpoints, then correlate them against rules and generate prioritized alerts.

Syslog uses UDP 514 by default; syslog over TLS uses TCP 6514 for encrypted, reliable delivery to the collector.

NetFlow/IPFIX records flow metadata (five-tuple, byte and packet counts, timestamps) but no payload; full packet capture records payload at a much higher storage cost.

NTP (UDP 123) keeps device clocks synchronized. Unsynced clocks corrupt event correlation and weaken the timeline value of logs used as evidence.

SNMP uses UDP 161 for agent queries and UDP 162 for traps; SNMPv3 adds authentication and encryption that v1 and v2c lack.

A baseline is a documented profile of normal traffic volume, protocols, and login patterns. An anomaly is any deviation from baseline, and it is not automatically malicious.

Alert outcomes: true positive (real attack detected), false positive (benign event flagged), true negative (benign event ignored), false negative (real attack missed - the highest-risk outcome).

IDS is passive, fed by a SPAN/mirror port, and only alerts; IPS is inline and can drop traffic, so an IPS false positive can block legitimate business traffic.

Document hierarchy: policy = mandatory management intent (what and why); standard = mandatory specific requirements; procedure = step-by-step instructions; guideline = recommended but non-binding.

An Acceptable Use Policy defines permitted use of organizational systems and data, states privacy expectations, and links violations to the HR and legal processes.

Data classification tiers (public, internal, confidential, restricted) drive handling, storage, transmission, encryption, and retention requirements for each data type.

Separation of duties splits a sensitive task across multiple people so no single individual can complete fraud alone; it is complemented by job rotation and least privilege.

Due care is the action taken to protect assets (implementing controls); due diligence is ongoing verification that the controls work. Both support a negligence defense.

Regulatory drivers: PCI DSS for cardholder data, HIPAA for US health information, GDPR for EU personal data, SOX for financial reporting controls.

An incident response plan must define roles, severity levels, escalation contacts, communication channels, and evidence handling, and it must be tested and reviewed at least annually.

NIST SP 800-61 phases: (1) Preparation; (2) Detection and Analysis; (3) Containment, Eradication, and Recovery; (4) Post-Incident Activity. Phases can run concurrently and repeat.

Order of volatility (RFC 3227), most volatile first: CPU registers/cache → system memory → network state and ARP cache → running processes → disk storage → backups and archives.

Chain of custody documents who collected, handled, and accessed evidence, with date, time, and purpose. Any gap lowers the evidentiary weight or admissibility.

Containment options: disable the switch port to isolate a host, block traffic at the firewall, sinkhole malicious DNS, segment the network, or power off the host (which destroys volatile evidence).

Eradication removes the root cause (malware, backdoors, rogue accounts, the exploited vulnerability); recovery restores systems to a known-good state and monitors for reinfection.

Severity is derived from data sensitivity, number of affected hosts, business criticality of the service, and rate of spread; severity drives the escalation level and notification requirements.

Post-incident activity: lessons-learned meeting, formal incident report, and control improvements, measured with metrics such as MTTD (mean time to detect) and MTTR (mean time to respond).

CSIRT roles commonly include the incident handler/analyst, team lead, communications lead, legal counsel, HR representative, and management liaison.

TCP connection setup is SYN → SYN-ACK → ACK with agreed initial sequence numbers. A capture showing SYNs with no completed handshakes indicates scanning, spoofing, or filtered paths.

Scan signatures: SYN (half-open) scan sends many SYNs to sequential ports and never completes the handshake; XMAS, FIN, and NULL scans use unusual flag combinations to evade simple filters.

tcpdump uses BPF capture syntax (tcp port 80, host 10.1.1.5, not arp); Wireshark display filters use a different syntax (ip.addr==10.1.1.5 && tcp.port==443) applied after capture.

Five-tuple = source IP, source port, destination IP, destination port, and protocol. It identifies a single flow and is the key used by firewalls, NetFlow records, and session tables.

ARP spoofing sends forged ARP replies mapping the gateway IP to the attacker MAC, enabling man-in-the-middle. Indicators are duplicate IP-to-MAC mappings and unsolicited gratuitous ARP.

DNS tunneling indicators: high volume of TXT or NULL queries to a single domain, unusually long or encoded labels, many NXDOMAIN responses, and queries to domains with no business purpose.

Beaconing indicators: outbound connections to the same external IP at regular intervals with small, consistent payloads; large transfers at unusual hours; traffic to known-bad IPs; internal hosts offering services on unusual ports.

HTTP status codes in logs: 200 OK, 301/302 redirect, 401 unauthorized, 403 forbidden, 404 not found, 500 server error. Spikes of 401 or 404 from one source suggest brute force or content enumeration.