EXIN Cyber Security Foundation cheat sheet

Confidentiality, Integrity and Availability (the CIA triad) are the three core information security objectives; non-repudiation and authenticity are often added as supporting properties.

Confidentiality protects against unauthorised disclosure, integrity against unauthorised or accidental modification, and availability against loss of timely access to information and systems.

Vulnerability is a weakness in a system or control; threat is a potential cause of harm that could exploit it; risk is the combination of the likelihood of that exploitation and its impact.

Risk = likelihood x impact; a risk is only realised when a threat, a vulnerability and an exposure path coexist.

Information security concerns data and information assets; IT security focuses on the technology that stores and processes them; cyber security extends to people, processes and the interconnected environment.

Asset classification (for example public, internal, confidential, secret) determines the baseline of controls applied to that asset.

Defence in depth layers preventive, detective, corrective and compensating controls so that no single control failure results in full compromise.

The security lifecycle is continuous: identify assets, assess risk, select and implement controls, monitor, and improve (Plan-Do-Check-Act).

Least privilege, need-to-know and separation of duties are foundational principles that limit the blast radius of any single compromised account or action.

Malware categories: virus (needs a host and user action), worm (self-propagating over networks), trojan (disguised as legitimate), ransomware (encrypts or exfiltrates and demands payment), spyware (covert collection).

Social engineering exploits human trust rather than technical flaws; phishing, spear phishing, vishing (voice), smishing (SMS) and pretexting are its main forms.

Phishing is bulk and generic; spear phishing is targeted at a named individual or role; whaling targets senior executives.

Denial of service (DoS) exhausts a resource from one source; distributed DoS (DDoS) uses many compromised hosts (a botnet) and is harder to block by source address.

Man-in-the-middle attacks intercept or alter traffic between two parties; protection relies on strong encryption and certificate validation, not on the network being trusted.

SQL injection inserts malicious SQL through unsanitised input; cross-site scripting (XSS) injects client-side script into pages viewed by other users. Input validation and output encoding are the corresponding defences.

Ransomware defence rests on tested offline or immutable backups, patching, segmentation and rapid detection; paying the ransom does not guarantee recovery.

Advanced persistent threat (APT) is a prolonged, stealthy, well-resourced campaign that establishes persistence and exfiltrates data over time rather than causing immediate disruption.

Insider threats may be malicious or accidental; they are detected through logging, behaviour analytics, access review and segregation of duties rather than perimeter controls.

Control types: preventive (stops an event), detective (identifies it), corrective (restores after it), compensating (substitutes when the primary control is not feasible).

Control categories: technical (logical), physical and administrative (organisational). A single measure may belong to more than one category.

Authentication factors are knowledge (something you know), possession (something you have) and inherence (something you are); multi-factor authentication requires factors from at least two different categories.

Symmetric encryption uses one shared key and is fast (for example AES); asymmetric encryption uses a public/private key pair and solves key distribution (for example RSA).

Hashing is one-way and provides integrity, not confidentiality; a digital signature combines a hash with the sender's private key to give integrity, authenticity and non-repudiation.

TLS protects data in transit, full-disk or database encryption protects data at rest; both are needed because the threats differ.

Firewalls filter by rules and state; an intrusion detection system (IDS) alerts, an intrusion prevention system (IPS) can block inline; a DMZ separates internet-facing services from the internal network.

Patch management and vulnerability management are distinct: vulnerability management discovers and prioritises weaknesses, patch management remediates them within a defined window.

Business continuity (BCP) keeps critical processes running during disruption; disaster recovery (DRP) restores IT infrastructure afterwards. RTO is the maximum tolerable downtime and RPO the maximum tolerable data loss.

Governance sets direction and accountability: the board owns risk appetite, management owns implementation, and the security function advises and monitors.

ISO/IEC 27001 specifies requirements for an information security management system (ISMS) and is certifiable; ISO/IEC 27002 provides implementation guidance and is not certifiable.

The ISMS cycle is Plan-Do-Check-Act: establish the system, operate it, monitor and review it, then maintain and improve it.

A security policy is the top-level management statement of intent; standards, procedures and guidelines sit beneath it and must not contradict it.

Accountability for risk cannot be delegated to a supplier; outsourcing transfers activity, not responsibility.

GDPR requires lawful basis, data minimisation, breach notification within 72 hours where required, and privacy by design; the NIS2 directive extends cyber risk obligations to essential and important entities.

Security awareness programmes change behaviour; effectiveness is measured by phishing simulation click rates, reporting rates and assessment results, not by training completion alone.

Incident response follows preparation, detection and analysis, containment, eradication, recovery, and lessons learned; the lessons-learned phase is what prevents recurrence.

Key performance indicators measure activity (for example patches applied), while key risk indicators measure exposure (for example percentage of unpatched critical systems); governance relies on both.