ECF Cybersecurity (Core) cheat sheet

CIA triad: Confidentiality (authorized disclosure only), Integrity (unauthorized modification prevented), Availability (timely, reliable access).

Risk = Threat × Vulnerability × Impact. A threat exploits a vulnerability; impact is the consequence; risk is the resulting exposure.

Risk treatment options: Avoid (eliminate activity), Mitigate (reduce likelihood/impact via controls), Transfer (insurance, contracts), Accept (documented tolerance).

Quantitative risk: SLE = Asset Value × Exposure Factor; ALE = SLE × Annualized Rate of Occurrence (ARO).

Qualitative risk uses ordinal scales (High/Medium/Low) and risk matrices; no monetary estimate.

Defense in depth layers controls: administrative (policy, training), technical (firewalls, encryption), physical (locks, guards).

Least privilege, separation of duties, and need-to-know are preventive administrative controls.

Residual risk = inherent risk minus risk mitigated by controls; it must be formally accepted by management.

Business Impact Analysis (BIA) identifies critical functions, RTO (recovery time objective), and RPO (recovery point objective).

OSI layers: 7 Application, 6 Presentation, 5 Session, 4 Transport, 3 Network, 2 Data Link, 1 Physical. TCP/IP maps to 4 layers (Application, Transport, Internet, Link).

Stateful firewall tracks connection state; stateless packet filter inspects each packet independently against ACL rules.

IDS detects and alerts (passive); IPS detects and blocks (inline). Signature-based vs anomaly-based detection.

DMZ hosts internet-facing services segmented from the internal LAN; dual firewalls or a single firewall with three interfaces.

VLAN segmentation limits broadcast domains; inter-VLAN routing requires a router or Layer 3 switch with ACLs.

IPsec modes: Transport (payload protected, original IP header) and Tunnel (entire packet encapsulated). AH provides integrity/authentication; ESP provides confidentiality plus integrity.

TLS handshake establishes session keys via asymmetric cryptography, then bulk data uses symmetric encryption.

802.1X port-based network access control authenticates devices before granting LAN access (supplicant, authenticator, authentication server).

AAA: Authentication (verify identity), Authorization (grant permissions), Accounting (log activity).

Authentication factors: something you know (password), something you have (token), something you are (biometric). MFA requires two or more distinct factor types.

Access control models: DAC (owner discretion), MAC (labels/clearances), RBAC (role-based), ABAC (attribute-based).

Least privilege and separation of duties limit insider risk; job rotation and mandatory vacation detect fraud.

SSO reduces credential sprawl but concentrates risk; federated identity uses standards such as SAML and OIDC.

Password storage uses salted, slow hashes (bcrypt, scrypt, Argon2, PBKDF2) - never plaintext or fast hashes alone.

Kerberos uses a KDC, ticket-granting ticket (TGT), and service tickets; time synchronization is required to limit replay.

Privileged access management (PAM) vaults administrative credentials, enforces just-in-time elevation, and records sessions.

Hardening baseline: remove unnecessary services, disable default accounts, apply patches, enforce least privilege, enable logging.

EDR monitors endpoint behavior and can detect, contain, and remediate; antivirus is signature-centric and narrower.

Application allowlisting permits only approved executables; blocklisting is weaker because unknown threats bypass it.

Patch management lifecycle: inventory, assess, test, deploy, verify, and document exceptions.

Full-disk encryption protects data at rest if the device is lost or stolen; TPM stores keys and supports measured boot.

Host-based firewall filters traffic per endpoint; it complements but does not replace network firewalls.

Configuration drift occurs when systems deviate from the approved baseline; continuous compliance scanning detects drift.

Sandboxing isolates untrusted code execution; container security requires image scanning and least-privilege runtime.

Symmetric encryption uses one shared key (AES, ChaCha20); fast for bulk data but key distribution is hard.

Asymmetric encryption uses public/private key pairs (RSA, ECC); slower, used for key exchange and digital signatures.

Hashing is one-way and collision-resistant (SHA-256, SHA-3); it provides integrity, not confidentiality.

Digital signature = hash of message encrypted with sender's private key; verifies origin, integrity, and non-repudiation.

PKI: CA issues and signs certificates binding a public key to an identity; CRL and OCSP handle revocation.

Key management: generate with sufficient entropy, rotate, escrow where required, destroy securely; never hard-code keys.

Data states: at rest (storage encryption), in transit (TLS/IPsec), in use (confidential computing, memory protections).

Data classification (public, internal, confidential, restricted) drives handling, retention, and encryption requirements.

Perfect forward secrecy uses ephemeral key exchange so compromise of a long-term key does not expose past sessions.

Incident response phases: Preparation, Detection and Analysis, Containment, Eradication, Recovery, Lessons Learned.

Containment options: isolate host, block indicator, disable account; choose based on business impact and spread risk.

Chain of custody documents who handled evidence, when, and how; maintain integrity with hashes and sealed storage.

Order of volatility: CPU/cache, memory, network state, disk, backups/archives - collect most volatile first.

SIEM aggregates and correlates logs; SOAR automates response playbooks; both depend on accurate time sync and log coverage.

SOC tiers: Tier 1 triage, Tier 2 investigation, Tier 3 advanced hunting/forensics; escalation paths must be defined.

MTTD (mean time to detect) and MTTR (mean time to respond/recover) are key operational metrics.

Tabletop exercises and post-incident reviews validate playbooks and update controls.

Threat intelligence levels: strategic (executive), operational (campaigns), tactical (TTPs), technical (IOCs such as hashes, IPs, domains).

Frameworks: MITRE ATT&CK (adversary tactics/techniques), Cyber Kill Chain (phases of intrusion), Diamond Model (adversary, capability, infrastructure, victim).

IOC vs TTP: indicators are atomic and short-lived; TTPs are behavioral and more durable for detection.

Vulnerability management cycle: discover assets, scan, prioritize, remediate, verify, report.

CVSS base score (0–10) reflects intrinsic severity; temporal and environmental metrics adjust for context.

Prioritize by exploitability and exposure: CVSS plus EPSS (exploit prediction) and known exploited vulnerabilities (KEV).

Threat hunting is hypothesis-driven proactive search; it differs from alert-driven monitoring.

Vulnerability scanning finds known weaknesses; penetration testing validates exploitability through authorized simulated attacks.

Governance sets direction via policies, standards, procedures, and guidelines; management enforces them.

Policy types: acceptable use, access control, data classification, incident response, business continuity, retention.

Compliance frameworks: ISO/IEC 27001 (ISMS), NIST CSF (Identify, Protect, Detect, Respond, Recover), PCI DSS (card data), HIPAA (health data), GDPR (EU personal data).

Privacy principles: lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, accountability.

Data subject rights under GDPR include access, rectification, erasure, restriction, portability, and objection.

Third-party risk management: due diligence, contractual security requirements, right-to-audit clauses, ongoing monitoring.

Audit evidence should be sufficient, reliable, and relevant; segregation of duties applies to audit and production roles.

Business continuity (BCP) maintains operations during disruption; disaster recovery (DRP) restores critical systems after a major outage.