CSA (EC-Council Certifications) cheat sheet

Mean time to detect (MTTD) = total detection time / number of incidents; mean time to respond (MTTR) = total response time / incidents resolved.

Separation of duties requires that no single person can both authorize and execute a sensitive transaction.

Least privilege: grant the minimum access needed for a task, and review entitlements on a defined cycle.

RTO is the maximum acceptable downtime; RPO is the maximum acceptable data loss measured in time.

Change management gates: request, risk assessment, approval, test, scheduled implementation, post-implementation review.

A SOC tier model: Tier 1 triage, Tier 2 investigation, Tier 3 threat hunting and advanced response.

Key performance indicators for a SOC include alert volume, false positive rate, escalation rate, and dwell time.

Business impact analysis ranks systems by criticality and feeds RTO/RPO values into continuity planning.

Cyber Kill Chain order: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives.

MITRE ATT&CK tactics describe the adversary's goal (why); techniques describe how the goal is achieved.

Indicator types: atomic (IP, hash, domain), computed (regex, byte sequences), and behavioral (TTPs).

IoC confidence decays over time; atomic indicators like IPs have shorter useful lifetimes than TTPs.

Phishing variants: spear phishing is targeted, whaling targets executives, vishing uses voice, smishing uses SMS.

Living-off-the-land attacks abuse legitimate binaries (PowerShell, WMI, certutil) to avoid malware signatures.

Ransomware progression: initial access, lateral movement, data exfiltration, encryption, extortion demand.

Supply chain compromise places malicious code in trusted software or updates delivered to many victims.

SIEM pipeline: collection, normalization/parsing, correlation, alerting, retention, and review.

Correlation rules match multiple events across sources within a time window to raise a single alert.

A tuning cycle reduces false positives by adjusting thresholds, adding exclusions, and validating logic.

Use case categories: authentication anomalies, privilege escalation, data exfiltration, malware beaconing, policy violations.

Alert triage order: severity, asset criticality, threat intelligence match, then recency.

Baseline deviation detects anomalies by comparing current activity against a learned normal profile.

Log source health monitoring is required; a silent feed produces false negatives, not just missing data.

Watchlist and threat-intel enrichment raises or lowers alert priority based on known-bad indicators.

Log levels: debug, info, warning, error, critical; production retention usually excludes debug.

Centralized logging protects integrity by shipping logs off-host to a write-once or restricted store.

NTP synchronization is required so correlated events share a trustworthy timeline.

Retention periods are driven by legal, regulatory, and investigative needs; confirm before purging.

Log integrity controls: hashing, append-only storage, access controls, and chain-of-custody records.

Common sources: OS event logs, firewall, proxy, DNS, IDS/IPS, authentication servers, application logs.

Log rotation prevents disk exhaustion; rotation must preserve the retention window.

Time skew between sources breaks correlation; verify offsets during ingestion troubleshooting.

Defense in depth layers controls: perimeter, network segmentation, host hardening, application, and data.

Endpoint detection and response (EDR) records process, file, network, and registry telemetry for hunting and response.

Network segmentation limits lateral movement; deny-by-default between zones is the strictest posture.

Host firewall rules should default-deny inbound and allow only required services.

Application allowlisting blocks execution of unapproved binaries, defeating many droppers.

Patch management prioritizes by exploitability and exposure, not only by CVSS score.

Full-disk encryption protects data at rest if a device is lost or stolen.

Egress filtering blocks command-and-control callbacks by restricting outbound destinations.

NIST IR lifecycle: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.

Order of volatility (RFC 3227): CPU/cache, memory, network state, running processes, disk, backups, archival media.

Capture volatile data before powering down; powering off destroys memory-resident evidence.

Chain of custody documents who handled evidence, when, and where, from seizure to presentation.

Forensic imaging uses write blockers and hash verification (e.g., SHA-256) to prove integrity.

Containment options: isolate host from network, disable account, block indicator, segment the subnet.

Timeline analysis correlates file system, log, and memory artifacts to reconstruct attacker actions.

Lessons-learned review produces corrective actions and updates detection content after closure.

TCP three-way handshake: SYN, SYN-ACK, ACK; a half-open SYN flood leaves many connections incomplete.

Port scan signatures: SYN scan (stealth), full connect scan, and FIN/XMAS/NULL scans for firewall evasion.

PCAP analysis workflow: capture, filter by host/protocol, follow stream, extract indicators.

Common ports: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 445 SMB, 3389 RDP.

DNS tunneling shows long, high-entropy subdomains and unusually high query volume to one domain.

Beaconing detection looks for periodic connections at regular intervals to the same destination.

IDS signatures detect known patterns; anomaly detection flags deviations from baseline traffic.

Encrypted traffic analysis uses JA3/JA3S fingerprints, certificate metadata, and flow timing rather than payload.

Incident severity tiers drive notification scope, escalation path, and reporting deadlines.

Stakeholder matrix maps each audience (executive, legal, technical, customer) to the information they need.

Regulatory notification clocks (e.g., breach disclosure laws) start at confirmed awareness, not at attack start.

Status updates should state impact, actions taken, current status, and next update time.

Avoid sharing unverified attribution or speculation in external communications.

Post-incident report contents: summary, timeline, root cause, impact, evidence, and corrective actions.

Escalation criteria must be defined in advance so responders know when to involve management or legal.

Communication channels should be out-of-band in case the primary email or network is compromised.