GISP cheat sheet

Risk = Threat × Vulnerability × Impact; qualitative approaches use ordinal scales (High/Medium/Low) while quantitative approaches compute ALE = SLE × ARO, with SLE = Asset Value × Exposure Factor.

Risk treatment options are mitigate, transfer, avoid, and accept; residual risk is the risk remaining after controls and must be formally accepted by an accountable owner.

Due care is the action taken to maintain the duty of care; due diligence is the ongoing verification and investigation that supports those decisions.

CIA triad plus supporting attributes: confidentiality (disclosure), integrity (modification), availability (access); supporting concepts include authenticity, non-repudiation, and accountability.

Business Impact Analysis identifies critical business functions, RTO (max tolerable downtime), RPO (max tolerable data loss), and MTD (maximum tolerable downtime); RTO must be ≤ MTD.

Defense in depth layers administrative, technical, and physical controls across preventive, detective, corrective, deterrent, recovery, and compensating categories.

Threat modeling (e.g., STRIDE: spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) identifies threats at design time.

Security governance aligns policy (management intent), standards (mandatory specifics), baselines (minimum configuration), guidelines (recommendations), and procedures (step-by-step).

Key regulations to recognize: GDPR (EU personal data, 72-hour breach notification), HIPAA (US health data), PCI DSS (cardholder data), SOX (financial reporting controls).

Data classification tiers typically run public → internal/private → confidential → restricted; classification drives handling, labeling, retention, and access rules.

Data roles: owner (accountable for classification and protection), custodian (implements controls), user (follows rules), and controller/processor under GDPR.

Data states are at rest (storage encryption, e.g., AES-256), in transit (TLS/IPsec), and in use (memory protection, secure enclaves, homomorphic options).

Data remanence countermeasures: overwriting, degaussing (magnetic media only), cryptographic erasure, and physical destruction; degaussing does not work on SSDs/flash.

Retention and destruction must follow legal/regulatory minimums and privacy maximization; secure deletion methods include shredding, incineration, and certified destruction.

Scoping reduces the compliance footprint of an asset inventory by limiting systems that store, process, or transmit regulated data.

Asset inventory attributes: owner, location, classification, value, and supporting systems; unclassified or unowned assets are the primary governance gap.

PII, PHI, and cardholder data carry different obligations; tokenization and data minimization reduce the scope of regulated data.

Security models: Bell-LaPadula (confidentiality: no read up, no write down), Biba (integrity: no read down, no write up), Clark-Wilson (integrity via well-formed transactions and separation of duties), Brewer-Nash (conflict of interest).

Evaluation criteria: TCSEC/Orange Book (D through A divisions) and Common Criteria (EAL1–EAL7 with Protection Profile and Security Target).

Trusted Computing Base (TCB) is the totality of protection mechanisms; the reference monitor enforces access and must be tamper-proof, always invoked, and verifiable.

Cryptography: symmetric (AES, 3DES) is fast and key-distribution heavy; asymmetric (RSA, ECC) solves key exchange and non-repudiation but is slow; hashes (SHA-256/384/512) provide integrity, not confidentiality.

Modes of operation: ECB is insecure (pattern leakage); CBC needs an IV; GCM provides authenticated encryption; digital signatures = hash encrypted with sender's private key.

PKI components: CA, RA, certificate, CRL/OCSP for revocation, and trust anchors; X.509 defines certificate structure.

Physical security: CPTED principles, perimeter controls, mantraps, and environmental controls (fire suppression, HVAC, humidity, power conditioning/UPS).

Secure design principles: least privilege, separation of duties, fail-safe defaults, complete mediation, open design, least common mechanism, and psychological acceptability.

OSI layers 1–7: Physical, Data Link, Network, Transport, Session, Presentation, Application; TCP/IP maps to Link, Internet, Transport, Application.

TCP is connection-oriented (three-way handshake, reliability); UDP is connectionless and used for DNS, DHCP, VoIP, and streaming.

IPsec: AH provides integrity/authentication only; ESP provides confidentiality plus integrity; transport mode protects host-to-host, tunnel mode protects gateway-to-gateway (VPN).

TLS provides confidentiality, integrity, and server authentication; certificate pinning and HSTS mitigate downgrade and MITM attacks.

Network segmentation (VLANs, subnets, DMZ) limits lateral movement; NAC enforces endpoint posture before network admission.

Wireless: WPA2 (CCMP/AES) and WPA3 (SAE) replace WEP; 802.1X/EAP provides port-based authentication; rogue AP and evil twin attacks target association.

Firewall types: packet-filtering (stateless), stateful inspection, application-layer/proxy, and NGFW with IPS and application awareness.

DNS security: DNSSEC signs records for integrity/authenticity (not confidentiality); DoH/DoT encrypt DNS traffic.

Authentication factors: something you know (password/PIN), have (token/smart card), are (biometrics); MFA requires two or more distinct factor types.

Biometric metrics: FAR (false acceptance rate) and FRR (false rejection rate); the crossover error rate (CER/EER) is the point where FAR equals FRR - lower CER means better accuracy.

Access control models: DAC (owner discretion), MAC (labels/clearances), RBAC (roles), ABAC (attributes/policy), and RuBAC (rules).

AAA: identification → authentication → authorization → accounting/auditing; single sign-on (SSO) trades convenience for a single point of compromise.

Federation standards: SAML (XML assertions), OAuth 2.0 (delegated authorization, not authentication), OpenID Connect (authentication layer on OAuth 2.0).

Password controls: hashing with salt (bcrypt, PBKDF2, Argon2), complexity/length policy, lockout thresholds, and protection against credential stuffing.

Privileged access management: just-in-time elevation, vaulting of credentials, session recording, and periodic recertification of entitlements.

Identity lifecycle: provisioning, review, role change/transfer, and timely deprovisioning on termination are key audit points.

Vulnerability scanning identifies known weaknesses (signature/CVE-based); penetration testing actively exploits to demonstrate business impact.

Test types: black-box (no knowledge), gray-box (partial), white-box (full knowledge); scoping and rules of engagement must be documented before testing.

SAST analyzes source/bytecode without execution; DAST tests running applications from outside; IAST combines runtime instrumentation; SCA finds vulnerable third-party components.

Fuzzing (mutation vs. generational) and fault injection test robustness of input handling and error paths.

Audit and assessment techniques include interviews, observation, configuration review, and sampling; evidence must be sufficient, relevant, and reliable.

Metrics: coverage, false positive/negative rates, MTTR, and remediation SLA compliance; findings should be risk-ranked and tracked to closure.

SOC 2 (Type I point-in-time, Type II over a period) and ISO 27001 certification are common third-party assurance reports.

Continuous monitoring uses SIEM, vulnerability feeds, and configuration baselines to detect drift between assessments.

Incident response phases: preparation → detection and analysis → containment, eradication, and recovery → post-incident activity; evidence handling preserves chain of custody.

BCP/DR: hot site (near-immediate), warm site (partial readiness), cold site (space/power only); DR metrics RTO/RPO drive site selection.

Backup strategies: full, incremental (changes since last backup), differential (changes since last full); the 3-2-1 rule keeps three copies on two media with one offsite.

Logging and monitoring: centralized syslog/SIEM, time synchronization (NTP), log retention, and alert tuning reduce false positives.

Malware types: virus (needs host), worm (self-propagating), trojan (disguised), ransomware (encryption/extortion), rootkit (persistence/stealth).

Change and configuration management: baselines, approval workflows, rollback plans, and separation of duties between developer and deployer.

Forensics order of volatility: CPU/cache → memory → network state → disk → backups/archives; hash evidence (SHA-256) and document every action.

Patch management tiers: identify, test, approve, deploy, verify; emergency patching bypasses normal cadence for critical exposures.

SDLC phases: requirements → design → development → testing → deployment → maintenance; security gates and threat modeling belong in requirements and design.

OWASP Top 10 categories include broken access control, injection, cryptographic failures, insecure design, and security misconfiguration; input validation and parameterized queries mitigate injection.

DevSecOps shifts security left with automated SAST/DAST/SCA in CI/CD, infrastructure as code scanning, and secrets management.

Secure coding: validate input, encode output (context-aware), avoid hard-coded secrets, handle errors without leaking details, and use vetted libraries.

API security: authentication (OAuth 2.0/OIDC), rate limiting, schema validation, and object-level authorization checks to prevent BOLA/IDOR.

Software supply chain: SBOM, signed artifacts, dependency pinning, and provenance attestations reduce compromise risk.

Testing levels: unit, integration, system, and acceptance; security tests include abuse cases, negative testing, and regression of prior findings.

Maturity models (BSIMM, SAMM) and secure code review checklists provide measurable program benchmarks.