CNCDP cheat sheet
CNCDP · Keep the key ideas within reach.
Network Security Architecture and Design
Defense in depth layers controls so no single failure grants full compromise: perimeter, segmentation, endpoint, identity, data, monitoring.
DMZ (screened subnet) hosts internet-facing services; internal hosts must not initiate inbound connections into it except via defined management paths.
Network segmentation reduces blast radius: VLANs, subnets, and microsegmentation enforce east-west policy separate from north-south perimeter policy.
Zero Trust principles: verify explicitly, use least privilege, assume breach; identity and device posture drive access, not network location.
Purdue model levels 0-5 separate OT process control from enterprise IT; conduits between levels pass through firewalls with protocol-aware inspection.
Stateful firewalls track connection state; stateless ACLs must permit return traffic explicitly and are order-dependent (first match wins).
High availability: active-passive failover preserves state via session sync; active-active requires asymmetric routing controls and consistent policy.
Fail-closed vs fail-open: security gateways should fail closed for confidentiality-critical paths and fail open only where safety-of-life demands availability.
Threat Landscape and Threat Intelligence
Intelligence levels: strategic (leadership, risk), operational (campaigns, actors), tactical (TTPs), technical (IOCs such as hashes, IPs, domains).
Pyramid of Pain: hash/IP/domain IOCs are easy for adversaries to change; TTPs are hardest to change and most valuable to detect.
Diamond Model nodes: adversary, capability, infrastructure, victim; every event links these, and pivoting on any node expands analysis.
MITRE ATT&CK organizes adversary behavior into tactics (why) and techniques (how); used for detection coverage mapping, not for IOC storage.
Cyber Kill Chain phases: reconnaissance, weaponization, delivery, exploitation, installation, C2, actions on objectives - each offers break points.
IOC confidence decays; TTL and aging must be applied or detection generates false positives after infrastructure rotation.
Threat actors: nation-state (persistent, resourced), organized crime (financial), hacktivist (ideological), insider (authorized access).
STIX/TAXII: STIX is the structured language for indicators and relationships; TAXII is the transport protocol for sharing collections.
Vulnerability Assessment and Management
CVSS base score reflects intrinsic severity; temporal and environmental metrics adjust for exploit maturity and local exposure.
CVSS v3.1 qualitative bands: 0.0 none, 0.1-3.9 low, 4.0-6.9 medium, 7.0-8.9 high, 9.0-10.0 critical.
Risk-based prioritization combines severity, exploitability (KEV, EPSS), asset criticality, and compensating controls - not CVSS alone.
CISA KEV lists vulnerabilities with confirmed in-the-wild exploitation; membership justifies accelerated remediation timelines.
EPSS estimates probability of exploitation in the next 30 days; high EPSS plus high CVSS is the strongest patch-first signal.
Authenticated (credentialed) scans find far more local issues than unauthenticated scans; unauthenticated results approximate attacker view.
False positive triage requires evidence: version banner alone is weak; confirm via authenticated check, backported patch status, or manual validation.
Remediation SLA tiers typically: critical internet-facing in days, high in weeks, medium/low in a quarter; exceptions require documented risk acceptance.
Security Monitoring, Detection, and Analysis
Detection triad: log sources (endpoint, network, identity, cloud), correlation rules, and analyst triage; missing a source creates blind spots.
Sigma is a vendor-neutral detection rule format; rules are converted to SIEM query languages, enabling portable logic.
False positive = alert fired on benign activity; false negative = malicious activity not alerted. Tuning trades one against the other.
Alert fidelity metrics: true positive rate, false positive rate, mean time to detect (MTTD), and detection coverage by ATT&CK technique.
Log retention and time synchronization (NTP) are prerequisites; unsynced clocks break correlation and forensic timelines.
Behavioral analytics baseline normal and flag deviation; they complement signature rules but require tuning windows to avoid noise.
Triage order: validate alert, scope affected assets, determine active vs historical, escalate or close with documented rationale.
Detection-in-depth maps each ATT&CK technique to at least one telemetry source and rule; gaps are documented as coverage debt.
Incident Response and Handling
NIST SP 800-61 lifecycle: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.
Containment options: isolate host, disable account, block indicator, segment network - choose based on spread risk vs business impact.
Order of volatility: memory and network state first, then disk, then backups and logs; collection precedes remediation when evidence matters.
Evidence handling: maintain chain of custody, hash at collection, store in tamper-evident location, document every transfer.
Communication: defined escalation matrix, single incident commander, and legal/privacy notification triggers based on data type and jurisdiction.
Eradication must remove root cause (persistence, credentials, implants), not just symptoms; recovery requires validation before reconnecting.
Post-incident review produces lessons learned, detection improvements, and control changes; track actions to closure.
Tabletop exercises and playbooks reduce response time; playbooks should specify decision authority and evidence retention steps.
Digital Forensics and Evidence Handling
Forensic soundness: preserve original, work on a verified copy, hash before and after (SHA-256) to prove integrity.
Order of volatility (RFC 3227): CPU/cache, memory, network state, running processes, disk, remote logs, archival media.
Write blockers prevent modification of source media during acquisition; imaging validates with a hash comparison.
Chain of custody records who handled evidence, when, where, and why; any gap weakens admissibility.
Windows artifacts: event logs, registry hives, MFT, USN journal, prefetch, shimcache, AmCache, LNK files, Volume Shadow Copies.
Linux artifacts: auth.log, syslog, bash history, cron, /proc, journald, and file timestamps (atime, mtime, ctime).
Timeline analysis correlates file system, log, and memory timestamps; normalize to UTC and note timezone sources.
Memory forensics reveals running processes, network connections, injected code, and credentials not present on disk.
Cyber Defense Operations and Threat Hunting
Hypothesis-driven hunting starts from an ATT&CK technique or intelligence lead, not from an alert queue.
Hunt loop: form hypothesis, identify required data, query, analyze, document findings, convert successful hunts into detections.
Pivot points: process parent-child relationships, rare command lines, unusual authentication patterns, and beaconing periodicity.
Living-off-the-land binaries (LOLBins) such as PowerShell, certutil, and rundll32 evade signature detection; hunt behavior, not file names.
Beaconing detection: regular interval connections, jitter analysis, consistent payload size, and rare destination reputation.
Purple teaming validates detection by executing controlled adversary techniques and measuring whether alerts fire.
Hunt documentation must record data sources queried, time range, queries used, and negative results to avoid duplicate effort.
Threat hunting differs from monitoring: hunting is proactive and hypothesis-driven; monitoring is reactive to defined alerts.
Governance, Risk, and Compliance
Risk = likelihood × impact; treatment options are mitigate, transfer, avoid, or accept, and acceptance must be documented by an accountable owner.
Frameworks: NIST CSF (identify, protect, detect, respond, recover, govern), ISO 27001 (ISMS), CIS Controls (prioritized safeguards).
Control types: preventive, detective, corrective; categories: technical, administrative, physical. Map controls to framework requirements.
Compliance is not security: meeting a standard is a baseline; residual risk must still be assessed against the threat landscape.
Policy hierarchy: policy (intent) → standard (mandatory requirement) → procedure (steps) → guideline (recommendation).
Third-party risk: vendor assessments, contractual security requirements, and continuous monitoring of supplier exposure.
Audit evidence must be current, attributable, and reproducible; control owners are accountable for evidence accuracy.
Metrics for governance: control coverage, open risk register items, remediation SLA adherence, and incident trend reporting.