CNDA cheat sheet

CIA triad: Confidentiality protects disclosure, Integrity protects modification, Availability protects timely access; each control is mapped to the property it primarily serves.

Defense in depth layers controls so no single failure is decisive: perimeter, network segmentation, host hardening, identity, monitoring, and response each provide independent coverage.

Least privilege and need-to-know limit both user rights and service accounts; separation of duties prevents one identity from authorizing and executing a sensitive action.

Risk = Threat x Vulnerability x Impact; risk treatment options are mitigate, transfer, avoid, and accept, and residual risk is what remains after controls.

The TCP/IP model layers are Application, Transport, Internet, and Link; each layer has distinct attacks (e.g., ARP spoofing at Link, SYN flood at Transport).

AAA separates Authentication (who you are), Authorization (what you may do), and Accounting (what you did); RADIUS and TACACS+ are common AAA protocols.

Fail-safe defaults vs fail-open: a security control should deny access on failure unless availability requirements are documented and formally accepted.

Zero Trust removes implicit trust from the internal network; every request is authenticated and authorized based on identity, device posture, and context.

Common frameworks: NIST CSF functions are Identify, Protect, Detect, Respond, Recover, and Govern; CIS Controls are prioritized safeguards mapped to those functions.

Stateful firewalls track connection state; stateless ACLs evaluate each packet alone, so return traffic must be explicitly permitted in stateless designs.

Default-deny inbound and default-deny outbound are separate policies; egress filtering blocks command-and-control callbacks and data exfiltration.

DMZ design places internet-facing services on a segmented subnet with restricted paths to the internal network, so a compromised host cannot pivot freely.

NAT is not a security control; it obscures addressing but does not inspect, authenticate, or block malicious payloads.

IDS detects and alerts (passive), IPS detects and blocks inline (active); signature, anomaly, and behavior are the three main detection methods.

VPN tunnels: IPsec uses AH for integrity/authentication and ESP for encryption plus integrity; TLS VPNs commonly use 443 to traverse restrictive networks.

802.1X port-based access control authenticates devices before network access; NAC adds posture checks such as patch level and endpoint agent status.

Proxy and reverse proxy terminate client or server connections, enabling content filtering, TLS inspection, and hiding internal topology.

Microsegmentation applies least-privilege east-west rules between workloads, limiting lateral movement after a perimeter breach.

Patch management lifecycle: inventory, risk-rank, test, deploy, verify; mean time to remediate is a measurable defense metric.

Host hardening baselines disable unused services and ports, remove default accounts, enforce least privilege, and enable logging of privileged actions.

Application allowlisting (deny-by-default execution) blocks unknown binaries more reliably than blocklisting, which fails against renamed or polymorphic malware.

EDR collects process, file, registry, network, and memory telemetry; it supports detection, hunting, and containment, unlike signature-only antivirus.

Windows privilege tiers: Tier 0 domain controllers, Tier 1 servers, Tier 2 workstations; credentials must not cross downward between tiers.

File integrity monitoring hashes critical files and alerts on change; it detects tampering with system binaries, configs, and audit logs.

Full-disk encryption at rest protects against physical theft; it does not protect data in use or against a compromised running OS.

Endpoint isolation (network containment) preserves memory and disk evidence while cutting C2 traffic, and is reversible unlike reimaging.

Least functionality and secure boot/UEFI validation reduce the attack surface and resist bootkits and unauthorized kernel drivers.

Log source categories: network (firewall, IDS, flow), host (EDR, OS audit), identity (authentication, directory), and application; correlation across categories raises confidence.

Syslog severity 0-7: 0 emergency through 7 debug; lower numbers are more severe, and most collectors filter below a configured threshold.

Detection rule anatomy: data source, condition/logic, threshold or time window, and response action; tuning reduces false positives without removing coverage.

MITRE ATT&CK maps adversary tactics (why) to techniques (how); detections are written against techniques such as T1059 command execution.

SIEM normalizes and correlates logs; SOAR automates playbook actions; neither replaces analyst validation of alerts.

NIDS placement matters: outside the firewall sees internet noise; inside the firewall sees what actually traversed the boundary policy.

Time synchronization (NTP) across sources is required for reliable correlation and timeline reconstruction; skew breaks event ordering.

Baselines of normal traffic and user behavior enable anomaly detection; deviations are leads, not proof, and require triage.

Key metrics: MTTD (detect) and MTTR (respond); alert fidelity is measured by true-positive rate and analyst disposition time.

NIST SP 800-61 phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.

Order of volatility: CPU registers and cache, memory, network state, running processes, disk, remote logs, archival media; collect most volatile first.

Containment options include network isolation, account disablement, credential reset, and blocking indicators; choose based on scope and business impact.

Evidence handling: maintain chain of custody, hash images (SHA-256), work from copies, and document every action with timestamps and collector identity.

Eradication removes root cause (malware, persistence, vulnerable service); recovery restores validated systems and monitors closely for reinfection.

Indicators of compromise (hashes, IPs, domains) are time-sensitive; tactics, techniques, and procedures endure longer and drive durable detection.

Post-incident review produces lessons learned, detection gaps, and control improvements fed back into preparation, closing the response loop.

Defense in depth in IR means layered detection: if endpoint telemetry fails, network flow and identity logs still surface the intrusion.

Tabletop exercises and playbooks reduce response time; playbooks define roles, communication paths, and decision authority before an incident.