CPIT InfoSec cheat sheet

Governance sets direction and accountability; management executes it. Boards approve risk appetite, security strategy, and policy hierarchy, while management implements controls and reports performance.

Policy hierarchy: policy (mandatory intent) → standards (specific mandatory requirements) → procedures (step-by-step instructions) → guidelines (recommended practice). Baselines are minimum mandatory configurations.

Common control frameworks: ISO/IEC 27001 (ISMS requirements), NIST CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover), COBIT (IT governance), CIS Controls (prioritized safeguards).

Segregation of duties prevents one person from both initiating and approving a transaction or change; compensating controls (logging, review, dual control) apply when separation is impractical.

Three lines model: operational management owns risk (first line), risk/compliance functions oversee (second line), internal audit provides independent assurance (third line).

Security metrics should be SMART and tied to objectives; lagging indicators (incidents) show outcomes, leading indicators (patch compliance, MFA coverage) predict future performance.

Due care is the level of diligence a reasonable organization exercises; due diligence is the ongoing verification activity. Negligence claims hinge on failure of due care relative to a standard.

Third-party governance: tier vendors by data sensitivity and criticality, require contractual security terms and right-to-audit, and reassess at defined intervals or on material change.

Risk = likelihood × impact. Qualitative scales use ordinal ratings; quantitative analysis uses annualized loss expectancy: ALE = SLE × ARO, where SLE = asset value × exposure factor.

Risk treatment options: mitigate (reduce), transfer (insurance, contract), avoid (eliminate activity), accept (retain within appetite). Residual risk remains after controls; it must be compared to risk appetite.

Inherent risk is assessed before controls; residual risk after controls. Control effectiveness reduces likelihood, impact, or both - document which.

Risk register entries include asset/process, threat, vulnerability, likelihood, impact, owner, treatment, due date, and residual rating. Risk owners accept; risk practitioners advise.

Compliance is adherence to obligations (laws, regulations, contracts, standards). Compliance does not equal security: a compliant system can still carry unmanaged risk.

Common regulations: GDPR (EU personal data, extraterritorial reach, 72-hour breach notification to supervisory authority), HIPAA (US health data), PCI DSS (cardholder data), SOX (financial reporting controls).

Risk assessment approaches: asset-based, threat-based, and vulnerability-based; qualitative methods include Delphi and scenario analysis; quantitative includes Monte Carlo simulation.

Key risk indicators (KRIs) are thresholds that signal rising exposure; when breached they trigger escalation. Risk tolerance is the acceptable variation around appetite.

Defense in depth layers controls so no single failure is fatal; least privilege, fail-safe defaults, separation of duties, and complete mediation are Saltzer and Schroeder design principles.

Security models: Bell-LaPadula (confidentiality: no read up, no write down), Biba (integrity: no read down, no write up), Clark-Wilson (integrity via well-formed transactions and separation of duties).

Reference monitor properties: it must be tamper-proof, always invoked, and verifiable (small enough to analyze). The trusted computing base is the set of components relied on for security.

Threat modeling with STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) pairs with data-flow diagrams, trust boundaries, and entry points.

Architecture patterns: zero trust (verify explicitly, least privilege, assume breach), microsegmentation, secure enclaves, and shared responsibility splits between cloud provider and customer.

Common criteria evaluation assurance levels run EAL1–EAL7; higher EAL means more rigorous evaluation evidence, not inherently better security for a given use case.

Attack surface reduction: disable unused services and ports, minimize code, restrict interfaces, and remove default accounts. Attack trees quantify paths to a goal.

Cryptographic architecture decisions (key custody, algorithm agility, data residency) belong in design reviews, not retrofitted after deployment.

OSI layers map to controls: L2 (MAC filtering, VLANs, port security), L3 (ACLs, routing controls), L4 (stateful firewalls, port filtering), L7 (WAF, application proxies).

Firewall types: packet-filtering (stateless, header-based), stateful (tracks sessions), application-layer/proxy (inspects payload), next-generation (adds IPS, identity awareness). Default deny is the baseline.

DMZ design places internet-facing services in a segmented zone with restricted inbound and outbound flows; dual firewalls or a single firewall with separate interfaces are common patterns.

VPN: IPsec uses AH (integrity) and ESP (confidentiality/integrity); IKE negotiates SAs. TLS VPNs operate at the transport layer. Split tunneling changes exposure and policy scope.

802.1X provides port-based network access control using supplicant, authenticator, and authentication server (RADIUS); EAP variants differ in credential type and server authentication.

IDS detects and alerts (signature or anomaly); IPS sits inline and blocks. Placement matters: network TAP/SPAN for visibility, inline for prevention.

DNS security: DNSSEC signs records for authenticity, DoH/DoT encrypt queries, and DNS filtering blocks malicious resolution. ARP spoofing is countered by dynamic ARP inspection.

Wireless: WPA3 uses SAE for resistance to offline dictionary attacks; WPA2-PSK is vulnerable to handshake capture and offline cracking. Rogue AP detection and 802.11w (management frame protection) reduce attacks.

Authentication factors: something you know, have, are; plus location and behavior. MFA requires factors from different categories; two passwords are not MFA.

Access control models: DAC (owner discretion), MAC (labels/clearances), RBAC (roles), ABAC (attributes/policy), and rule-based. RBAC is the most common enterprise default.

AAA: identification, authentication, authorization, and accounting. Authorization decisions should be enforced server-side, never solely in the client.

Federation standards: SAML 2.0 (XML assertions, browser SSO), OAuth 2.0 (delegated authorization, not authentication), OpenID Connect (identity layer over OAuth).

Password storage: salted, slow hashes (bcrypt, scrypt, Argon2, PBKDF2). Never store reversible or unsalted fast hashes. NIST guidance favors length, blocklists, and no forced rotation.

Privileged access management: vault credentials, session recording, just-in-time elevation, and periodic recertification of entitlements. Dormant accounts are a top audit finding.

Kerberos: ticket-granting ticket from the KDC, service tickets for resources; time synchronization is required. Kerberoasting targets weak service account passwords.

Zero trust identity: continuous verification, device posture checks, conditional access policies, and short-lived tokens with refresh controls.

Symmetric ciphers: AES (128/192/256-bit keys, block), ChaCha20 (stream). Modes: GCM provides authenticated encryption; ECB leaks patterns and should not be used for data.

Asymmetric: RSA (key size ≥2048), ECC (smaller keys, comparable strength), Diffie-Hellman for key agreement, DSA/ECDSA for signatures. Asymmetric is slow; it wraps symmetric keys.

Hashing: SHA-256/SHA-3 are current; MD5 and SHA-1 are broken for collision resistance. HMAC provides message authentication using a shared key.

Digital signature = hash of message encrypted with signer's private key; verification uses the public key and proves integrity, authenticity, and non-repudiation.

PKI: CA signs certificates binding identity to public key; chain of trust, CRL and OCSP for revocation, and certificate pinning for hard-coded trust. Validate expiry and hostname.

Key management lifecycle: generation, distribution, storage, rotation, archival, destruction. Keys should be stored in HSMs or KMS, never in source code; separate key custodian duties.

Perfect forward secrecy comes from ephemeral key exchange (ECDHE); compromise of long-term keys does not expose past sessions. TLS 1.3 mandates PFS-capable suites.

Post-quantum: NIST standardized ML-KEM (FIPS 203), ML-DSA (204), SLH-DSA (205); crypto-agility planning matters for long-lived data.

Hardening baseline: remove unnecessary services, disable default accounts, apply least privilege, enforce host firewall, enable logging, and use configuration management to prevent drift.

Patch management cycle: inventory → assess → test → deploy → verify. Track mean time to remediate by severity; critical internet-facing flaws get shorter windows.

EDR/XDR detects behavioral indicators and enables response (isolate host, kill process). Antivirus signatures alone miss fileless and living-off-the-land attacks.

Application security: input validation (allowlist), output encoding, parameterized queries against SQL injection, CSRF tokens, secure session management, and security headers (CSP, HSTS).

OWASP Top 10 categories include broken access control, injection, cryptographic failures, insecure design, misconfiguration, and vulnerable components; map testing to them.

SDLC integration: threat modeling at design, SAST on code, DAST on running apps, SCA on dependencies, and secrets scanning in repositories. Shift-left reduces fix cost.

Memory safety: buffer overflows, use-after-free; mitigations include ASLR, DEP/NX, stack canaries, and safe languages. Input length checks are not a substitute.

Container and workload security: minimal base images, no root, read-only filesystems, image scanning, signed images, and admission control in orchestration.

SOC tiers: T1 triage, T2 investigation, T3 threat hunting/advanced response. Detection engineering turns threat intelligence and TTPs into rules with tuned false-positive rates.

SIEM correlates logs and alerts; SOAR automates enrichment and response. Log sources: identity, endpoint, network, cloud, and application. Time synchronization is essential for correlation.

Detection coverage frameworks: MITRE ATT&CK tactics/techniques map rules to adversary behavior; gaps are prioritized by threat relevance.

Incident response phases (NIST): preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Evidence handling preserves chain of custody.

Containment options: isolate host, disable account, block IP/domain, revoke tokens. Order of volatility guides evidence collection (memory/CPU before disk before backups).

Forensics: hash disk images, maintain write blockers, document every action, and store evidence securely. Legal hold suspends normal deletion.

Incident severity classification drives escalation and notification clocks; regulatory breach notification timelines differ by jurisdiction and data type.

Threat intelligence types: strategic, operational, tactical, technical. Indicators have a shelf life; sharing via TAXII/STIX standardizes exchange.

BIA identifies critical business functions, dependencies, and maximum tolerable downtime (MTD); recovery time objective (RTO) must be ≤ MTD, and RPO defines acceptable data loss.

Recovery strategies by cost/RTO: backup and restore (hours-days), warm site (hours), hot site (minutes), active-active (near zero). Choose based on BIA output.

Backup types: full, incremental (changes since last backup), differential (changes since last full). The 3-2-1 rule: 3 copies, 2 media, 1 offsite; add immutability for ransomware.

Test backups by restoring, not by reading logs. Untested recovery plans are assumptions. Tabletop exercises validate roles and communications.

DR plan contents: scope, roles, call trees, alternate sites, system recovery order, dependencies, and communication plans. BC plan covers people and business processes.

Crisis management: incident command structure, predefined spokesperson, and stakeholder communication cadence. Reputation recovery is part of resilience.

Resilience engineering: redundancy, failover automation, graceful degradation, and chaos testing. Single points of failure are identified via dependency mapping.

Metrics: actual RTO/RPO achieved in tests versus targets; track test frequency and remediation of gaps found.

Data roles under GDPR: controller determines purposes and means; processor acts on controller instructions. Both carry obligations; contracts are required for processing.

GDPR principles: lawfulness/fairness/transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, accountability. Legal bases include consent, contract, legal obligation, vital interests, public task, legitimate interests.

Data subject rights: access, rectification, erasure, restriction, portability, objection, and rights related to automated decision-making. Respond within one month (extendable).

Data classification tiers (public, internal, confidential, restricted) drive handling, encryption, retention, and access rules. Data mapping/records of processing are prerequisites.

Cross-border transfer mechanisms: adequacy decisions, standard contractual clauses, binding corporate rules. Schrems II invalidated Privacy Shield and required transfer impact assessments.

Privacy by design and by default: minimize collection, pseudonymize, set retention limits, and embed privacy in system design. DPIA is required for high-risk processing.

Ethics: professional codes require honesty, due care, confidentiality, and avoidance of conflicts of interest; whistleblowing protections and responsible disclosure are expected practices.

Breach notification: GDPR requires notification to the supervisory authority within 72 hours of awareness where risk exists, and to data subjects without undue delay when high risk.