ECF-GSF Core cheat sheet

Risk = Threat × Vulnerability × Impact; a threat with no vulnerability, or a vulnerability with no threat, yields no realized risk.

Quantitative measures: SLE = Asset Value × Exposure Factor; ALE = SLE × Annualized Rate of Occurrence (ARO).

Qualitative analysis uses ordinal scales (e.g., High/Medium/Low) and is preferred when credible numeric data is unavailable.

Risk treatments: mitigate (reduce likelihood/impact), transfer (insurance, contracts), avoid (stop the activity), accept (documented residual risk).

Defense in depth layers controls so a single failure does not compromise the asset; controls are preventive, detective, corrective, or compensating.

CIA triad: confidentiality (disclosure), integrity (unauthorized modification), availability (timely access); non-repudiation and authenticity are supporting properties.

Due care is the action taken to reduce risk; due diligence is the ongoing verification that controls and processes remain adequate.

Residual risk = inherent risk − risk mitigated by controls; it must be explicitly accepted by an accountable owner.

Threat modeling (e.g., STRIDE) enumerates spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.

OSI layers map to devices: L2 switches (MAC), L3 routers (IP), L4 firewalls (ports), L7 proxies/WAF (application payload).

TCP three-way handshake is SYN, SYN-ACK, ACK; a SYN flood exhausts the half-open connection table and is mitigated by SYN cookies.

Stateful firewalls track connection state; stateless ACLs evaluate each packet independently and must permit both directions explicitly.

DMZ (screened subnet) hosts internet-facing services between two filtering points so a compromised host does not reach the internal LAN directly.

IPsec modes: transport encrypts payload only (host-to-host); tunnel encrypts the whole packet (gateway-to-gateway, remote access).

802.1X port-based access control uses supplicant, authenticator (switch), and authentication server (RADIUS) before granting LAN access.

NAT/PAT hides internal addressing but is not a security control; segmentation and least-privilege filtering provide the actual boundary.

Zero trust replaces implicit internal trust with per-request verification of identity, device posture, and context (policy decision and enforcement points).

Authentication proves identity; authorization grants permissions; accounting/auditing records actions - the three A's are distinct.

Factors: something you know (password), have (token, certificate), are (biometric); MFA requires two or more different factor types.

NIST SP 800-63B: require length over composition complexity, screen against breached-password lists, and do not force periodic rotation absent compromise.

RBAC assigns permissions to roles and users to roles; ABAC evaluates attributes (user, resource, environment) in policy for finer granularity.

Least privilege, separation of duties, and need-to-know limit standing access; just-in-time elevation reduces persistent privileged accounts.

SSO with SAML or OIDC centralizes authentication; federation trusts an identity provider's assertions across security domains.

Kerberos issues time-limited tickets from a KDC; clock skew beyond the tolerance (commonly 5 minutes) causes authentication failure.

Password storage must use salted, slow hashes (bcrypt, scrypt, Argon2, PBKDF2) - never fast hashes such as MD5 or SHA-1 alone.

Data states: at rest (storage encryption), in transit (TLS/IPsec), and in use (memory, enclaves, confidential computing).

Classification tiers (public, internal, confidential, restricted) drive handling, retention, and control requirements; labeling enables enforcement.

Data lifecycle: create, store, use, share, archive, destroy; each stage needs an owner and defined controls.

DLP inspects content and context to block exfiltration; effectiveness depends on accurate classification and data tagging.

Tokenization substitutes a non-sensitive token for data, keeping the vault out of PCI scope; format-preserving encryption keeps the original schema.

Backup rule 3-2-1: three copies, two media types, one offsite; immutable/offline copies defend against ransomware.

Secure destruction: crypto-shredding destroys keys for encrypted data; degaussing works on magnetic media, not on flash or optical.

Data minimization and purpose limitation (GDPR principles) reduce both breach impact and regulatory exposure.

Symmetric ciphers (AES, ChaCha20) are fast and need a shared key; asymmetric (RSA, ECC) solve key distribution but are slow and used mainly for key exchange and signatures.

AES block size is 128 bits; key lengths are 128, 192, or 256 bits. RSA keys are commonly 2048-4096 bits; ECC achieves equivalent strength with far shorter keys (P-256 ≈ RSA 3072).

Modes: GCM/CCM give authenticated encryption (confidentiality plus integrity); ECB leaks patterns and must not be used for real data; CBC needs a random IV and a MAC.

Hashes (SHA-256, SHA-3) are one-way and collision-resistant; HMAC adds a shared key for message authentication.

Digital signature = hash of message encrypted/signed with the sender's private key; verification uses the public key and proves integrity, authenticity, non-repudiation.

PKI trust chain: root CA (self-signed) → intermediate CA → leaf certificate; revocation via CRL or OCSP; pinning constrains accepted certificates.

Forward secrecy (ephemeral Diffie-Hellman, ECDHE) means compromise of a long-term key does not decrypt past sessions.

Privacy principles: lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, accountability.

Privacy-enhancing technologies: differential privacy, k-anonymity/l-diversity, homomorphic encryption, and secure multiparty computation.

EDR collects endpoint telemetry (process, file, network, registry) and enables detection plus response, unlike signature-only antivirus.

Application allowlisting permits known-good executables; blocklisting only stops known-bad and is weaker against novel malware.

OWASP Top 10 core defenses: parameterized queries (injection), output encoding plus CSP (XSS), CSRF tokens, and server-side authorization checks.

SAST examines source code without execution; DAST tests a running application; SCA finds vulnerable third-party dependencies.

Shared responsibility: the cloud provider secures the infrastructure 'of' the cloud; the customer secures data, identity, configuration, and access 'in' the cloud.

CIS benchmarks and hardened images reduce misconfiguration, the leading cause of cloud breaches; IaC scanning catches drift before deployment.

Container security: minimal base images, no root, signed images, and scanning for CVEs in layers; the orchestrator's secrets must not be baked into images.

Patch management prioritizes by exploitability and exposure (e.g., CVSS plus known-exploited status), not by CVSS score alone.

NIST IR lifecycle: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.

Incident severity drives escalation; evidence must preserve chain of custody (hash, log, timestamp, custodian) for legal use.

SOC tiers: T1 triage, T2 investigation, T3 threat hunting/response; detection engineering maintains detection-as-code.

SIEM correlates logs against rules; SOAR automates playbook responses; tuning reduces false positives and alert fatigue.

Key metrics: MTTD (mean time to detect), MTTR (mean time to respond), and alert-to-incident conversion rate.

Vulnerability management cycle: discover, prioritize, remediate, verify, report; scanning frequency is set by risk and compliance.

Threat intelligence feeds (STIX/TAXII) and MITRE ATT&CK mapping improve detection coverage and hunting hypotheses.

Forensic order of volatility: CPU registers/cache, RAM, network state, disk, remote logs, archival media - collect most volatile first.

Policy hierarchy: policy (intent) → standard (mandatory requirements) → procedure (steps) → guideline (recommendation).

Frameworks: ISO/IEC 27001 (ISMS requirements, certification), NIST CSF (Identify, Protect, Detect, Respond, Recover, Govern), SOC 2 (trust services criteria).

GDPR: lawful basis, data subject rights (access, erasure, portability), 72-hour breach notification to the supervisory authority, fines up to 4% of global turnover.

PCI DSS applies to any entity storing, processing, or transmitting cardholder data; scope reduction via tokenization or segmentation.

HIPAA covers protected health information in the US; the Security Rule mandates administrative, physical, and technical safeguards.

Legal concepts: due care/due diligence, negligence, contracts, and jurisdictional reach; data localization laws restrict cross-border transfers.

Audit evidence includes logs, configurations, and access reviews; segregation of duties and independent audit strengthen assurance.

Records retention schedules must satisfy the longest applicable legal, regulatory, or contractual requirement before destruction.

Risk = Threat × Vulnerability × Impact; a threat with no vulnerability, or a vulnerability with no threat, yields no realized risk.

Quantitative measures: SLE = Asset Value × Exposure Factor; ALE = SLE × Annualized Rate of Occurrence (ARO).

Qualitative analysis uses ordinal scales (e.g., High/Medium/Low) and is preferred when credible numeric data is unavailable.

Risk treatments: mitigate (reduce likelihood/impact), transfer (insurance, contracts), avoid (stop the activity), accept (documented residual risk).

Defense in depth layers controls so a single failure does not compromise the asset; controls are preventive, detective, corrective, or compensating.

CIA triad: confidentiality (disclosure), integrity (unauthorized modification), availability (timely access); non-repudiation and authenticity are supporting properties.

Due care is the action taken to reduce risk; due diligence is the ongoing verification that controls and processes remain adequate.

Residual risk = inherent risk − risk mitigated by controls; it must be explicitly accepted by an accountable owner.

Threat modeling (e.g., STRIDE) enumerates spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.

OSI layers map to devices: L2 switches (MAC), L3 routers (IP), L4 firewalls (ports), L7 proxies/WAF (application payload).

TCP three-way handshake is SYN, SYN-ACK, ACK; a SYN flood exhausts the half-open connection table and is mitigated by SYN cookies.

Stateful firewalls track connection state; stateless ACLs evaluate each packet independently and must permit both directions explicitly.

DMZ (screened subnet) hosts internet-facing services between two filtering points so a compromised host does not reach the internal LAN directly.

IPsec modes: transport encrypts payload only (host-to-host); tunnel encrypts the whole packet (gateway-to-gateway, remote access).

802.1X port-based access control uses supplicant, authenticator (switch), and authentication server (RADIUS) before granting LAN access.

NAT/PAT hides internal addressing but is not a security control; segmentation and least-privilege filtering provide the actual boundary.

Zero trust replaces implicit internal trust with per-request verification of identity, device posture, and context (policy decision and enforcement points).

Authentication proves identity; authorization grants permissions; accounting/auditing records actions - the three A's are distinct.

Factors: something you know (password), have (token, certificate), are (biometric); MFA requires two or more different factor types.

NIST SP 800-63B: require length over composition complexity, screen against breached-password lists, and do not force periodic rotation absent compromise.

RBAC assigns permissions to roles and users to roles; ABAC evaluates attributes (user, resource, environment) in policy for finer granularity.

Least privilege, separation of duties, and need-to-know limit standing access; just-in-time elevation reduces persistent privileged accounts.

SSO with SAML or OIDC centralizes authentication; federation trusts an identity provider's assertions across security domains.

Kerberos issues time-limited tickets from a KDC; clock skew beyond the tolerance (commonly 5 minutes) causes authentication failure.

Password storage must use salted, slow hashes (bcrypt, scrypt, Argon2, PBKDF2) - never fast hashes such as MD5 or SHA-1 alone.

Data states: at rest (storage encryption), in transit (TLS/IPsec), and in use (memory, enclaves, confidential computing).

Classification tiers (public, internal, confidential, restricted) drive handling, retention, and control requirements; labeling enables enforcement.

Data lifecycle: create, store, use, share, archive, destroy; each stage needs an owner and defined controls.

DLP inspects content and context to block exfiltration; effectiveness depends on accurate classification and data tagging.

Tokenization substitutes a non-sensitive token for data, keeping the vault out of PCI scope; format-preserving encryption keeps the original schema.

Backup rule 3-2-1: three copies, two media types, one offsite; immutable/offline copies defend against ransomware.

Secure destruction: crypto-shredding destroys keys for encrypted data; degaussing works on magnetic media, not on flash or optical.

Data minimization and purpose limitation (GDPR principles) reduce both breach impact and regulatory exposure.

Symmetric ciphers (AES, ChaCha20) are fast and need a shared key; asymmetric (RSA, ECC) solve key distribution but are slow and used mainly for key exchange and signatures.

AES block size is 128 bits; key lengths are 128, 192, or 256 bits. RSA keys are commonly 2048-4096 bits; ECC achieves equivalent strength with far shorter keys (P-256 ≈ RSA 3072).

Modes: GCM/CCM give authenticated encryption (confidentiality plus integrity); ECB leaks patterns and must not be used for real data; CBC needs a random IV and a MAC.

Hashes (SHA-256, SHA-3) are one-way and collision-resistant; HMAC adds a shared key for message authentication.

Digital signature = hash of message encrypted/signed with the sender's private key; verification uses the public key and proves integrity, authenticity, non-repudiation.

PKI trust chain: root CA (self-signed) → intermediate CA → leaf certificate; revocation via CRL or OCSP; pinning constrains accepted certificates.

Forward secrecy (ephemeral Diffie-Hellman, ECDHE) means compromise of a long-term key does not decrypt past sessions.

Privacy principles: lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, accountability.

Privacy-enhancing technologies: differential privacy, k-anonymity/l-diversity, homomorphic encryption, and secure multiparty computation.

EDR collects endpoint telemetry (process, file, network, registry) and enables detection plus response, unlike signature-only antivirus.

Application allowlisting permits known-good executables; blocklisting only stops known-bad and is weaker against novel malware.

OWASP Top 10 core defenses: parameterized queries (injection), output encoding plus CSP (XSS), CSRF tokens, and server-side authorization checks.

SAST examines source code without execution; DAST tests a running application; SCA finds vulnerable third-party dependencies.

Shared responsibility: the cloud provider secures the infrastructure 'of' the cloud; the customer secures data, identity, configuration, and access 'in' the cloud.

CIS benchmarks and hardened images reduce misconfiguration, the leading cause of cloud breaches; IaC scanning catches drift before deployment.

Container security: minimal base images, no root, signed images, and scanning for CVEs in layers; the orchestrator's secrets must not be baked into images.

Patch management prioritizes by exploitability and exposure (e.g., CVSS plus known-exploited status), not by CVSS score alone.

NIST IR lifecycle: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.

Incident severity drives escalation; evidence must preserve chain of custody (hash, log, timestamp, custodian) for legal use.

SOC tiers: T1 triage, T2 investigation, T3 threat hunting/response; detection engineering maintains detection-as-code.

SIEM correlates logs against rules; SOAR automates playbook responses; tuning reduces false positives and alert fatigue.

Key metrics: MTTD (mean time to detect), MTTR (mean time to respond), and alert-to-incident conversion rate.

Vulnerability management cycle: discover, prioritize, remediate, verify, report; scanning frequency is set by risk and compliance.

Threat intelligence feeds (STIX/TAXII) and MITRE ATT&CK mapping improve detection coverage and hunting hypotheses.

Forensic order of volatility: CPU registers/cache, RAM, network state, disk, remote logs, archival media - collect most volatile first.

Policy hierarchy: policy (intent) → standard (mandatory requirements) → procedure (steps) → guideline (recommendation).

Frameworks: ISO/IEC 27001 (ISMS requirements, certification), NIST CSF (Identify, Protect, Detect, Respond, Recover, Govern), SOC 2 (trust services criteria).

GDPR: lawful basis, data subject rights (access, erasure, portability), 72-hour breach notification to the supervisory authority, fines up to 4% of global turnover.

PCI DSS applies to any entity storing, processing, or transmitting cardholder data; scope reduction via tokenization or segmentation.

HIPAA covers protected health information in the US; the Security Rule mandates administrative, physical, and technical safeguards.

Legal concepts: due care/due diligence, negligence, contracts, and jurisdictional reach; data localization laws restrict cross-border transfers.

Audit evidence includes logs, configurations, and access reviews; segregation of duties and independent audit strengthen assurance.

Records retention schedules must satisfy the longest applicable legal, regulatory, or contractual requirement before destruction.