ATSA cheat sheet
ATSA · Keep the key ideas within reach.
General Security Concepts
CIA triad: Confidentiality (encryption, access control), Integrity (hashing, signatures, MAC), Availability (redundancy, DDoS protection, backups).
Non-repudiation requires asymmetric cryptography: a sender signs with their private key and any verifier checks with the public key.
AAA model: Authentication proves identity, Authorization grants rights, Accounting logs activity for audit.
Least privilege, separation of duties, and defense in depth are control-design principles, not individual controls.
Control types: preventive (blocks), detective (identifies), corrective (restores), deterrent (discourages), compensating (substitute), directive (policy).
Zero Trust removes implicit trust from the network perimeter; every request is authenticated and authorized based on identity, device posture, and context.
Hashing (SHA-256, SHA-3) is one-way and detects modification; it does not provide confidentiality and is not encryption.
Symmetric encryption (AES) is fast and used for bulk data; asymmetric (RSA, ECC) is slower and used for key exchange and signatures.
Security through obscurity alone is not a control; hiding a service name or port reduces exposure but does not replace authentication or patching.
Network Security
OSI layers and controls: L2 MAC filtering/VLANs, L3 ACLs and routing, L4 stateful firewalls and port filtering, L7 WAF/proxy inspection.
TCP three-way handshake is SYN, SYN-ACK, ACK; a SYN flood exhausts the half-open connection table and is mitigated with SYN cookies or rate limiting.
Stateful firewalls track connection state; stateless ACLs must permit return traffic explicitly.
NAT/PAT translates private addresses to a public address and port; it is not a security control by itself.
TLS 1.2/1.3 provides confidentiality, integrity, and server authentication; certificate validation checks chain, hostname, expiry, and revocation.
IPsec modes: transport encrypts payload only; tunnel encrypts the whole packet and is used for site-to-site VPNs.
VLAN hopping via double tagging or switch spoofing is mitigated by disabling unused ports, using a dedicated native VLAN, and enabling DTP/trunk hardening.
IDS detects and alerts (passive); IPS detects and blocks inline (active); both may be signature- or anomaly-based.
Segmentation (DMZ, microsegmentation) limits lateral movement; a DMZ hosts internet-facing services isolated from the internal network.
Security Operations and Monitoring
Log source categories: network (firewall, IDS/IPS, NetFlow), host (EDR, Sysmon, OS audit), application, identity (AD, IdP), and cloud (CloudTrail, activity logs).
NIST SP 800-92 log management lifecycle: generation, transmission, storage, analysis, disposal; retain per legal and investigative needs.
Syslog severity 0 (emergency) through 7 (debug); lower number equals higher severity.
SIEM correlates and normalizes logs, applies correlation rules, and supports alerting; SOAR automates response playbooks.
Time synchronization (NTP) is required for correlation; unsynchronized clocks break timeline reconstruction.
Detection tuning metrics: false positive rate, false negative rate, mean time to detect (MTTD), mean time to respond (MTTR).
Honeypots/honeynets are deception controls that provide low-noise detection and threat intelligence, not primary prevention.
Baseline deviation and anomaly detection are effective for unknown threats but produce higher false positives than deterministic signatures.
Vulnerability Management
CVSS v3.1 base score components: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity, Availability.
CVSS severity bands: 0.0 None, 0.1-3.9 Low, 4.0-6.9 Medium, 7.0-8.9 High, 9.0-10.0 Critical.
Prioritization combines CVSS with exploitability (EPSS), known exploitation (CISA KEV), asset criticality, and exposure.
Vulnerability scanning is authenticated (credentialed) or unauthenticated; credentialed scans find far more host-level issues.
A false positive is a reported vulnerability that does not exist; a false negative is a missed real vulnerability.
CVE identifies a specific vulnerability; CWE classifies weakness types; NVD enriches CVEs with CVSS and CPE data.
Patch management cycle: inventory, assess, test, deploy, verify, and document exceptions with compensating controls.
A vulnerability is a weakness; a threat is an actor or event that could exploit it; risk is the combination of likelihood and impact.
Scan results must be validated before remediation to avoid chasing false positives and to confirm exploit conditions.
Incident Response and Threat Hunting
NIST IR lifecycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.
Incident response plan elements: roles, communication paths, escalation criteria, evidence handling, and legal/regulatory notification triggers.
Order of volatility: CPU registers/cache, RAM, swap, network connections, running processes, disk, backups, archived media.
Evidence handling requires chain of custody, hashing at acquisition, write blockers, and documented handoffs.
Containment options: isolate host from network, disable account, block IOC at perimeter, revoke tokens; choose based on blast radius.
Threat hunting hypothesis-driven approach: form hypothesis from TTPs (MITRE ATT&CK), query telemetry, validate, then convert findings into detections.
MITRE ATT&CK tactics describe adversary goals (e.g., Initial Access, Persistence, Lateral Movement); techniques describe how.
Indicators of compromise (hashes, IPs, domains) are low-fidelity and short-lived; TTPs are higher-fidelity and more durable.
Post-incident review produces lessons learned, root cause, and detection/control improvements; it is not a blame exercise.
Security Architecture and Engineering
Secure design principles: least privilege, fail-safe defaults, complete mediation, open design, separation of privilege, least common mechanism.
Threat modeling frameworks: STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) and PASTA.
Trust boundaries are drawn where data crosses between components with different privilege or ownership; threats concentrate there.
Defense in depth layers controls so a single failure does not compromise the asset.
Cryptographic key management: generation, distribution, storage, rotation, revocation, destruction; key compromise defeats the algorithm.
HSM/TPM provide hardware-protected key storage; TPM supports measured boot and platform integrity attestation.
Cloud shared responsibility: provider secures the cloud (physical, hypervisor); customer secures what is in the cloud (data, identity, config).
Secure boot verifies bootloader/kernel signatures; measured boot records hashes to a TPM for later attestation.
Fail-open vs fail-closed: fail-closed denies access on failure (safer for security); fail-open preserves availability but may expose the asset.
Identity and Access Management
Authentication factors: something you know, something you have, something you are; MFA requires two or more different factor types.
Access control models: DAC (owner discretion), MAC (labels/clearances), RBAC (roles), ABAC (attributes/policy), RuBAC (rules).
SAML is XML-based SSO for web; OAuth 2.0 is delegated authorization, not authentication; OIDC adds an identity layer on OAuth 2.0.
Password storage requires a salted, slow hash (bcrypt, scrypt, Argon2, PBKDF2); plain SHA-256 is unsuitable for passwords.
Kerberos uses a KDC, TGT, and service tickets; it provides mutual authentication and is time-sensitive (default clock skew 5 minutes).
Privileged access management: just-in-time elevation, session recording, vaulting of credentials, and removal of standing admin rights.
Federation establishes trust between identity providers and service providers, enabling cross-domain SSO without shared passwords.
Account lifecycle: provisioning, periodic access review/recertification, role change, and timely deprovisioning on termination.
Directory services (LDAP, Active Directory) centralize identity; LDAP is a protocol, AD is a directory service implementation.
Risk Management and Compliance
Risk = likelihood x impact; qualitative (high/medium/low), quantitative (SLE, ARO, ALE), and semi-quantitative methods.
SLE = asset value x exposure factor; ALE = SLE x annualized rate of occurrence (ARO).
Risk responses: mitigate, transfer (insurance), avoid, accept; residual risk is what remains after treatment.
Risk register records asset, threat, vulnerability, likelihood, impact, owner, treatment, and status.
Qualitative vs quantitative: qualitative is faster and subjective; quantitative is numeric and requires reliable data.
Business impact analysis (BIA) identifies critical processes and derives RTO and RPO; MTD is the maximum tolerable downtime.
RTO is the target restore time; RPO is the maximum acceptable data loss measured in time.
Frameworks: NIST CSF (Identify, Protect, Detect, Respond, Recover, Govern), ISO 27001 (ISMS), SOC 2 (trust services criteria).
Compliance is adherence to requirements; it does not guarantee security, and a control gap is not automatically a breach.
General Security Concepts
CIA triad: Confidentiality (encryption, access control), Integrity (hashing, signatures, MAC), Availability (redundancy, DDoS protection, backups).
Non-repudiation requires asymmetric cryptography: a sender signs with their private key and any verifier checks with the public key.
AAA model: Authentication proves identity, Authorization grants rights, Accounting logs activity for audit.
Least privilege, separation of duties, and defense in depth are control-design principles, not individual controls.
Control types: preventive (blocks), detective (identifies), corrective (restores), deterrent (discourages), compensating (substitute), directive (policy).
Zero Trust removes implicit trust from the network perimeter; every request is authenticated and authorized based on identity, device posture, and context.
Hashing (SHA-256, SHA-3) is one-way and detects modification; it does not provide confidentiality and is not encryption.
Symmetric encryption (AES) is fast and used for bulk data; asymmetric (RSA, ECC) is slower and used for key exchange and signatures.
Security through obscurity alone is not a control; hiding a service name or port reduces exposure but does not replace authentication or patching.
Network Security
OSI layers and controls: L2 MAC filtering/VLANs, L3 ACLs and routing, L4 stateful firewalls and port filtering, L7 WAF/proxy inspection.
TCP three-way handshake is SYN, SYN-ACK, ACK; a SYN flood exhausts the half-open connection table and is mitigated with SYN cookies or rate limiting.
Stateful firewalls track connection state; stateless ACLs must permit return traffic explicitly.
NAT/PAT translates private addresses to a public address and port; it is not a security control by itself.
TLS 1.2/1.3 provides confidentiality, integrity, and server authentication; certificate validation checks chain, hostname, expiry, and revocation.
IPsec modes: transport encrypts payload only; tunnel encrypts the whole packet and is used for site-to-site VPNs.
VLAN hopping via double tagging or switch spoofing is mitigated by disabling unused ports, using a dedicated native VLAN, and enabling DTP/trunk hardening.
IDS detects and alerts (passive); IPS detects and blocks inline (active); both may be signature- or anomaly-based.
Segmentation (DMZ, microsegmentation) limits lateral movement; a DMZ hosts internet-facing services isolated from the internal network.
Security Operations and Monitoring
Log source categories: network (firewall, IDS/IPS, NetFlow), host (EDR, Sysmon, OS audit), application, identity (AD, IdP), and cloud (CloudTrail, activity logs).
NIST SP 800-92 log management lifecycle: generation, transmission, storage, analysis, disposal; retain per legal and investigative needs.
Syslog severity 0 (emergency) through 7 (debug); lower number equals higher severity.
SIEM correlates and normalizes logs, applies correlation rules, and supports alerting; SOAR automates response playbooks.
Time synchronization (NTP) is required for correlation; unsynchronized clocks break timeline reconstruction.
Detection tuning metrics: false positive rate, false negative rate, mean time to detect (MTTD), mean time to respond (MTTR).
Honeypots/honeynets are deception controls that provide low-noise detection and threat intelligence, not primary prevention.
Baseline deviation and anomaly detection are effective for unknown threats but produce higher false positives than deterministic signatures.
Vulnerability Management
CVSS v3.1 base score components: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity, Availability.
CVSS severity bands: 0.0 None, 0.1-3.9 Low, 4.0-6.9 Medium, 7.0-8.9 High, 9.0-10.0 Critical.
Prioritization combines CVSS with exploitability (EPSS), known exploitation (CISA KEV), asset criticality, and exposure.
Vulnerability scanning is authenticated (credentialed) or unauthenticated; credentialed scans find far more host-level issues.
A false positive is a reported vulnerability that does not exist; a false negative is a missed real vulnerability.
CVE identifies a specific vulnerability; CWE classifies weakness types; NVD enriches CVEs with CVSS and CPE data.
Patch management cycle: inventory, assess, test, deploy, verify, and document exceptions with compensating controls.
A vulnerability is a weakness; a threat is an actor or event that could exploit it; risk is the combination of likelihood and impact.
Scan results must be validated before remediation to avoid chasing false positives and to confirm exploit conditions.
Incident Response and Threat Hunting
NIST IR lifecycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.
Incident response plan elements: roles, communication paths, escalation criteria, evidence handling, and legal/regulatory notification triggers.
Order of volatility: CPU registers/cache, RAM, swap, network connections, running processes, disk, backups, archived media.
Evidence handling requires chain of custody, hashing at acquisition, write blockers, and documented handoffs.
Containment options: isolate host from network, disable account, block IOC at perimeter, revoke tokens; choose based on blast radius.
Threat hunting hypothesis-driven approach: form hypothesis from TTPs (MITRE ATT&CK), query telemetry, validate, then convert findings into detections.
MITRE ATT&CK tactics describe adversary goals (e.g., Initial Access, Persistence, Lateral Movement); techniques describe how.
Indicators of compromise (hashes, IPs, domains) are low-fidelity and short-lived; TTPs are higher-fidelity and more durable.
Post-incident review produces lessons learned, root cause, and detection/control improvements; it is not a blame exercise.
Security Architecture and Engineering
Secure design principles: least privilege, fail-safe defaults, complete mediation, open design, separation of privilege, least common mechanism.
Threat modeling frameworks: STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) and PASTA.
Trust boundaries are drawn where data crosses between components with different privilege or ownership; threats concentrate there.
Defense in depth layers controls so a single failure does not compromise the asset.
Cryptographic key management: generation, distribution, storage, rotation, revocation, destruction; key compromise defeats the algorithm.
HSM/TPM provide hardware-protected key storage; TPM supports measured boot and platform integrity attestation.
Cloud shared responsibility: provider secures the cloud (physical, hypervisor); customer secures what is in the cloud (data, identity, config).
Secure boot verifies bootloader/kernel signatures; measured boot records hashes to a TPM for later attestation.
Fail-open vs fail-closed: fail-closed denies access on failure (safer for security); fail-open preserves availability but may expose the asset.
Identity and Access Management
Authentication factors: something you know, something you have, something you are; MFA requires two or more different factor types.
Access control models: DAC (owner discretion), MAC (labels/clearances), RBAC (roles), ABAC (attributes/policy), RuBAC (rules).
SAML is XML-based SSO for web; OAuth 2.0 is delegated authorization, not authentication; OIDC adds an identity layer on OAuth 2.0.
Password storage requires a salted, slow hash (bcrypt, scrypt, Argon2, PBKDF2); plain SHA-256 is unsuitable for passwords.
Kerberos uses a KDC, TGT, and service tickets; it provides mutual authentication and is time-sensitive (default clock skew 5 minutes).
Privileged access management: just-in-time elevation, session recording, vaulting of credentials, and removal of standing admin rights.
Federation establishes trust between identity providers and service providers, enabling cross-domain SSO without shared passwords.
Account lifecycle: provisioning, periodic access review/recertification, role change, and timely deprovisioning on termination.
Directory services (LDAP, Active Directory) centralize identity; LDAP is a protocol, AD is a directory service implementation.
Risk Management and Compliance
Risk = likelihood x impact; qualitative (high/medium/low), quantitative (SLE, ARO, ALE), and semi-quantitative methods.
SLE = asset value x exposure factor; ALE = SLE x annualized rate of occurrence (ARO).
Risk responses: mitigate, transfer (insurance), avoid, accept; residual risk is what remains after treatment.
Risk register records asset, threat, vulnerability, likelihood, impact, owner, treatment, and status.
Qualitative vs quantitative: qualitative is faster and subjective; quantitative is numeric and requires reliable data.
Business impact analysis (BIA) identifies critical processes and derives RTO and RPO; MTD is the maximum tolerable downtime.
RTO is the target restore time; RPO is the maximum acceptable data loss measured in time.
Frameworks: NIST CSF (Identify, Protect, Detect, Respond, Recover, Govern), ISO 27001 (ISMS), SOC 2 (trust services criteria).
Compliance is adherence to requirements; it does not guarantee security, and a control gap is not automatically a breach.
General Security Concepts
CIA triad: Confidentiality (encryption, access control), Integrity (hashing, signatures, MAC), Availability (redundancy, DDoS protection, backups).
Non-repudiation requires asymmetric cryptography: a sender signs with their private key and any verifier checks with the public key.
AAA model: Authentication proves identity, Authorization grants rights, Accounting logs activity for audit.
Least privilege, separation of duties, and defense in depth are control-design principles, not individual controls.
Control types: preventive (blocks), detective (identifies), corrective (restores), deterrent (discourages), compensating (substitute), directive (policy).
Zero Trust removes implicit trust from the network perimeter; every request is authenticated and authorized based on identity, device posture, and context.
Hashing (SHA-256, SHA-3) is one-way and detects modification; it does not provide confidentiality and is not encryption.
Symmetric encryption (AES) is fast and used for bulk data; asymmetric (RSA, ECC) is slower and used for key exchange and signatures.
Security through obscurity alone is not a control; hiding a service name or port reduces exposure but does not replace authentication or patching.
Network Security
OSI layers and controls: L2 MAC filtering/VLANs, L3 ACLs and routing, L4 stateful firewalls and port filtering, L7 WAF/proxy inspection.
TCP three-way handshake is SYN, SYN-ACK, ACK; a SYN flood exhausts the half-open connection table and is mitigated with SYN cookies or rate limiting.
Stateful firewalls track connection state; stateless ACLs must permit return traffic explicitly.
NAT/PAT translates private addresses to a public address and port; it is not a security control by itself.
TLS 1.2/1.3 provides confidentiality, integrity, and server authentication; certificate validation checks chain, hostname, expiry, and revocation.
IPsec modes: transport encrypts payload only; tunnel encrypts the whole packet and is used for site-to-site VPNs.
VLAN hopping via double tagging or switch spoofing is mitigated by disabling unused ports, using a dedicated native VLAN, and enabling DTP/trunk hardening.
IDS detects and alerts (passive); IPS detects and blocks inline (active); both may be signature- or anomaly-based.
Segmentation (DMZ, microsegmentation) limits lateral movement; a DMZ hosts internet-facing services isolated from the internal network.
Security Operations and Monitoring
Log source categories: network (firewall, IDS/IPS, NetFlow), host (EDR, Sysmon, OS audit), application, identity (AD, IdP), and cloud (CloudTrail, activity logs).
NIST SP 800-92 log management lifecycle: generation, transmission, storage, analysis, disposal; retain per legal and investigative needs.
Syslog severity 0 (emergency) through 7 (debug); lower number equals higher severity.
SIEM correlates and normalizes logs, applies correlation rules, and supports alerting; SOAR automates response playbooks.
Time synchronization (NTP) is required for correlation; unsynchronized clocks break timeline reconstruction.
Detection tuning metrics: false positive rate, false negative rate, mean time to detect (MTTD), mean time to respond (MTTR).
Honeypots/honeynets are deception controls that provide low-noise detection and threat intelligence, not primary prevention.
Baseline deviation and anomaly detection are effective for unknown threats but produce higher false positives than deterministic signatures.
Vulnerability Management
CVSS v3.1 base score components: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity, Availability.
CVSS severity bands: 0.0 None, 0.1-3.9 Low, 4.0-6.9 Medium, 7.0-8.9 High, 9.0-10.0 Critical.
Prioritization combines CVSS with exploitability (EPSS), known exploitation (CISA KEV), asset criticality, and exposure.
Vulnerability scanning is authenticated (credentialed) or unauthenticated; credentialed scans find far more host-level issues.
A false positive is a reported vulnerability that does not exist; a false negative is a missed real vulnerability.
CVE identifies a specific vulnerability; CWE classifies weakness types; NVD enriches CVEs with CVSS and CPE data.
Patch management cycle: inventory, assess, test, deploy, verify, and document exceptions with compensating controls.
A vulnerability is a weakness; a threat is an actor or event that could exploit it; risk is the combination of likelihood and impact.
Scan results must be validated before remediation to avoid chasing false positives and to confirm exploit conditions.
Incident Response and Threat Hunting
NIST IR lifecycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.
Incident response plan elements: roles, communication paths, escalation criteria, evidence handling, and legal/regulatory notification triggers.
Order of volatility: CPU registers/cache, RAM, swap, network connections, running processes, disk, backups, archived media.
Evidence handling requires chain of custody, hashing at acquisition, write blockers, and documented handoffs.
Containment options: isolate host from network, disable account, block IOC at perimeter, revoke tokens; choose based on blast radius.
Threat hunting hypothesis-driven approach: form hypothesis from TTPs (MITRE ATT&CK), query telemetry, validate, then convert findings into detections.
MITRE ATT&CK tactics describe adversary goals (e.g., Initial Access, Persistence, Lateral Movement); techniques describe how.
Indicators of compromise (hashes, IPs, domains) are low-fidelity and short-lived; TTPs are higher-fidelity and more durable.
Post-incident review produces lessons learned, root cause, and detection/control improvements; it is not a blame exercise.
Security Architecture and Engineering
Secure design principles: least privilege, fail-safe defaults, complete mediation, open design, separation of privilege, least common mechanism.
Threat modeling frameworks: STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) and PASTA.
Trust boundaries are drawn where data crosses between components with different privilege or ownership; threats concentrate there.
Defense in depth layers controls so a single failure does not compromise the asset.
Cryptographic key management: generation, distribution, storage, rotation, revocation, destruction; key compromise defeats the algorithm.
HSM/TPM provide hardware-protected key storage; TPM supports measured boot and platform integrity attestation.
Cloud shared responsibility: provider secures the cloud (physical, hypervisor); customer secures what is in the cloud (data, identity, config).
Secure boot verifies bootloader/kernel signatures; measured boot records hashes to a TPM for later attestation.
Fail-open vs fail-closed: fail-closed denies access on failure (safer for security); fail-open preserves availability but may expose the asset.
Identity and Access Management
Authentication factors: something you know, something you have, something you are; MFA requires two or more different factor types.
Access control models: DAC (owner discretion), MAC (labels/clearances), RBAC (roles), ABAC (attributes/policy), RuBAC (rules).
SAML is XML-based SSO for web; OAuth 2.0 is delegated authorization, not authentication; OIDC adds an identity layer on OAuth 2.0.
Password storage requires a salted, slow hash (bcrypt, scrypt, Argon2, PBKDF2); plain SHA-256 is unsuitable for passwords.
Kerberos uses a KDC, TGT, and service tickets; it provides mutual authentication and is time-sensitive (default clock skew 5 minutes).
Privileged access management: just-in-time elevation, session recording, vaulting of credentials, and removal of standing admin rights.
Federation establishes trust between identity providers and service providers, enabling cross-domain SSO without shared passwords.
Account lifecycle: provisioning, periodic access review/recertification, role change, and timely deprovisioning on termination.
Directory services (LDAP, Active Directory) centralize identity; LDAP is a protocol, AD is a directory service implementation.
Risk Management and Compliance
Risk = likelihood x impact; qualitative (high/medium/low), quantitative (SLE, ARO, ALE), and semi-quantitative methods.
SLE = asset value x exposure factor; ALE = SLE x annualized rate of occurrence (ARO).
Risk responses: mitigate, transfer (insurance), avoid, accept; residual risk is what remains after treatment.
Risk register records asset, threat, vulnerability, likelihood, impact, owner, treatment, and status.
Qualitative vs quantitative: qualitative is faster and subjective; quantitative is numeric and requires reliable data.
Business impact analysis (BIA) identifies critical processes and derives RTO and RPO; MTD is the maximum tolerable downtime.
RTO is the target restore time; RPO is the maximum acceptable data loss measured in time.
Frameworks: NIST CSF (Identify, Protect, Detect, Respond, Recover, Govern), ISO 27001 (ISMS), SOC 2 (trust services criteria).
Compliance is adherence to requirements; it does not guarantee security, and a control gap is not automatically a breach.
General Security Concepts
CIA triad: Confidentiality (encryption, access control), Integrity (hashing, signatures, MAC), Availability (redundancy, DDoS protection, backups).
Non-repudiation requires asymmetric cryptography: a sender signs with their private key and any verifier checks with the public key.
AAA model: Authentication proves identity, Authorization grants rights, Accounting logs activity for audit.
Least privilege, separation of duties, and defense in depth are control-design principles, not individual controls.
Control types: preventive (blocks), detective (identifies), corrective (restores), deterrent (discourages), compensating (substitute), directive (policy).
Zero Trust removes implicit trust from the network perimeter; every request is authenticated and authorized based on identity, device posture, and context.
Hashing (SHA-256, SHA-3) is one-way and detects modification; it does not provide confidentiality and is not encryption.
Symmetric encryption (AES) is fast and used for bulk data; asymmetric (RSA, ECC) is slower and used for key exchange and signatures.
Security through obscurity alone is not a control; hiding a service name or port reduces exposure but does not replace authentication or patching.
Network Security
OSI layers and controls: L2 MAC filtering/VLANs, L3 ACLs and routing, L4 stateful firewalls and port filtering, L7 WAF/proxy inspection.
TCP three-way handshake is SYN, SYN-ACK, ACK; a SYN flood exhausts the half-open connection table and is mitigated with SYN cookies or rate limiting.
Stateful firewalls track connection state; stateless ACLs must permit return traffic explicitly.
NAT/PAT translates private addresses to a public address and port; it is not a security control by itself.
TLS 1.2/1.3 provides confidentiality, integrity, and server authentication; certificate validation checks chain, hostname, expiry, and revocation.
IPsec modes: transport encrypts payload only; tunnel encrypts the whole packet and is used for site-to-site VPNs.
VLAN hopping via double tagging or switch spoofing is mitigated by disabling unused ports, using a dedicated native VLAN, and enabling DTP/trunk hardening.
IDS detects and alerts (passive); IPS detects and blocks inline (active); both may be signature- or anomaly-based.
Segmentation (DMZ, microsegmentation) limits lateral movement; a DMZ hosts internet-facing services isolated from the internal network.
Security Operations and Monitoring
Log source categories: network (firewall, IDS/IPS, NetFlow), host (EDR, Sysmon, OS audit), application, identity (AD, IdP), and cloud (CloudTrail, activity logs).
NIST SP 800-92 log management lifecycle: generation, transmission, storage, analysis, disposal; retain per legal and investigative needs.
Syslog severity 0 (emergency) through 7 (debug); lower number equals higher severity.
SIEM correlates and normalizes logs, applies correlation rules, and supports alerting; SOAR automates response playbooks.
Time synchronization (NTP) is required for correlation; unsynchronized clocks break timeline reconstruction.
Detection tuning metrics: false positive rate, false negative rate, mean time to detect (MTTD), mean time to respond (MTTR).
Honeypots/honeynets are deception controls that provide low-noise detection and threat intelligence, not primary prevention.
Baseline deviation and anomaly detection are effective for unknown threats but produce higher false positives than deterministic signatures.
Vulnerability Management
CVSS v3.1 base score components: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity, Availability.
CVSS severity bands: 0.0 None, 0.1-3.9 Low, 4.0-6.9 Medium, 7.0-8.9 High, 9.0-10.0 Critical.
Prioritization combines CVSS with exploitability (EPSS), known exploitation (CISA KEV), asset criticality, and exposure.
Vulnerability scanning is authenticated (credentialed) or unauthenticated; credentialed scans find far more host-level issues.
A false positive is a reported vulnerability that does not exist; a false negative is a missed real vulnerability.
CVE identifies a specific vulnerability; CWE classifies weakness types; NVD enriches CVEs with CVSS and CPE data.
Patch management cycle: inventory, assess, test, deploy, verify, and document exceptions with compensating controls.
A vulnerability is a weakness; a threat is an actor or event that could exploit it; risk is the combination of likelihood and impact.
Scan results must be validated before remediation to avoid chasing false positives and to confirm exploit conditions.
Incident Response and Threat Hunting
NIST IR lifecycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.
Incident response plan elements: roles, communication paths, escalation criteria, evidence handling, and legal/regulatory notification triggers.
Order of volatility: CPU registers/cache, RAM, swap, network connections, running processes, disk, backups, archived media.
Evidence handling requires chain of custody, hashing at acquisition, write blockers, and documented handoffs.
Containment options: isolate host from network, disable account, block IOC at perimeter, revoke tokens; choose based on blast radius.
Threat hunting hypothesis-driven approach: form hypothesis from TTPs (MITRE ATT&CK), query telemetry, validate, then convert findings into detections.
MITRE ATT&CK tactics describe adversary goals (e.g., Initial Access, Persistence, Lateral Movement); techniques describe how.
Indicators of compromise (hashes, IPs, domains) are low-fidelity and short-lived; TTPs are higher-fidelity and more durable.
Post-incident review produces lessons learned, root cause, and detection/control improvements; it is not a blame exercise.
Security Architecture and Engineering
Secure design principles: least privilege, fail-safe defaults, complete mediation, open design, separation of privilege, least common mechanism.
Threat modeling frameworks: STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) and PASTA.
Trust boundaries are drawn where data crosses between components with different privilege or ownership; threats concentrate there.
Defense in depth layers controls so a single failure does not compromise the asset.
Cryptographic key management: generation, distribution, storage, rotation, revocation, destruction; key compromise defeats the algorithm.
HSM/TPM provide hardware-protected key storage; TPM supports measured boot and platform integrity attestation.
Cloud shared responsibility: provider secures the cloud (physical, hypervisor); customer secures what is in the cloud (data, identity, config).
Secure boot verifies bootloader/kernel signatures; measured boot records hashes to a TPM for later attestation.
Fail-open vs fail-closed: fail-closed denies access on failure (safer for security); fail-open preserves availability but may expose the asset.
Identity and Access Management
Authentication factors: something you know, something you have, something you are; MFA requires two or more different factor types.
Access control models: DAC (owner discretion), MAC (labels/clearances), RBAC (roles), ABAC (attributes/policy), RuBAC (rules).
SAML is XML-based SSO for web; OAuth 2.0 is delegated authorization, not authentication; OIDC adds an identity layer on OAuth 2.0.
Password storage requires a salted, slow hash (bcrypt, scrypt, Argon2, PBKDF2); plain SHA-256 is unsuitable for passwords.
Kerberos uses a KDC, TGT, and service tickets; it provides mutual authentication and is time-sensitive (default clock skew 5 minutes).
Privileged access management: just-in-time elevation, session recording, vaulting of credentials, and removal of standing admin rights.
Federation establishes trust between identity providers and service providers, enabling cross-domain SSO without shared passwords.
Account lifecycle: provisioning, periodic access review/recertification, role change, and timely deprovisioning on termination.
Directory services (LDAP, Active Directory) centralize identity; LDAP is a protocol, AD is a directory service implementation.
Risk Management and Compliance
Risk = likelihood x impact; qualitative (high/medium/low), quantitative (SLE, ARO, ALE), and semi-quantitative methods.
SLE = asset value x exposure factor; ALE = SLE x annualized rate of occurrence (ARO).
Risk responses: mitigate, transfer (insurance), avoid, accept; residual risk is what remains after treatment.
Risk register records asset, threat, vulnerability, likelihood, impact, owner, treatment, and status.
Qualitative vs quantitative: qualitative is faster and subjective; quantitative is numeric and requires reliable data.
Business impact analysis (BIA) identifies critical processes and derives RTO and RPO; MTD is the maximum tolerable downtime.
RTO is the target restore time; RPO is the maximum acceptable data loss measured in time.
Frameworks: NIST CSF (Identify, Protect, Detect, Respond, Recover, Govern), ISO 27001 (ISMS), SOC 2 (trust services criteria).
Compliance is adherence to requirements; it does not guarantee security, and a control gap is not automatically a breach.
General Security Concepts
CIA triad: Confidentiality (encryption, access control), Integrity (hashing, signatures, MAC), Availability (redundancy, DDoS protection, backups).
Non-repudiation requires asymmetric cryptography: a sender signs with their private key and any verifier checks with the public key.
AAA model: Authentication proves identity, Authorization grants rights, Accounting logs activity for audit.
Least privilege, separation of duties, and defense in depth are control-design principles, not individual controls.
Control types: preventive (blocks), detective (identifies), corrective (restores), deterrent (discourages), compensating (substitute), directive (policy).
Zero Trust removes implicit trust from the network perimeter; every request is authenticated and authorized based on identity, device posture, and context.
Hashing (SHA-256, SHA-3) is one-way and detects modification; it does not provide confidentiality and is not encryption.
Symmetric encryption (AES) is fast and used for bulk data; asymmetric (RSA, ECC) is slower and used for key exchange and signatures.
Security through obscurity alone is not a control; hiding a service name or port reduces exposure but does not replace authentication or patching.
Network Security
OSI layers and controls: L2 MAC filtering/VLANs, L3 ACLs and routing, L4 stateful firewalls and port filtering, L7 WAF/proxy inspection.
TCP three-way handshake is SYN, SYN-ACK, ACK; a SYN flood exhausts the half-open connection table and is mitigated with SYN cookies or rate limiting.
Stateful firewalls track connection state; stateless ACLs must permit return traffic explicitly.
NAT/PAT translates private addresses to a public address and port; it is not a security control by itself.
TLS 1.2/1.3 provides confidentiality, integrity, and server authentication; certificate validation checks chain, hostname, expiry, and revocation.
IPsec modes: transport encrypts payload only; tunnel encrypts the whole packet and is used for site-to-site VPNs.
VLAN hopping via double tagging or switch spoofing is mitigated by disabling unused ports, using a dedicated native VLAN, and enabling DTP/trunk hardening.
IDS detects and alerts (passive); IPS detects and blocks inline (active); both may be signature- or anomaly-based.
Segmentation (DMZ, microsegmentation) limits lateral movement; a DMZ hosts internet-facing services isolated from the internal network.
Security Operations and Monitoring
Log source categories: network (firewall, IDS/IPS, NetFlow), host (EDR, Sysmon, OS audit), application, identity (AD, IdP), and cloud (CloudTrail, activity logs).
NIST SP 800-92 log management lifecycle: generation, transmission, storage, analysis, disposal; retain per legal and investigative needs.
Syslog severity 0 (emergency) through 7 (debug); lower number equals higher severity.
SIEM correlates and normalizes logs, applies correlation rules, and supports alerting; SOAR automates response playbooks.
Time synchronization (NTP) is required for correlation; unsynchronized clocks break timeline reconstruction.
Detection tuning metrics: false positive rate, false negative rate, mean time to detect (MTTD), mean time to respond (MTTR).
Honeypots/honeynets are deception controls that provide low-noise detection and threat intelligence, not primary prevention.
Baseline deviation and anomaly detection are effective for unknown threats but produce higher false positives than deterministic signatures.
Vulnerability Management
CVSS v3.1 base score components: Attack Vector, Attack Complexity, Privileges Required, User Interaction, Scope, Confidentiality, Integrity, Availability.
CVSS severity bands: 0.0 None, 0.1-3.9 Low, 4.0-6.9 Medium, 7.0-8.9 High, 9.0-10.0 Critical.
Prioritization combines CVSS with exploitability (EPSS), known exploitation (CISA KEV), asset criticality, and exposure.
Vulnerability scanning is authenticated (credentialed) or unauthenticated; credentialed scans find far more host-level issues.
A false positive is a reported vulnerability that does not exist; a false negative is a missed real vulnerability.
CVE identifies a specific vulnerability; CWE classifies weakness types; NVD enriches CVEs with CVSS and CPE data.
Patch management cycle: inventory, assess, test, deploy, verify, and document exceptions with compensating controls.
A vulnerability is a weakness; a threat is an actor or event that could exploit it; risk is the combination of likelihood and impact.
Scan results must be validated before remediation to avoid chasing false positives and to confirm exploit conditions.
Incident Response and Threat Hunting
NIST IR lifecycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.
Incident response plan elements: roles, communication paths, escalation criteria, evidence handling, and legal/regulatory notification triggers.
Order of volatility: CPU registers/cache, RAM, swap, network connections, running processes, disk, backups, archived media.
Evidence handling requires chain of custody, hashing at acquisition, write blockers, and documented handoffs.
Containment options: isolate host from network, disable account, block IOC at perimeter, revoke tokens; choose based on blast radius.
Threat hunting hypothesis-driven approach: form hypothesis from TTPs (MITRE ATT&CK), query telemetry, validate, then convert findings into detections.
MITRE ATT&CK tactics describe adversary goals (e.g., Initial Access, Persistence, Lateral Movement); techniques describe how.
Indicators of compromise (hashes, IPs, domains) are low-fidelity and short-lived; TTPs are higher-fidelity and more durable.
Post-incident review produces lessons learned, root cause, and detection/control improvements; it is not a blame exercise.
Security Architecture and Engineering
Secure design principles: least privilege, fail-safe defaults, complete mediation, open design, separation of privilege, least common mechanism.
Threat modeling frameworks: STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) and PASTA.
Trust boundaries are drawn where data crosses between components with different privilege or ownership; threats concentrate there.
Defense in depth layers controls so a single failure does not compromise the asset.
Cryptographic key management: generation, distribution, storage, rotation, revocation, destruction; key compromise defeats the algorithm.
HSM/TPM provide hardware-protected key storage; TPM supports measured boot and platform integrity attestation.
Cloud shared responsibility: provider secures the cloud (physical, hypervisor); customer secures what is in the cloud (data, identity, config).
Secure boot verifies bootloader/kernel signatures; measured boot records hashes to a TPM for later attestation.
Fail-open vs fail-closed: fail-closed denies access on failure (safer for security); fail-open preserves availability but may expose the asset.
Identity and Access Management
Authentication factors: something you know, something you have, something you are; MFA requires two or more different factor types.
Access control models: DAC (owner discretion), MAC (labels/clearances), RBAC (roles), ABAC (attributes/policy), RuBAC (rules).
SAML is XML-based SSO for web; OAuth 2.0 is delegated authorization, not authentication; OIDC adds an identity layer on OAuth 2.0.
Password storage requires a salted, slow hash (bcrypt, scrypt, Argon2, PBKDF2); plain SHA-256 is unsuitable for passwords.
Kerberos uses a KDC, TGT, and service tickets; it provides mutual authentication and is time-sensitive (default clock skew 5 minutes).
Privileged access management: just-in-time elevation, session recording, vaulting of credentials, and removal of standing admin rights.
Federation establishes trust between identity providers and service providers, enabling cross-domain SSO without shared passwords.
Account lifecycle: provisioning, periodic access review/recertification, role change, and timely deprovisioning on termination.
Directory services (LDAP, Active Directory) centralize identity; LDAP is a protocol, AD is a directory service implementation.
Risk Management and Compliance
Risk = likelihood x impact; qualitative (high/medium/low), quantitative (SLE, ARO, ALE), and semi-quantitative methods.
SLE = asset value x exposure factor; ALE = SLE x annualized rate of occurrence (ARO).
Risk responses: mitigate, transfer (insurance), avoid, accept; residual risk is what remains after treatment.
Risk register records asset, threat, vulnerability, likelihood, impact, owner, treatment, and status.
Qualitative vs quantitative: qualitative is faster and subjective; quantitative is numeric and requires reliable data.
Business impact analysis (BIA) identifies critical processes and derives RTO and RPO; MTD is the maximum tolerable downtime.
RTO is the target restore time; RPO is the maximum acceptable data loss measured in time.
Frameworks: NIST CSF (Identify, Protect, Detect, Respond, Recover, Govern), ISO 27001 (ISMS), SOC 2 (trust services criteria).
Compliance is adherence to requirements; it does not guarantee security, and a control gap is not automatically a breach.