GCT-2A-324 cheat sheet

Risk = likelihood × impact; a risk register records asset, threat, vulnerability, existing controls, inherent risk, residual risk, owner, and treatment decision.

Four risk treatments: mitigate (reduce likelihood or impact), transfer (insurance, contract), avoid (stop the activity), accept (documented tolerance by an accountable owner).

Inherent risk is measured before controls; residual risk after controls. A control gap exists when residual risk exceeds the stated risk appetite.

Qualitative scales (e.g., 1–5 likelihood × 1–5 impact) are common; semi-quantitative scoring maps bands to numeric ranges. Single Loss Expectancy = Asset Value × Exposure Factor; ALE = SLE × Annualized Rate of Occurrence.

Policy hierarchy: policy (management intent, mandatory) → standard (specific mandatory requirements) → procedure (step-by-step) → guideline (recommended, non-mandatory).

Separation of duties prevents one person from authorizing, executing, and reviewing the same transaction; least privilege and need-to-know limit access to what the role requires.

Compliance evidence types: policy documents, control test results, logs, access reviews, training records, and third-party attestations; evidence must be dated and traceable to the control.

Due care is acting on known risk (implementing controls); due diligence is the investigation that informs it. Negligence claims hinge on documented reasonable care.

Regulatory examples to distinguish: GDPR (EU personal data, 72-hour breach notification to supervisory authority), HIPAA (US protected health information), PCI DSS (cardholder data), SOX (financial reporting controls).

Defense in depth layers controls so a single failure does not compromise the asset; each layer should fail closed where availability permits.

Reference models: OSI seven layers vs. TCP/IP four layers; map controls to the layer they act on (e.g., TLS at transport, WAF at application).

Trust boundaries exist wherever data crosses between components of different trust levels; every boundary needs authentication, authorization, and logging.

Common architectures: DMZ with dual firewalls, zero trust (verify explicitly, least privilege, assume breach), and microsegmentation limiting east-west traffic.

Security models: Bell-LaPadula (confidentiality: no read up, no write down), Biba (integrity: no read down, no write up), Clark-Wilson (integrity via well-formed transactions and separation of duties).

Fail-safe defaults: systems deny by default; fail-open is acceptable only where safety or availability outweighs confidentiality and is explicitly documented.

Attack surface reduction: disable unused services and ports, remove default accounts, minimize installed software, and restrict management interfaces to dedicated networks.

Threat modeling (e.g., STRIDE: spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) is performed at design time, before code is written.

Virtualization and cloud shared-responsibility: the provider secures the physical and hypervisor layers; the customer secures guest OS, identity, data, and configuration.

Authentication factors: something you know, something you have, something you are; MFA requires factors from at least two different categories.

Authorization models: RBAC (roles aggregate permissions), ABAC (attributes and policy conditions), MAC (labels/clearances), and rule-based access control.

Least privilege and separation of duties are enforced through role design; role explosion is the common failure mode of poorly governed RBAC.

Identity lifecycle: joiner (provision), mover (re-evaluate access), leaver (deprovision promptly); orphaned accounts are a top audit finding.

Access reviews (recertification) are performed periodically by resource or role owners; privileged accounts should be reviewed more frequently than standard accounts.

SSO via SAML or OIDC centralizes authentication; federation relies on a trusted identity provider and signed assertions/tokens that the relying party validates.

Privileged access management: vault credentials, just-in-time elevation, session recording, and separate administrative accounts from daily-use accounts.

Password storage uses salted, slow hashing (bcrypt, scrypt, Argon2, PBKDF2); plain or fast hashes (MD5, SHA-1) are unsuitable for passwords.

Directory protocols: LDAP for directory queries; Kerberos uses tickets (TGT, service tickets) and time-bound trust, so clock skew breaks authentication.

Firewall rule design: default deny, explicit allow, least-privilege source/destination/port, and periodic rule review to remove stale rules.

Stateful firewalls track connection state; stateless ACLs must permit return traffic explicitly. Next-gen firewalls add application identification and IPS.

Network segmentation (VLANs, subnets, security groups) limits lateral movement; east-west controls matter as much as perimeter controls.

IDS detects and alerts (passive), IPS detects and blocks inline; signature-based detection misses novel behavior, anomaly-based detection produces false positives.

VPN: IPsec (AH for integrity, ESP for encryption; IKE for key exchange) vs. TLS VPNs; site-to-site vs. remote access.

Wireless: WPA2/WPA3 with AES-CCMP; WPA3 adds SAE to resist offline dictionary attacks. WEP and WPA/TKIP are deprecated.

DNS risks: cache poisoning, tunneling for exfiltration, and spoofing; mitigations include DNSSEC, response-rate limiting, and filtering resolvers.

DDoS defenses: rate limiting, anycast/scrubbing centers, and upstream provider filtering; volumetric attacks are absorbed, application-layer attacks need behavioral controls.

Zero trust network access replaces broad VPN access with per-application, identity-aware, least-privilege connections.

Symmetric encryption (AES) is fast and used for bulk data; asymmetric (RSA, ECC) solves key distribution and enables digital signatures.

AES key sizes: 128, 192, 256 bits. RSA keys of 2048 bits or more are current minimum; ECC offers comparable strength at much shorter key lengths.

Hash functions provide integrity, not confidentiality; SHA-256/SHA-3 are current; MD5 and SHA-1 are broken for collision resistance.

Digital signature = hash of message encrypted with sender's private key; verification uses the sender's public key and proves integrity, authenticity, and non-repudiation.

Modes of operation: ECB leaks patterns (avoid); CBC needs a random IV and padding; GCM provides authenticated encryption (confidentiality plus integrity).

Key management lifecycle: generation, distribution, storage, rotation, revocation, destruction. Keys must never be stored alongside the data they protect.

Data states: at rest (encryption, access control), in transit (TLS 1.2+), and in use (confidential computing, memory protections). Data classification drives control selection.

PKI trust: a certificate binds a public key to an identity, signed by a CA; validation checks signature chain, validity dates, revocation (CRL/OCSP), and hostname.

TLS 1.2/1.3 with strong cipher suites; certificate pinning reduces MITM risk in mobile apps but complicates rotation. Perfect forward secrecy requires ephemeral key exchange (ECDHE).

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned (post-incident review).

Containment options: isolate host from network, disable account, block indicator at perimeter, or snapshot for forensics; preserve volatile evidence before shutdown when possible.

Evidence handling: order of volatility (CPU/registers → memory → network state → disk → backups), chain of custody, hashing of images, and write blockers.

Detection sources: SIEM correlation, EDR telemetry, IDS/IPS alerts, authentication logs, DNS and proxy logs, and cloud audit trails.

Key metrics: MTTD (mean time to detect), MTTR (mean time to respond/recover), alert false-positive rate, and percentage of incidents detected internally vs. externally.

Log management: centralized collection, synchronized time (NTP), retention per policy/regulation, and integrity protection so logs cannot be altered by an attacker.

MITRE ATT&CK maps adversary tactics and techniques to detections; coverage gaps are identified by comparing telemetry to technique coverage.

Escalation and communication: defined severity tiers, on-call rotation, executive and legal notification triggers, and regulatory breach-reporting deadlines.

Tabletop exercises and purple-team validation test the plan without live production impact; findings feed back into detection engineering.

Vulnerability lifecycle: discover (scan), validate (confirm exploitability/false positive), prioritize (CVSS + exploitability + asset criticality), remediate, verify, and report.

CVSS base score (0–10) reflects intrinsic severity; temporal and environmental scores adjust for exploit maturity and local context. CVSS alone does not equal business risk.

Severity bands: 0.1–3.9 low, 4.0–6.9 medium, 7.0–8.9 high, 9.0–10.0 critical.

Remediation SLAs are tiered by severity and asset exposure (e.g., internet-facing critical faster than internal low); compensating controls apply when patching is delayed.

SAST analyzes source code (white box) early; DAST tests running applications (black box); SCA identifies vulnerable open-source dependencies; IAST combines runtime instrumentation.

Secure SDLC gates: threat modeling at design, code review and SAST at build, DAST/pen testing before release, and dependency scanning continuously.

OWASP Top 10 categories include injection, broken access control, cryptographic failures, and security misconfiguration; input validation and parameterized queries prevent injection.

Penetration testing requires written authorization and defined scope; testing without authorization is a legal, not a technical, failure.

Patch management: inventory assets, test patches, deploy in risk order, verify installation, and track exceptions with expiry dates.

Due diligence before onboarding: security questionnaire, independent attestations (SOC 2 Type II, ISO 27001), financial stability, and breach history.

SOC 2 Type II covers an audit period and tests control operation; Type I covers a point in time. ISO 27001 certification covers the ISMS, not a specific service's controls.

Contract terms to require: right to audit, breach notification timelines, data ownership and return/deletion, subcontractor approval, and security obligations with remedies.

Tier vendors by data sensitivity and access level; critical vendors receive deeper assessment and more frequent review.

Fourth-party risk: subcontractors and cloud dependencies can undermine a vendor's controls; require disclosure of critical subprocessors.

Concentration risk: over-reliance on a single vendor or shared provider creates correlated failure; identify and plan alternatives for critical services.

Software supply chain: SBOM (e.g., SPDX, CycloneDX) inventories components; verify provenance and signatures, monitor dependencies for known vulnerabilities, and pin versions.

Continuous monitoring after onboarding: periodic reassessment, review of new attestations, tracking of vendor security incidents, and offboarding with access revocation and data destruction confirmation.

Vendor risk acceptance must be documented with an accountable owner and review date; unmanaged exceptions are audit findings.