ICDL Cyber Security (ICDL) cheat sheet

The CIA triad defines three core goals: Confidentiality (only authorised parties can read data), Integrity (data is accurate and unaltered), and Availability (data and services are reachable when needed).

Authentication proves an identity; authorisation decides what that proven identity is allowed to do. Authentication always precedes authorisation.

Non-repudiation means a party cannot credibly deny having sent a message or performed an action, usually achieved with digital signatures.

Multi-factor authentication combines factors from different categories: something you know (password), something you have (token), something you are (biometric). Two items from the same category do not count as MFA.

Least privilege: a user or process receives only the minimum access rights required for its task, reducing the blast radius of a compromise.

Defence in depth layers independent controls (network, host, application, data) so that failure of one layer does not expose the whole system.

A vulnerability is a weakness; a threat is a potential cause of harm; risk is the combination of likelihood and impact of a threat exploiting a vulnerability.

A zero-day is a vulnerability unknown to the vendor, so no patch exists at the time of exploitation.

Phishing is a bulk deceptive message; spear phishing is targeted at a specific person using researched details; whaling targets senior executives.

Social engineering exploits human trust rather than technical flaws; the attacker's goal is usually credentials, payments, or access.

Malware categories: virus (attaches to files and needs a host), worm (self-replicates across networks without a host), trojan (disguised as legitimate software), ransomware (encrypts data and demands payment).

Ransomware defence rests on offline or immutable backups; paying the ransom does not guarantee data recovery.

A man-in-the-middle attack intercepts traffic between two parties; HTTPS with valid certificates and avoiding untrusted Wi-Fi mitigate it.

Denial-of-service floods a service with traffic to exhaust resources; a distributed denial-of-service (DDoS) uses many compromised hosts (a botnet).

Keyloggers record keystrokes to capture credentials; on-screen keyboards and MFA reduce their effectiveness.

Risk treatment options are: avoid, reduce (mitigate), transfer (e.g. insurance), and accept. Residual risk remains after treatment.

Encryption at rest protects stored data; encryption in transit (TLS/HTTPS) protects data moving across networks. Both are needed for full coverage.

A strong password is long rather than merely complex; length and uniqueness across sites matter more than forced character mixing.

A password manager stores credentials in an encrypted vault unlocked by one strong master password, enabling unique passwords per site.

Full-disk encryption protects data if a device is lost or stolen, because the drive is unreadable without the key or passphrase.

Backups follow the 3-2-1 rule: at least 3 copies, on 2 different media, with 1 copy stored off-site (or offline).

Patching closes known vulnerabilities; automatic updates reduce the window of exposure between disclosure and fix.

A firewall filters network traffic by rules; a host firewall protects a single device, a network firewall protects a whole segment.

Antimalware relies on signature detection for known threats and heuristic or behavioural detection for unknown ones; signatures must be kept current.

Check the URL and the domain name before entering credentials; a lookalike domain (e.g. typosquatting) is a common phishing indicator.

HTTPS and the padlock indicate an encrypted connection, not that the site is trustworthy or legitimate.

Public Wi-Fi is untrusted; use a VPN or mobile hotspot for sensitive activity, and disable automatic network joining.

Oversharing on social media enables social engineering and identity theft; personal details such as birth date, address, and travel plans are high-risk.

Digital footprint is the trail of data left by online activity; it is persistent and can be copied, so deletion is never guaranteed.

Software should be downloaded only from official vendor or app-store sources; sideloaded apps bypass store security review.

Unexpected attachments or links, even from known contacts, should be verified through a separate channel before opening.

Responsible behaviour includes respecting copyright and licence terms, and not sharing others' personal data without consent.

Confidentiality, Integrity, and Availability form the CIA triad, the three standard goals of information security.

Authentication verifies identity; authorisation grants permissions after identity is proven.

Multi-factor authentication requires factors from at least two different categories: knowledge, possession, inherence.

Least privilege limits each account to the minimum rights needed for its function.

Non-repudiation prevents denial of an action, typically via digital signatures.

Risk equals the combination of the likelihood of a threat event and its impact.

Defence in depth stacks independent controls so one failure does not expose the system.

Spear phishing targets a specific individual; whaling targets senior executives; bulk phishing is untargeted.

Worms self-replicate without a host file; viruses require a host; trojans disguise themselves as legitimate software.

Ransomware encrypts data and demands payment; offline backups are the reliable recovery path.

Social engineering manipulates people into revealing information or performing actions.

DDoS attacks use many compromised devices (a botnet) to exhaust a service.

Risk treatments are avoid, reduce, transfer, and accept; residual risk remains after treatment.

Keyloggers capture keystrokes; MFA reduces the value of stolen credentials.

Encryption in transit uses TLS/HTTPS; encryption at rest protects stored files and disks.

Longer passwords are stronger than short complex ones; uniqueness per site prevents credential-stuffing spread.

The 3-2-1 backup rule: three copies, two media types, one off-site.

Full-disk encryption makes a lost device's storage unreadable without the key.

Patching removes known vulnerabilities; automatic updates shorten exposure windows.

Firewalls filter traffic by rule; host firewalls protect one device, network firewalls protect a segment.

Antimalware uses signatures for known malware and behaviour heuristics for unknown samples.

The padlock and HTTPS mean the connection is encrypted, not that the site is honest.

Lookalike and typosquatted domains are a standard phishing indicator; verify the exact domain.

Public Wi-Fi is untrusted; use a VPN or hotspot and disable auto-join.

Digital footprints persist and can be copied, so deletion is never guaranteed.

Install software only from official vendor or app-store sources.

Verify unexpected links or attachments through a separate channel before acting.

Respect copyright and licence terms, and do not share others' personal data without consent.

Availability ensures data and services are accessible to authorised users when required.

Integrity ensures data is accurate and has not been altered in transit or storage.

A vulnerability is a weakness; a threat is a potential cause of harm; risk combines likelihood and impact.

A zero-day vulnerability is unknown to the vendor, so no patch exists when it is exploited.

Possession factors include hardware tokens and authenticator apps; knowledge factors include passwords and PINs.

Biometric factors (fingerprint, face) are inherence factors and cannot be easily reset if compromised.

Separation of duties splits critical tasks between people to prevent fraud and error.

A trojan appears legitimate but carries hidden malicious function; it does not self-replicate.

Man-in-the-middle attacks intercept traffic between two parties; valid TLS certificates mitigate them.

Phishing often creates urgency or fear to bypass careful thinking.

A botnet is a network of compromised devices controlled remotely, often used for DDoS.

Social engineering targets human trust, so technical controls alone cannot fully prevent it.

Risk acceptance is a valid choice when the cost of treatment exceeds the potential loss.

Ransomware payment does not guarantee recovery; decryption keys may fail or data may be leaked.

A password manager enables unique, long passwords per site without memorising each one.

Backups must be tested by restoring; an untested backup is not a reliable control.

Automatic updates reduce the time a known vulnerability remains exploitable.

Antivirus signatures must be updated; outdated signatures miss new malware.

A VPN encrypts traffic between the device and the VPN endpoint, protecting data on untrusted networks.

Device screen locks and auto-lock timeouts reduce exposure from unattended devices.

Removable media should be scanned before use and encrypted if it holds sensitive data.

Check the domain name, not just the page design, before entering credentials.

Unexpected urgency in a message is a phishing indicator, not proof of legitimacy.

Avoid posting travel plans or home address publicly; this aids burglary and identity theft.

Only install apps from official stores; sideloaded apps skip security review.

Verify unusual requests from known contacts via a separate channel such as a phone call.

Copyright and licence terms apply to downloaded content; unauthorised sharing is a legal and ethical breach.

Report suspected phishing to the relevant provider rather than forwarding it to others.