C|CT cheat sheet

Defense in depth layers controls so that no single failure exposes the asset: perimeter filtering, internal segmentation, host hardening, and monitoring each fail independently.

The CIA triad is the standard triage rule: confidentiality protects disclosure, integrity protects modification, availability protects uptime; a control is chosen by which leg the threat targets.

Stateful inspection tracks the 5-tuple (source IP, destination IP, source port, destination port, protocol) plus TCP flags; stateless ACLs match packets individually and cannot detect out-of-state replies.

DMZ placement rule: internet-facing services sit in a screened subnet between two filtering points; the internal LAN must never be directly reachable from the DMZ without a second policy check.

Network segmentation limits lateral movement; flat networks let one compromised host reach every peer, while VLANs plus inter-VLAN ACLs force traffic through a policy enforcement point.

IDS detects and alerts (passive, out-of-band, no packet dropping); IPS sits inline and can block. Signature detection catches known patterns; anomaly detection baselines normal and flags deviation, trading false positives for unknown-threat coverage.

NAT/PAT rewrites source addresses and ports; it conserves public IPv4 space and hides internal topology but is not a security control and breaks end-to-end protocols needing embedded addresses.

802.1X port-based access control authenticates a device before granting VLAN access via supplicant, authenticator (switch), and authentication server (RADIUS); without it, physical port access equals network access.

Log retention and time synchronization are defensive requirements: NTP-aligned clocks across firewalls, routers, and hosts are a precondition for correlating events during incident reconstruction.

Authorization is the dividing line between penetration testing and unauthorized access: written scope, signed rules of engagement, and defined testing windows precede any active technique.

Reconnaissance splits into passive (OSINT, DNS records, certificate transparency, WHOIS, search engines; no packets to the target) and active (port scans, banner grabs, service probes; visible to the target).

TCP connect scan completes the three-way handshake and is logged by the target; SYN scan sends SYN and never completes, leaving half-open connections that many hosts do not log.

Nmap states: open (service listening), closed (reachable, no listener, RST returned), filtered (no reply or ICMP unreachable, firewall dropping), unfiltered (reachable but state undetermined).

Vulnerability severity uses CVSS base metrics: attack vector, attack complexity, privileges required, user interaction, plus confidentiality, integrity, and availability impact; the score is not a substitute for exploitability context.

Exploitation phases follow a repeatable order: enumeration of users/shares/services, vulnerability validation, exploitation, privilege escalation, persistence, then evidence collection and cleanup.

Password attacks: online guessing is rate-limited and noisy; offline cracking against captured hashes is limited only by hash algorithm, password entropy, and attacker hardware.

Web testing anchors on the OWASP Top 10 categories: injection, broken access control, cryptographic failures, misconfiguration, and vulnerable components are the highest-frequency findings.

Reporting converts findings into risk: each item needs reproduction steps, affected asset, business impact, severity rating, and a remediation recommendation; unverifiable findings are excluded.

Order of volatility governs acquisition order: CPU registers and cache, then RAM, then swap and temporary files, then disk, then remote logs and backups, then archival media.

Chain of custody records who handled evidence, when, where, and why; any gap in the record weakens admissibility regardless of the technical soundness of the analysis.

Write blockers and hash verification (MD5/SHA-256 before and after imaging) establish that the working copy matches the original; analysis is performed on the copy, never the source.

File system timestamps differ in meaning: MACE (modified, accessed, changed/metadata, entry-created) on NTFS; $STANDARD_INFORMATION and $FILE_NAME attributes can disagree, which itself is evidence.

Deleted-file recovery depends on whether the MFT entry or inode is reused; unallocated space and slack space retain remnants of prior content until overwritten.

Windows artifacts: Event logs (Security 4624 logon, 4625 failure), registry hives (SAM, SYSTEM, NTUSER.DAT), prefetch, Amcache, ShimCache, and $UsnJrnl record execution and access history.

Linux artifacts: /var/log/auth.log and secure, wtmp/btmp, bash_history, /etc/passwd and shadow, cron entries, and file timestamps; journald stores binary logs queried with journalctl.

Memory forensics recovers running processes, network connections, loaded modules, injected code, and encryption keys that vanish on shutdown; hibernation and pagefile files are disk-resident memory sources.

Timeline analysis normalizes timestamps to a single time zone (UTC preferred) and correlates sources; unnormalized or unsynchronized clocks produce false orderings.

SOC tiers: Tier 1 triages and closes or escalates alerts, Tier 2 investigates and contains, Tier 3 performs hunting and advanced response; escalation criteria are defined by playbooks, not judgment alone.

SIEM correlation joins log sources by rule; detection quality depends on log coverage, normalization, and tuning. High false positive rates cause alert fatigue and missed true positives.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned; containment strategy (isolate vs. monitor) trades evidence preservation against spread risk.

MTTD (mean time to detect) and MTTR (mean time to respond) are the standard SOC metrics; both are measured from event occurrence, not from alert generation.

Threat intelligence feeds indicators (IPs, domains, hashes) mapped to frameworks such as MITRE ATT&CK tactics and techniques; indicators age quickly, so TTL and confidence must be tracked.

Vulnerability management cycle: inventory assets, scan, prioritize by exploitability and asset criticality, remediate or mitigate, then verify closure with a rescan.

Change management requires documented approval, rollback plan, and testing before production deployment; emergency changes are reviewed retroactively within a defined window.

Backup strategy follows 3-2-1: three copies, two media types, one offsite; restore testing proves recoverability, and immutable or offline copies defend against ransomware encryption.

Evidence handling during response preserves volatile data first and documents every action taken on affected hosts so the forensic record survives containment.