DSST Cybersecurity cheat sheet

Input validation rule: validate on the server side using allowlists (known-good characters/patterns); client-side validation is a usability aid only and never a security control.

SQL injection defense hierarchy: parameterized queries/prepared statements first, then stored procedures, then input escaping; concatenating user input into SQL is the root cause.

Cross-site scripting types: reflected (payload in request echoed in response), stored (payload persisted server-side), DOM-based (sink in client-side JavaScript). Output encoding at the correct context (HTML, attribute, JS, URL) is the primary control.

CSRF defense: unpredictable synchronizer token tied to the session, or SameSite cookies; checking Origin/Referer is a secondary layer. GET requests must be safe/idempotent.

Broken access control is the top web risk class: enforce authorization server-side per object (IDOR prevention), deny by default, and never rely on hidden UI elements.

Memory safety: stack overflow overwrites return addresses; heap overflow corrupts heap metadata; ASLR randomizes base addresses; DEP/NX blocks execution from data pages; stack canaries detect return-address overwrite.

Secure SDLC phases: threat modeling at design, static analysis (SAST) on source, dynamic analysis (DAST) on running apps, software composition analysis (SCA) for third-party dependencies, and penetration testing before release.

File upload controls: validate type by content not extension, store outside webroot, rename files, disable execution in the upload directory, and enforce size limits.

Race condition (TOCTOU) fix: make check-and-use atomic via locking or atomic OS operations; the vulnerability exists when state changes between check and use.

Three authentication factors: something you know (password/PIN), something you have (token, smart card, phone), something you are (biometrics). Two factors must come from different categories; two passwords are not MFA.

Password storage: salted, slow hashes (bcrypt, scrypt, Argon2, PBKDF2). Salt defeats rainbow tables; slowness defeats brute force. Plain MD5/SHA-1 is unsuitable for passwords.

Kerberos flow: client authenticates once to the KDC, receives a TGT, then requests service tickets; tickets are time-limited and realm-scoped.

OAuth 2.0 delegates authorization via access tokens; OpenID Connect adds an identity layer (ID token, a signed JWT) on top of OAuth 2.0 for authentication.

SAML assertions carry authentication/authorization statements between an identity provider and a service provider; assertions are XML and digitally signed.

Access control models: DAC (owner discretion), MAC (labels/clearances, e.g., Bell-LaPadula confidentiality, Biba integrity), RBAC (role-based), ABAC (attribute/policy-based).

RADIUS and TACACS+ are AAA protocols; TACACS+ encrypts the entire payload and separates AAA functions, RADIUS encrypts only the password.

Session management: generate a new session ID at login (session fixation defense), set HttpOnly and Secure cookie flags, and enforce idle and absolute timeouts.

PCI DSS applies to any entity that stores, processes, or transmits cardholder data; core requirements include encryption of card data in transit and at rest, quarterly ASV scans, and annual penetration testing.

HIPAA Security Rule covers electronic protected health information (ePHI) with administrative, physical, and technical safeguards; the Privacy Rule governs use and disclosure.

GDPR lawful bases include consent, contract, legal obligation, vital interests, public task, and legitimate interests; breach notification to the supervisory authority is generally within 72 hours.

SOX Section 404 requires management assessment and auditor attestation of internal controls over financial reporting; IT general controls (change management, access, backup) support it.

NIST Cybersecurity Framework core functions: Identify, Protect, Detect, Respond, Recover (plus Govern in CSF 2.0).

Data classification tiers (public, internal, confidential, restricted) drive handling rules: storage, transmission, retention, and destruction requirements follow the label.

Chain of custody: document who collected evidence, when, where, and every transfer; hash the evidence at acquisition to prove integrity.

Due care is acting on identified risk; due diligence is the ongoing investigation/verification that supports it.

OSI layer attacks: ARP spoofing (Layer 2), IP spoofing/SYN flood (Layer 3/4), DNS poisoning and TLS stripping (Layer 7). Defense in depth places controls at each layer.

Firewall rule order matters: rules are evaluated top-down and the first match wins; an implicit deny-all should terminate the list. Stateful firewalls track connection state; stateless ACLs filter per packet.

DMZ design: internet-facing services sit in a segmented zone between two firewall boundaries; internal databases are never directly reachable from the internet.

IDS detects and alerts (passive); IPS detects and blocks inline. Signature detection matches known patterns; anomaly detection baselines normal behavior.

VPN: IPsec uses AH (integrity/authentication) and ESP (encryption); TLS VPNs operate at the transport/session layer. Split tunneling lets remote traffic bypass the tunnel.

802.1X port-based network access control uses a supplicant, authenticator (switch), and authentication server (RADIUS) before granting LAN access.

Physical controls: mantraps prevent tailgating, bollards stop vehicle ramming, CCTV is detective, guards are preventive and detective, biometric locks are preventive.

Environmental controls: fire suppression for data centers uses clean agents (FM-200, inert gas) rather than water; UPS bridges short outages, generators cover extended ones.

Wireless: WPA2/WPA3 with AES-CCMP; WEP and WPA/TKIP are deprecated. Rogue access points and evil twins are detected by wireless surveys and WIDS.

CVSS base score components: attack vector, attack complexity, privileges required, user interaction, scope, and the CIA impact metrics; base score ranges 0.0-10.0.

CVE is the identifier for a specific vulnerability; NVD enriches CVEs with CVSS scores and CPE applicability data.

Scan types: credentialed (authenticated) scans see installed patches and configuration; non-credentialed scans see only exposed services. Credentialed scans produce fewer false positives.

False positive = tool reports a vulnerability that does not exist; false negative = tool misses a real vulnerability. Tuning reduces both but trades against each other.

Patch lifecycle: inventory, assess, prioritize by risk (exposure + severity + exploitability), test, deploy, verify. Emergency patching is triggered by active exploitation.

Risk rating formula in practice: likelihood x impact; a critical CVSS score on an unreachable internal host may rank below a medium score on an internet-facing host.

Zero-day: no vendor patch exists; compensating controls (virtual patching via WAF/IPS, segmentation, least privilege) reduce exposure until a fix ships.

Penetration test phases: scoping/contract, reconnaissance, scanning/enumeration, exploitation, post-exploitation, reporting, and remediation retest.

Vulnerability exception (risk acceptance) requires documented owner approval, a compensating control, and a defined expiration/review date.