Google Cybersecurity cheat sheet

The CIA triad defines confidentiality as preventing unauthorized disclosure, integrity as preventing unauthorized modification, and availability as ensuring timely authorized access.

Security posture combines the risk landscape, threat landscape, and implemented controls; reducing likelihood or impact lowers overall risk.

The NIST Cybersecurity Framework organizes activity into five functions: Identify, Protect, Detect, Respond, and Recover.

Security controls are categorized as technical, operational, or managerial and as preventive, detective, or corrective.

The incident response lifecycle is preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity.

Compliance satisfies stated requirements, while security reduces actual risk; an organization can be compliant and still be insecure.

The principle of least privilege grants only the access needed for a task and limits the damage from compromised accounts.

Common entry-level roles include SOC analyst, security analyst, GRC analyst, and incident response support.

Qualitative risk is commonly expressed as likelihood multiplied by impact, then mapped to a risk rating such as low, medium, or high.

Risk treatment options are accept, avoid, transfer, and mitigate; selection depends on risk appetite, cost, and legal requirements.

The NIST Risk Management Framework steps are prepare, categorize, select, implement, assess, authorize, and monitor.

A risk register records each risk with an owner, likelihood, impact, score, treatment decision, and status.

A SIEM aggregates and correlates logs from multiple sources, generates alerts, and supports event investigation.

A SOAR platform automates repetitive response actions through playbooks and integrations with security tools.

Vulnerability management follows identify, assess, prioritize, remediate, and verify, with prioritization driven by exploitability and asset criticality.

A business impact analysis identifies critical functions and sets recovery time objectives and recovery point objectives.

Third-party risk management assesses vendors through questionnaires, contract controls, and ongoing monitoring.

The OSI model layers, from top to bottom, are application, presentation, session, transport, network, data link, and physical.

TCP establishes a connection with a SYN, SYN-ACK, ACK handshake; UDP is connectionless and does not guarantee delivery.

Common ports include 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 3306 MySQL, and 3389 RDP.

Private IPv4 ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

A stateless firewall evaluates each packet independently; a stateful firewall tracks established connections and permits return traffic.

An IDS detects and alerts on suspicious traffic; an IPS sits inline and can block or drop malicious traffic.

A VPN encrypts traffic in a tunnel between endpoints, protecting confidentiality over untrusted networks.

Network segmentation divides systems into zones with controlled inter-zone traffic, limiting lateral movement after a compromise.

CIDR notation defines prefix length; a /24 IPv4 subnet contains 256 addresses, with 254 usable host addresses in typical configurations.

Linux permission values are read=4, write=2, execute=1; chmod 755 gives owner rwx, group r-x, and others r-x.

sudo runs a command with elevated privileges after authorization and supports least privilege when administrative access is restricted.

Core file commands include ls, cd, pwd, cp, mv, rm, cat, less, grep, and find.

Process commands include ps aux to list processes, top or htop for real-time monitoring, and kill -9 to force termination.

Linux logs commonly reside under /var/log, including authentication and system logs; journalctl reads systemd journal entries.

A basic SQL query form is SELECT columns FROM table WHERE condition ORDER BY column LIMIT count.

WHERE filters rows before grouping; HAVING filters grouped results after aggregation.

INNER JOIN returns matching rows from both tables; LEFT JOIN returns all left-table rows plus matches from the right table.

Parameterized queries and least-privilege database accounts reduce SQL injection risk.

Asset inventories cover hardware, software, data, people, and facilities, with classification based on sensitivity and business criticality.

Threat actor categories include nation-state groups, organized crime, hacktivists, insiders, and unskilled opportunists.

A virus requires a host to spread, a worm self-replicates across networks, a trojan disguises itself, and ransomware encrypts data for extortion.

Social engineering forms include phishing, vishing, smishing, baiting, and tailgating; verification through a separate channel reduces risk.

A vulnerability is a weakness, a threat is an actor or event that can exploit it, and risk combines likelihood with impact.

CVSS base scores range from 0 to 10: none 0.0, low 0.1-3.9, medium 4.0-6.9, high 7.0-8.9, and critical 9.0-10.0.

Encryption protects confidentiality, hashing verifies integrity, and digital signatures support authenticity and nonrepudiation.

Access control models include discretionary, mandatory, role-based, and attribute-based control.

Defense in depth layers preventive, detective, and corrective controls so that one failure does not expose the entire environment.

SOC tiers commonly separate triage, deeper investigation, and advanced response, with escalation when scope or impact exceeds tier authority.

Alert triage considers severity, asset criticality, detection confidence, and business impact before escalation.

A false positive is a benign event flagged as malicious; a false negative is a malicious event that is not detected.

Common log sources include firewall, IDS/IPS, endpoint, authentication, DNS, proxy, and cloud audit logs.

MITRE ATT&CK tactics include initial access, execution, persistence, privilege escalation, lateral movement, and exfiltration.

Incident response phases are preparation, detection and analysis, containment, eradication, recovery, and lessons learned.

Chain of custody documents evidence handling and uses hashes to verify that evidence has not been altered.

Threat hunting is proactive and hypothesis-driven, using telemetry and threat intelligence to find activity missed by existing detections.

Detection engineering writes and tunes rules, baselines normal behavior, and measures detection coverage against known techniques.

Python built-in types include int, float, str, bool, list, tuple, dict, and set.

Lists are ordered and mutable, tuples are ordered and immutable, dictionaries map unique keys to values, and sets store unique elements.

Conditionals use if, elif, and else; for loops iterate over iterables, and while loops repeat while a condition remains true.

Functions are defined with def name(parameters): and return values with return; local scope limits unintended side effects.

Files are safely opened with with open(path, mode) as handle, which closes the file when the block exits.

Exception handling uses try, except, and finally; bare except clauses can hide errors and complicate debugging.

The re module provides search, match, findall, and sub; compiled patterns are reused for repeated matching.

Useful automation libraries include os, sys, datetime, json, csv, re, subprocess, and requests.

Log parsing commonly combines strip, split, and regular expressions, followed by timestamp normalization for correlation.

Entry paths include SOC analyst, security analyst, GRC analyst, and IT support roles that build into security operations.

Resume bullets that quantify impact, such as reduced alert volume by a percentage, are stronger than duty-only descriptions.

The STAR method structures behavioral answers as Situation, Task, Action, and Result.

A portfolio can include a home lab, automation scripts, CTF writeups, and project documentation created without confidential data.

Executive audiences need business impact and risk framing; technical audiences need evidence, logs, and precise remediation detail.

Incident communications should state known facts, impact, actions taken, and the next update time, without speculation.

Professional ethics require authorized testing only, confidentiality of sensitive data, and disclosure of conflicts of interest.

Certifications such as Security+ and CySA+ validate foundational knowledge, while hands-on demonstrations validate applied skill.