ECSS cheat sheet

CIA triad: confidentiality protects disclosure, integrity protects modification, availability protects timely access; a control is classified by which property it primarily protects.

Defense in depth layers physical, network, host, application, and data controls; a single failed layer must not expose the asset, so overlapping controls are intentional.

Firewall rule evaluation is first-match top-down: place specific permit/deny rules above broad ones, and remember an implicit deny-all typically terminates the list.

Stateful inspection tracks the connection table (5-tuple plus state); stateless ACLs must permit return traffic explicitly, which is why ephemeral ports appear in both directions.

IDS detects and alerts passively (out-of-band SPAN/TAP); IPS sits inline and can drop. Signature-based detects known patterns, anomaly-based baselines normal behavior and flags deviation.

NAT/PAT rewrites source addresses and ports; private ranges are 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16 is link-local APIPA, not routable.

VPN: IPsec uses AH (integrity/authentication, no encryption) and ESP (encryption plus integrity); IKE negotiates SAs in two phases. TLS VPNs operate at the transport/session layer.

AAA separates authentication (who), authorization (what is allowed), and accounting (what happened); RADIUS is common for network access, TACACS+ encrypts the full payload and separates the three functions.

Risk = likelihood × impact. Residual risk remains after controls; risk treatment options are mitigate, transfer, avoid, and accept. Vulnerability scanning finds weaknesses; penetration testing validates exploitability.

Methodology order: reconnaissance (passive/active) → scanning and enumeration → vulnerability analysis → exploitation → post-exploitation → reporting. Authorization in scope must precede any active step.

Passive recon uses OSINT without touching targets (WHOIS, DNS records, certificate transparency, search engines); active recon sends traffic directly (DNS zone transfer attempts, banner grabbing).

TCP flag facts: SYN scan is half-open and stealthier; FIN/NULL/XMAS scans exploit RFC behavior on closed ports (RST) versus open ports (no response); connect scan completes the handshake and is logged.

Nmap states: open, closed (RST received), filtered (no response or ICMP unreachable), unfiltered. -sS needs raw-socket privilege; -sT does not.

Enumeration targets: SMB (shares, users, null sessions), SNMP (community strings, MIB walk), LDAP, DNS, NetBIOS, NTP - enumeration extracts identifiers, not just open ports.

Password attacks: brute force (exhaustive), dictionary (wordlist), rainbow table (precomputed hashes, defeated by salting), credential stuffing (reuse). Salting and key stretching (bcrypt, PBKDF2, Argon2) slow offline cracking.

Web attacks: SQL injection (input concatenation; test with quote errors and boolean/union logic), XSS (reflected/stored/DOM; output encoding plus CSP), CSRF (forged authenticated request; anti-CSRF tokens, SameSite cookies).

Privilege escalation: vertical (lower to higher privilege) versus horizontal (same level, different user). Common vectors are misconfigured SUID/sudo, unpatched kernels, weak service permissions, and exposed credentials.

Reporting must state scope, dates, methodology, findings with evidence and CVSS-style severity, business impact, and remediation; never include live credentials or data exfiltrated beyond proof.

Order of volatility (most to least): CPU registers/cache → RAM and swap → network state/connections → running processes → temporary files → disk → remote logs → archival backups.

Forensic soundness requires a write blocker, hash verification (MD5/SHA-256) of source versus image, chain of custody documentation, and working only on copies.

Disk acquisition types: physical (entire device, includes slack and unallocated), logical (partition or file-level), and sparse. A forensic image differs from a backup because it captures deleted and unallocated space.

File systems: NTFS uses $MFT (file records), $LogFile (journal), $UsnJrnl (change journal), and alternate data streams; FAT keeps directory entries and no journaling; ext3/4 use journaling.

Deleted-file recovery: NTFS clears the in-use flag in the $MFT record and frees clusters; data persists until overwritten. File carving recovers content by header/footer signatures independent of file system metadata.

Timestamps: MACB (modified, accessed, changed/MFT entry, born/created). Time-zone normalization and clock skew must be documented; timestomping is a defense-evasion indicator.

Windows artifacts: event logs (Security 4624 logon, 4625 failure, 4688 process creation), registry hives (SAM, SYSTEM, SOFTWARE, NTUSER.DAT), prefetch, Amcache, ShimCache, LNK files, $Recycle.Bin.

Memory forensics captures volatile evidence: process lists, network connections, loaded DLLs, injected code, encryption keys. Pull the plug only when RAM must be preserved; otherwise graceful shutdown preserves disk state.

Anti-forensics: wiping, encryption, steganography, log tampering, and data hiding. Investigators counter with artifact correlation, entropy analysis, and timeline reconstruction across multiple sources.