CASSPT cheat sheet

CVSS v3.1 base score = f(Exploitability, Scope, Impact); exploitability = 8.22 × AttackVector × AttackComplexity × PrivilegesRequired × UserInteraction, and Impact uses Confidentiality × Integrity × Availability weights (0.56/0.22/0.56).

CVSS severity bands: 0.0 None, 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High, 9.0–10.0 Critical; a Scope change alters the Impact formula denominator.

EPSS gives the probability a CVE is exploited in the wild in the next 30 days (0–1); combine with CVSS to prioritize - high EPSS plus medium CVSS can outrank a high-CVSS/low-EPSS item.

CISA KEV listing is a binary signal of known exploitation; treat KEV membership as an overriding priority regardless of CVSS score.

Risk rating formula: Risk = Likelihood × Impact; likelihood inputs include threat actor capability, exposure, and exploit availability (weaponized vs. proof-of-concept).

Threat modeling with STRIDE maps threats to Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege; pair with DREAD or a likelihood/impact matrix for scoring.

Vulnerability scan types: authenticated (credentialed) scans find far more than unauthenticated; false positives are reduced by credentialed checks and manual validation.

ATT&CK is a behavioral knowledge base (Tactics → Techniques → Procedures); it describes adversary behavior, not vulnerabilities, and is used to map detection coverage.

Threat intelligence tiers: strategic (executive), operational (campaigns/TTPs), tactical (IOCs); TLP markings (RED/AMBER/GREEN/CLEAR) govern sharing scope.

Defense in depth layers: perimeter, network segmentation, host hardening, application controls, data encryption, identity - each layer assumes the prior layer failed.

Zero Trust principles: verify explicitly, least privilege, assume breach; policy enforcement point (PEP) enforces decisions from the policy decision point (PDP).

Reference models: OSI 7-layer for network, and the shared responsibility model - cloud provider secures 'of the cloud', customer secures 'in the cloud'.

Security models: Bell-LaPadula (confidentiality: no read up, no write down), Biba (integrity: no read down, no write up), Clark-Wilson (integrity via well-formed transactions and separation of duty).

Cryptography: symmetric (AES) for bulk data, asymmetric (RSA/ECC) for key exchange and signatures, hashing (SHA-256) for integrity; TLS combines asymmetric handshake with symmetric session keys.

Segmentation architecture: DMZ for internet-facing services, internal zones for sensitive data, micro-segmentation for east-west traffic control; deny-by-default firewall policy.

High availability patterns: redundancy (N+1), failover clustering, load balancing; RTO/RPO drive backup and replication architecture choices.

Secure design principles: least privilege, separation of duties, fail-safe defaults, complete mediation, economy of mechanism, open design, psychological acceptability.

Change management: request → risk assessment → approval → test → implement → verify → document; emergency changes require retroactive approval and post-implementation review.

Patch management cadence: inventory → classify (critical/high/medium/low) → test → deploy → verify; critical patches often within 24–72h, others per policy.

Configuration baselines: CIS Benchmarks and STIGs define hardened settings; configuration drift detection compares live state to baseline.

IAM operations: enforce MFA, rotate credentials, use role-based access control (RBAC) and just-in-time elevation; disable stale accounts on a defined schedule.

Backup strategy: 3-2-1 rule (3 copies, 2 media, 1 offsite); test restores regularly - an untested backup is not a backup.

Logging and monitoring operations: centralize logs, synchronize time (NTP), retain per policy, protect log integrity with write-once storage or hashing.

Incident readiness in operations: maintain runbooks, contact lists, and out-of-band communication channels; conduct tabletop exercises.

Asset management: maintain a CMDB/inventory; unknown assets cannot be patched, monitored, or risk-assessed.

Incident response lifecycle (NIST SP 800-61): Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity.

Detection sources: SIEM correlation, EDR telemetry, IDS/IPS signatures, netflow anomalies, and threat-hunting hypotheses; tune to reduce false positives.

Indicator types: atomic (IP, hash), behavioral (TTPs), and computed (statistical); behavioral indicators are more durable against attacker evasion.

Containment options: isolate host, block IP/domain, disable account, segment network; choose based on blast radius vs. operational impact.

Evidence handling: maintain chain of custody, hash evidence at acquisition, preserve volatile data (memory, connections) before shutdown.

MTTD (mean time to detect) and MTTR (mean time to respond) are key metrics; track dwell time from initial compromise to detection.

Pyramid of Pain: TTPs > tools > network/host artifacts > domain names > IP addresses > hash values; higher tiers cost adversaries more to change.

Post-incident: root cause analysis, lessons learned, detection rule updates, and control improvements feed back into preparation.

Risk treatment options: mitigate, transfer (insurance), avoid, accept; residual risk = inherent risk after controls, and acceptance requires documented sign-off.

Risk register fields: asset, threat, vulnerability, likelihood, impact, inherent score, controls, residual score, owner, treatment.

Frameworks: NIST CSF (Identify, Protect, Detect, Respond, Recover, Govern), ISO/IEC 27001 (ISMS requirements), SOC 2 (trust services criteria), PCI DSS (cardholder data).

Control types: preventive, detective, corrective, compensating; categories: administrative, technical, physical.

Compliance vs. security: compliance is a minimum baseline, not proof of security posture; map controls to multiple frameworks to reduce audit duplication.

Policy hierarchy: policy (intent) → standard (mandatory requirements) → procedure (steps) → guideline (recommendations).

Third-party risk: vendor tiering by data sensitivity and access; require security questionnaires, contractual security clauses, and periodic reassessment.

Data classification drives handling: public, internal, confidential, restricted; retention schedules and legal hold requirements apply per classification.

CVSS v3.1 base score = f(Exploitability, Scope, Impact); exploitability = 8.22 × AttackVector × AttackComplexity × PrivilegesRequired × UserInteraction, and Impact uses Confidentiality × Integrity × Availability weights (0.56/0.22/0.56).

CVSS severity bands: 0.0 None, 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High, 9.0–10.0 Critical; a Scope change alters the Impact formula denominator.

EPSS gives the probability a CVE is exploited in the wild in the next 30 days (0–1); combine with CVSS to prioritize - high EPSS plus medium CVSS can outrank a high-CVSS/low-EPSS item.

CISA KEV listing is a binary signal of known exploitation; treat KEV membership as an overriding priority regardless of CVSS score.

Risk rating formula: Risk = Likelihood × Impact; likelihood inputs include threat actor capability, exposure, and exploit availability (weaponized vs. proof-of-concept).

Threat modeling with STRIDE maps threats to Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege; pair with DREAD or a likelihood/impact matrix for scoring.

Vulnerability scan types: authenticated (credentialed) scans find far more than unauthenticated; false positives are reduced by credentialed checks and manual validation.

ATT&CK is a behavioral knowledge base (Tactics → Techniques → Procedures); it describes adversary behavior, not vulnerabilities, and is used to map detection coverage.

Threat intelligence tiers: strategic (executive), operational (campaigns/TTPs), tactical (IOCs); TLP markings (RED/AMBER/GREEN/CLEAR) govern sharing scope.

Defense in depth layers: perimeter, network segmentation, host hardening, application controls, data encryption, identity - each layer assumes the prior layer failed.

Zero Trust principles: verify explicitly, least privilege, assume breach; policy enforcement point (PEP) enforces decisions from the policy decision point (PDP).

Reference models: OSI 7-layer for network, and the shared responsibility model - cloud provider secures 'of the cloud', customer secures 'in the cloud'.

Security models: Bell-LaPadula (confidentiality: no read up, no write down), Biba (integrity: no read down, no write up), Clark-Wilson (integrity via well-formed transactions and separation of duty).

Cryptography: symmetric (AES) for bulk data, asymmetric (RSA/ECC) for key exchange and signatures, hashing (SHA-256) for integrity; TLS combines asymmetric handshake with symmetric session keys.

Segmentation architecture: DMZ for internet-facing services, internal zones for sensitive data, micro-segmentation for east-west traffic control; deny-by-default firewall policy.

High availability patterns: redundancy (N+1), failover clustering, load balancing; RTO/RPO drive backup and replication architecture choices.

Secure design principles: least privilege, separation of duties, fail-safe defaults, complete mediation, economy of mechanism, open design, psychological acceptability.

Change management: request → risk assessment → approval → test → implement → verify → document; emergency changes require retroactive approval and post-implementation review.

Patch management cadence: inventory → classify (critical/high/medium/low) → test → deploy → verify; critical patches often within 24–72h, others per policy.

Configuration baselines: CIS Benchmarks and STIGs define hardened settings; configuration drift detection compares live state to baseline.

IAM operations: enforce MFA, rotate credentials, use role-based access control (RBAC) and just-in-time elevation; disable stale accounts on a defined schedule.

Backup strategy: 3-2-1 rule (3 copies, 2 media, 1 offsite); test restores regularly - an untested backup is not a backup.

Logging and monitoring operations: centralize logs, synchronize time (NTP), retain per policy, protect log integrity with write-once storage or hashing.

Incident readiness in operations: maintain runbooks, contact lists, and out-of-band communication channels; conduct tabletop exercises.

Asset management: maintain a CMDB/inventory; unknown assets cannot be patched, monitored, or risk-assessed.

Incident response lifecycle (NIST SP 800-61): Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity.

Detection sources: SIEM correlation, EDR telemetry, IDS/IPS signatures, netflow anomalies, and threat-hunting hypotheses; tune to reduce false positives.

Indicator types: atomic (IP, hash), behavioral (TTPs), and computed (statistical); behavioral indicators are more durable against attacker evasion.

Containment options: isolate host, block IP/domain, disable account, segment network; choose based on blast radius vs. operational impact.

Evidence handling: maintain chain of custody, hash evidence at acquisition, preserve volatile data (memory, connections) before shutdown.

MTTD (mean time to detect) and MTTR (mean time to respond) are key metrics; track dwell time from initial compromise to detection.

Pyramid of Pain: TTPs > tools > network/host artifacts > domain names > IP addresses > hash values; higher tiers cost adversaries more to change.

Post-incident: root cause analysis, lessons learned, detection rule updates, and control improvements feed back into preparation.

Risk treatment options: mitigate, transfer (insurance), avoid, accept; residual risk = inherent risk after controls, and acceptance requires documented sign-off.

Risk register fields: asset, threat, vulnerability, likelihood, impact, inherent score, controls, residual score, owner, treatment.

Frameworks: NIST CSF (Identify, Protect, Detect, Respond, Recover, Govern), ISO/IEC 27001 (ISMS requirements), SOC 2 (trust services criteria), PCI DSS (cardholder data).

Control types: preventive, detective, corrective, compensating; categories: administrative, technical, physical.

Compliance vs. security: compliance is a minimum baseline, not proof of security posture; map controls to multiple frameworks to reduce audit duplication.

Policy hierarchy: policy (intent) → standard (mandatory requirements) → procedure (steps) → guideline (recommendations).

Third-party risk: vendor tiering by data sensitivity and access; require security questionnaires, contractual security clauses, and periodic reassessment.

Data classification drives handling: public, internal, confidential, restricted; retention schedules and legal hold requirements apply per classification.

CVSS v3.1 base score = f(Exploitability, Scope, Impact); exploitability = 8.22 × AttackVector × AttackComplexity × PrivilegesRequired × UserInteraction, and Impact uses Confidentiality × Integrity × Availability weights (0.56/0.22/0.56).

CVSS severity bands: 0.0 None, 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High, 9.0–10.0 Critical; a Scope change alters the Impact formula denominator.

EPSS gives the probability a CVE is exploited in the wild in the next 30 days (0–1); combine with CVSS to prioritize - high EPSS plus medium CVSS can outrank a high-CVSS/low-EPSS item.

CISA KEV listing is a binary signal of known exploitation; treat KEV membership as an overriding priority regardless of CVSS score.

Risk rating formula: Risk = Likelihood × Impact; likelihood inputs include threat actor capability, exposure, and exploit availability (weaponized vs. proof-of-concept).

Threat modeling with STRIDE maps threats to Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege; pair with DREAD or a likelihood/impact matrix for scoring.

Vulnerability scan types: authenticated (credentialed) scans find far more than unauthenticated; false positives are reduced by credentialed checks and manual validation.

ATT&CK is a behavioral knowledge base (Tactics → Techniques → Procedures); it describes adversary behavior, not vulnerabilities, and is used to map detection coverage.

Threat intelligence tiers: strategic (executive), operational (campaigns/TTPs), tactical (IOCs); TLP markings (RED/AMBER/GREEN/CLEAR) govern sharing scope.

Defense in depth layers: perimeter, network segmentation, host hardening, application controls, data encryption, identity - each layer assumes the prior layer failed.

Zero Trust principles: verify explicitly, least privilege, assume breach; policy enforcement point (PEP) enforces decisions from the policy decision point (PDP).

Reference models: OSI 7-layer for network, and the shared responsibility model - cloud provider secures 'of the cloud', customer secures 'in the cloud'.

Security models: Bell-LaPadula (confidentiality: no read up, no write down), Biba (integrity: no read down, no write up), Clark-Wilson (integrity via well-formed transactions and separation of duty).

Cryptography: symmetric (AES) for bulk data, asymmetric (RSA/ECC) for key exchange and signatures, hashing (SHA-256) for integrity; TLS combines asymmetric handshake with symmetric session keys.

Segmentation architecture: DMZ for internet-facing services, internal zones for sensitive data, micro-segmentation for east-west traffic control; deny-by-default firewall policy.

High availability patterns: redundancy (N+1), failover clustering, load balancing; RTO/RPO drive backup and replication architecture choices.

Secure design principles: least privilege, separation of duties, fail-safe defaults, complete mediation, economy of mechanism, open design, psychological acceptability.

Change management: request → risk assessment → approval → test → implement → verify → document; emergency changes require retroactive approval and post-implementation review.

Patch management cadence: inventory → classify (critical/high/medium/low) → test → deploy → verify; critical patches often within 24–72h, others per policy.

Configuration baselines: CIS Benchmarks and STIGs define hardened settings; configuration drift detection compares live state to baseline.

IAM operations: enforce MFA, rotate credentials, use role-based access control (RBAC) and just-in-time elevation; disable stale accounts on a defined schedule.

Backup strategy: 3-2-1 rule (3 copies, 2 media, 1 offsite); test restores regularly - an untested backup is not a backup.

Logging and monitoring operations: centralize logs, synchronize time (NTP), retain per policy, protect log integrity with write-once storage or hashing.

Incident readiness in operations: maintain runbooks, contact lists, and out-of-band communication channels; conduct tabletop exercises.

Asset management: maintain a CMDB/inventory; unknown assets cannot be patched, monitored, or risk-assessed.

Incident response lifecycle (NIST SP 800-61): Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity.

Detection sources: SIEM correlation, EDR telemetry, IDS/IPS signatures, netflow anomalies, and threat-hunting hypotheses; tune to reduce false positives.

Indicator types: atomic (IP, hash), behavioral (TTPs), and computed (statistical); behavioral indicators are more durable against attacker evasion.

Containment options: isolate host, block IP/domain, disable account, segment network; choose based on blast radius vs. operational impact.

Evidence handling: maintain chain of custody, hash evidence at acquisition, preserve volatile data (memory, connections) before shutdown.

MTTD (mean time to detect) and MTTR (mean time to respond) are key metrics; track dwell time from initial compromise to detection.

Pyramid of Pain: TTPs > tools > network/host artifacts > domain names > IP addresses > hash values; higher tiers cost adversaries more to change.

Post-incident: root cause analysis, lessons learned, detection rule updates, and control improvements feed back into preparation.

Risk treatment options: mitigate, transfer (insurance), avoid, accept; residual risk = inherent risk after controls, and acceptance requires documented sign-off.

Risk register fields: asset, threat, vulnerability, likelihood, impact, inherent score, controls, residual score, owner, treatment.

Frameworks: NIST CSF (Identify, Protect, Detect, Respond, Recover, Govern), ISO/IEC 27001 (ISMS requirements), SOC 2 (trust services criteria), PCI DSS (cardholder data).

Control types: preventive, detective, corrective, compensating; categories: administrative, technical, physical.

Compliance vs. security: compliance is a minimum baseline, not proof of security posture; map controls to multiple frameworks to reduce audit duplication.

Policy hierarchy: policy (intent) → standard (mandatory requirements) → procedure (steps) → guideline (recommendations).

Third-party risk: vendor tiering by data sensitivity and access; require security questionnaires, contractual security clauses, and periodic reassessment.

Data classification drives handling: public, internal, confidential, restricted; retention schedules and legal hold requirements apply per classification.

CVSS v3.1 base score = f(Exploitability, Scope, Impact); exploitability = 8.22 × AttackVector × AttackComplexity × PrivilegesRequired × UserInteraction, and Impact uses Confidentiality × Integrity × Availability weights (0.56/0.22/0.56).

CVSS severity bands: 0.0 None, 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High, 9.0–10.0 Critical; a Scope change alters the Impact formula denominator.

EPSS gives the probability a CVE is exploited in the wild in the next 30 days (0–1); combine with CVSS to prioritize - high EPSS plus medium CVSS can outrank a high-CVSS/low-EPSS item.

CISA KEV listing is a binary signal of known exploitation; treat KEV membership as an overriding priority regardless of CVSS score.

Risk rating formula: Risk = Likelihood × Impact; likelihood inputs include threat actor capability, exposure, and exploit availability (weaponized vs. proof-of-concept).

Threat modeling with STRIDE maps threats to Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege; pair with DREAD or a likelihood/impact matrix for scoring.

Vulnerability scan types: authenticated (credentialed) scans find far more than unauthenticated; false positives are reduced by credentialed checks and manual validation.

ATT&CK is a behavioral knowledge base (Tactics → Techniques → Procedures); it describes adversary behavior, not vulnerabilities, and is used to map detection coverage.

Threat intelligence tiers: strategic (executive), operational (campaigns/TTPs), tactical (IOCs); TLP markings (RED/AMBER/GREEN/CLEAR) govern sharing scope.

Defense in depth layers: perimeter, network segmentation, host hardening, application controls, data encryption, identity - each layer assumes the prior layer failed.

Zero Trust principles: verify explicitly, least privilege, assume breach; policy enforcement point (PEP) enforces decisions from the policy decision point (PDP).

Reference models: OSI 7-layer for network, and the shared responsibility model - cloud provider secures 'of the cloud', customer secures 'in the cloud'.

Security models: Bell-LaPadula (confidentiality: no read up, no write down), Biba (integrity: no read down, no write up), Clark-Wilson (integrity via well-formed transactions and separation of duty).

Cryptography: symmetric (AES) for bulk data, asymmetric (RSA/ECC) for key exchange and signatures, hashing (SHA-256) for integrity; TLS combines asymmetric handshake with symmetric session keys.

Segmentation architecture: DMZ for internet-facing services, internal zones for sensitive data, micro-segmentation for east-west traffic control; deny-by-default firewall policy.

High availability patterns: redundancy (N+1), failover clustering, load balancing; RTO/RPO drive backup and replication architecture choices.

Secure design principles: least privilege, separation of duties, fail-safe defaults, complete mediation, economy of mechanism, open design, psychological acceptability.

Change management: request → risk assessment → approval → test → implement → verify → document; emergency changes require retroactive approval and post-implementation review.

Patch management cadence: inventory → classify (critical/high/medium/low) → test → deploy → verify; critical patches often within 24–72h, others per policy.

Configuration baselines: CIS Benchmarks and STIGs define hardened settings; configuration drift detection compares live state to baseline.

IAM operations: enforce MFA, rotate credentials, use role-based access control (RBAC) and just-in-time elevation; disable stale accounts on a defined schedule.

Backup strategy: 3-2-1 rule (3 copies, 2 media, 1 offsite); test restores regularly - an untested backup is not a backup.

Logging and monitoring operations: centralize logs, synchronize time (NTP), retain per policy, protect log integrity with write-once storage or hashing.

Incident readiness in operations: maintain runbooks, contact lists, and out-of-band communication channels; conduct tabletop exercises.

Asset management: maintain a CMDB/inventory; unknown assets cannot be patched, monitored, or risk-assessed.

Incident response lifecycle (NIST SP 800-61): Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity.

Detection sources: SIEM correlation, EDR telemetry, IDS/IPS signatures, netflow anomalies, and threat-hunting hypotheses; tune to reduce false positives.

Indicator types: atomic (IP, hash), behavioral (TTPs), and computed (statistical); behavioral indicators are more durable against attacker evasion.

Containment options: isolate host, block IP/domain, disable account, segment network; choose based on blast radius vs. operational impact.

Evidence handling: maintain chain of custody, hash evidence at acquisition, preserve volatile data (memory, connections) before shutdown.

MTTD (mean time to detect) and MTTR (mean time to respond) are key metrics; track dwell time from initial compromise to detection.

Pyramid of Pain: TTPs > tools > network/host artifacts > domain names > IP addresses > hash values; higher tiers cost adversaries more to change.

Post-incident: root cause analysis, lessons learned, detection rule updates, and control improvements feed back into preparation.

Risk treatment options: mitigate, transfer (insurance), avoid, accept; residual risk = inherent risk after controls, and acceptance requires documented sign-off.

Risk register fields: asset, threat, vulnerability, likelihood, impact, inherent score, controls, residual score, owner, treatment.

Frameworks: NIST CSF (Identify, Protect, Detect, Respond, Recover, Govern), ISO/IEC 27001 (ISMS requirements), SOC 2 (trust services criteria), PCI DSS (cardholder data).

Control types: preventive, detective, corrective, compensating; categories: administrative, technical, physical.

Compliance vs. security: compliance is a minimum baseline, not proof of security posture; map controls to multiple frameworks to reduce audit duplication.

Policy hierarchy: policy (intent) → standard (mandatory requirements) → procedure (steps) → guideline (recommendations).

Third-party risk: vendor tiering by data sensitivity and access; require security questionnaires, contractual security clauses, and periodic reassessment.

Data classification drives handling: public, internal, confidential, restricted; retention schedules and legal hold requirements apply per classification.

CVSS v3.1 base score = f(Exploitability, Scope, Impact); exploitability = 8.22 × AttackVector × AttackComplexity × PrivilegesRequired × UserInteraction, and Impact uses Confidentiality × Integrity × Availability weights (0.56/0.22/0.56).

CVSS severity bands: 0.0 None, 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High, 9.0–10.0 Critical; a Scope change alters the Impact formula denominator.

EPSS gives the probability a CVE is exploited in the wild in the next 30 days (0–1); combine with CVSS to prioritize - high EPSS plus medium CVSS can outrank a high-CVSS/low-EPSS item.

CISA KEV listing is a binary signal of known exploitation; treat KEV membership as an overriding priority regardless of CVSS score.

Risk rating formula: Risk = Likelihood × Impact; likelihood inputs include threat actor capability, exposure, and exploit availability (weaponized vs. proof-of-concept).

Threat modeling with STRIDE maps threats to Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege; pair with DREAD or a likelihood/impact matrix for scoring.

Vulnerability scan types: authenticated (credentialed) scans find far more than unauthenticated; false positives are reduced by credentialed checks and manual validation.

ATT&CK is a behavioral knowledge base (Tactics → Techniques → Procedures); it describes adversary behavior, not vulnerabilities, and is used to map detection coverage.

Threat intelligence tiers: strategic (executive), operational (campaigns/TTPs), tactical (IOCs); TLP markings (RED/AMBER/GREEN/CLEAR) govern sharing scope.

Defense in depth layers: perimeter, network segmentation, host hardening, application controls, data encryption, identity - each layer assumes the prior layer failed.

Zero Trust principles: verify explicitly, least privilege, assume breach; policy enforcement point (PEP) enforces decisions from the policy decision point (PDP).

Reference models: OSI 7-layer for network, and the shared responsibility model - cloud provider secures 'of the cloud', customer secures 'in the cloud'.

Security models: Bell-LaPadula (confidentiality: no read up, no write down), Biba (integrity: no read down, no write up), Clark-Wilson (integrity via well-formed transactions and separation of duty).

Cryptography: symmetric (AES) for bulk data, asymmetric (RSA/ECC) for key exchange and signatures, hashing (SHA-256) for integrity; TLS combines asymmetric handshake with symmetric session keys.

Segmentation architecture: DMZ for internet-facing services, internal zones for sensitive data, micro-segmentation for east-west traffic control; deny-by-default firewall policy.

High availability patterns: redundancy (N+1), failover clustering, load balancing; RTO/RPO drive backup and replication architecture choices.

Secure design principles: least privilege, separation of duties, fail-safe defaults, complete mediation, economy of mechanism, open design, psychological acceptability.

Change management: request → risk assessment → approval → test → implement → verify → document; emergency changes require retroactive approval and post-implementation review.

Patch management cadence: inventory → classify (critical/high/medium/low) → test → deploy → verify; critical patches often within 24–72h, others per policy.

Configuration baselines: CIS Benchmarks and STIGs define hardened settings; configuration drift detection compares live state to baseline.

IAM operations: enforce MFA, rotate credentials, use role-based access control (RBAC) and just-in-time elevation; disable stale accounts on a defined schedule.

Backup strategy: 3-2-1 rule (3 copies, 2 media, 1 offsite); test restores regularly - an untested backup is not a backup.

Logging and monitoring operations: centralize logs, synchronize time (NTP), retain per policy, protect log integrity with write-once storage or hashing.

Incident readiness in operations: maintain runbooks, contact lists, and out-of-band communication channels; conduct tabletop exercises.

Asset management: maintain a CMDB/inventory; unknown assets cannot be patched, monitored, or risk-assessed.

Incident response lifecycle (NIST SP 800-61): Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity.

Detection sources: SIEM correlation, EDR telemetry, IDS/IPS signatures, netflow anomalies, and threat-hunting hypotheses; tune to reduce false positives.

Indicator types: atomic (IP, hash), behavioral (TTPs), and computed (statistical); behavioral indicators are more durable against attacker evasion.

Containment options: isolate host, block IP/domain, disable account, segment network; choose based on blast radius vs. operational impact.

Evidence handling: maintain chain of custody, hash evidence at acquisition, preserve volatile data (memory, connections) before shutdown.

MTTD (mean time to detect) and MTTR (mean time to respond) are key metrics; track dwell time from initial compromise to detection.

Pyramid of Pain: TTPs > tools > network/host artifacts > domain names > IP addresses > hash values; higher tiers cost adversaries more to change.

Post-incident: root cause analysis, lessons learned, detection rule updates, and control improvements feed back into preparation.

Risk treatment options: mitigate, transfer (insurance), avoid, accept; residual risk = inherent risk after controls, and acceptance requires documented sign-off.

Risk register fields: asset, threat, vulnerability, likelihood, impact, inherent score, controls, residual score, owner, treatment.

Frameworks: NIST CSF (Identify, Protect, Detect, Respond, Recover, Govern), ISO/IEC 27001 (ISMS requirements), SOC 2 (trust services criteria), PCI DSS (cardholder data).

Control types: preventive, detective, corrective, compensating; categories: administrative, technical, physical.

Compliance vs. security: compliance is a minimum baseline, not proof of security posture; map controls to multiple frameworks to reduce audit duplication.

Policy hierarchy: policy (intent) → standard (mandatory requirements) → procedure (steps) → guideline (recommendations).

Third-party risk: vendor tiering by data sensitivity and access; require security questionnaires, contractual security clauses, and periodic reassessment.

Data classification drives handling: public, internal, confidential, restricted; retention schedules and legal hold requirements apply per classification.