ICYB cheat sheet

CIA triad: Confidentiality (authorized disclosure only), Integrity (unauthorized modification prevented), Availability (timely reliable access); each attack maps to at least one leg.

Threat actor tiers: script kiddie (low skill, commodity tools), hacktivist (ideological motive), organized crime (financial, ransomware-as-a-service), nation-state (persistence, zero-days, long dwell time).

Malware classes by propagation and payload: virus (needs host file), worm (self-propagating over network), trojan (disguised, no self-replication), ransomware (encrypts or exfiltrates for extortion), rootkit (hides at kernel/user level).

Social engineering vectors: phishing (mass email), spear phishing (targeted), whaling (executives), vishing (voice), smishing (SMS), pretexting (fabricated scenario), baiting (physical media).

MITRE ATT&CK organizes adversary behavior into tactics (why: initial access, persistence, privilege escalation, exfiltration) and techniques (how); tactic order follows the attack lifecycle.

Kill chain phases in order: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives; defenders can break the chain at any phase.

Defense in depth layers: physical, network/perimeter, host/endpoint, application, data, identity, and human/process controls; no single control is assumed sufficient.

Threat intelligence tiers: strategic (executive risk trends), operational (campaign TTPs), tactical (IOC feeds such as IPs, hashes, domains); IOCs are perishable, TTPs are durable.

OSI layers and defenses: L3/4 firewalls filter IP/port; L7 next-gen firewalls and WAFs inspect application payloads; IDS detects and alerts, IPS detects and blocks inline.

Stateful vs stateless firewalls: stateful tracks connection table entries (SYN, ESTABLISHED) and permits return traffic implicitly; stateless evaluates each packet against ACLs alone.

DMZ design: internet-facing services (web, mail, VPN terminators) sit in a segmented zone with rules permitting inbound from internet and limited outbound to internal networks, never full internal access.

NAT/PAT translates private RFC 1918 addresses to public addresses; it conserves IPv4 space but is not a security control and does not replace firewalling.

VPN types: site-to-site IPsec (ESP tunnel mode, IKE for key exchange) and remote-access SSL/TLS VPN; IPsec provides confidentiality, integrity, and authentication of packets.

Segmentation and microsegmentation limit lateral movement; VLANs separate L2 broadcast domains, and inter-VLAN routing must pass through a policy enforcement point.

DDoS mitigation categories: volumetric (bandwidth floods, scrubbing centers, anycast), protocol (SYN flood, half-open connections), and application-layer (HTTP request floods, rate limiting, CAPTCHA).

802.1X port-based access control: supplicant authenticates to authenticator (switch/AP) via RADIUS; EAP methods (EAP-TLS certificate-based, PEAP/MSCHAPv2 password-based) determine strength.

AAA components: Authentication (verify identity), Authorization (grant permissions), Accounting (log activity); RADIUS and TACACS+ are common AAA protocols, TACACS+ encrypts the full payload and separates the functions.

Authentication factors: something you know (password/PIN), something you have (token, smartcard, phone), something you are (biometrics); MFA requires two or more distinct factor categories.

Access control models: DAC (owner discretion), MAC (labels and clearances, e.g., SELinux), RBAC (role-based), ABAC (attribute/policy-based); least privilege applies to all.

Password storage: salted, slow hashes (bcrypt, scrypt, Argon2, PBKDF2); fast hashes (MD5, SHA-1) and unsalted storage are unsuitable for credentials.

Session management: use Secure and HttpOnly cookie flags, rotate session IDs at login, enforce idle and absolute timeouts, and invalidate sessions on logout to prevent fixation and hijacking.

SSO and federation: SAML 2.0 (XML assertions, browser redirects), OAuth 2.0 (delegated authorization, not authentication), OIDC (identity layer atop OAuth 2.0 using ID tokens).

Kerberos: KDC issues TGT after authentication, then service tickets; ticket lifetimes and clock skew tolerance (typically 5 minutes) matter; golden ticket attacks forge TGTs via KRBTGT compromise.

Privileged access management: vault credentials, just-in-time elevation, session recording, and separation of admin accounts from daily-use accounts reduce standing privilege exposure.

EDR vs antivirus: signature AV matches known patterns; EDR records process, file, registry, and network telemetry, enabling behavioral detection, hunting, and response actions (isolate, kill, quarantine).

Host hardening baselines: disable unused services and ports, remove default accounts, apply CIS Benchmarks or DISA STIGs, enforce least-privilege service accounts, and enable host firewalls.

Patch management lifecycle: inventory, risk-based prioritization (CVSS plus exploitability and exposure), test, deploy in rings, verify, and track mean time to remediate.

Application allowlisting (deny-by-default) blocks unapproved executables; common on high-assurance endpoints and servers; needs a maintenance path for legitimate updates.

Full-disk encryption (BitLocker, LUKS, FileVault) protects data at rest against lost/stolen devices; TPM-backed key sealing binds the key to boot integrity measurements.

Windows defenses: Credential Guard (isolates LSA secrets via virtualization), LAPS (unique local admin passwords), AppLocker/WDAC, and Protected Users group restrictions.

Linux hardening: SELinux/AppArmor mandatory access control, sudo rules over shared root, SSH key auth with root login disabled, file permission auditing, and minimal installed packages.

Mobile and BYOD: MDM/MAM enforces encryption, screen lock, remote wipe, and containerization; jailbreak/root detection prevents compromised devices from accessing corporate data.

Symmetric ciphers (AES, ChaCha20) are fast and used for bulk data; asymmetric ciphers (RSA, ECC) solve key distribution and enable signatures; TLS combines both in a hybrid handshake.

AES modes: ECB is insecure (identical plaintext blocks yield identical ciphertext); CBC needs a random IV and is unauthenticated; GCM provides authenticated encryption (AEAD) and is preferred.

Hashing properties: one-way, fixed-length output, collision-resistant; SHA-256/SHA-3 are current, MD5 and SHA-1 are broken for collision resistance; hashes provide integrity, not confidentiality.

Digital signatures: sign a hash of the message with the sender's private key; receiver verifies with the public key, giving integrity, authentication, and non-repudiation.

PKI chain of trust: root CA (self-signed, offline) signs intermediate CAs, which issue leaf certificates; validation checks signature chain, validity dates, revocation (CRL/OCSP), and name match.

Data classification tiers (public, internal, confidential, restricted) drive handling, encryption, retention, and access rules; labeling must be enforceable, not advisory only.

Privacy principles (GDPR-style): lawfulness and purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability; data subject rights include access, erasure, and portability.

Data states: at rest (encryption, tokenization, masking), in transit (TLS, IPsec), in use (confidential computing, memory encryption); DLP monitors egress channels for classified content.

SOC tiers: Tier 1 triage and alert validation, Tier 2 investigation and containment, Tier 3 hunting and advanced analysis; escalation criteria must be defined in runbooks.

SIEM aggregates and correlates logs with detection rules; SOAR automates response playbooks; alert tuning reduces false positives that cause analyst fatigue.

Log source coverage: endpoint, network (firewall, proxy, DNS), identity (authentication events), cloud control plane, and application logs; missing identity or DNS logs blinds key detections.

Incident response phases (NIST SP 800-61): preparation; detection and analysis; containment, eradication, and recovery; post-incident activity (lessons learned).

Evidence handling: maintain chain of custody, capture volatile data first (memory, connections, processes), hash images, and use write blockers for disk acquisition.

Containment strategies: host isolation, account disablement, credential rotation, network ACL blocks, and DNS sinkholing; choose based on blast radius versus attacker warning tradeoff.

Key detection metrics: MTTD (mean time to detect) and MTTR (mean time to respond); dwell time measures how long an intruder remains undetected.

Forensic artifacts: Windows Event IDs (4624 logon, 4625 failed logon, 4688 process creation, 4720 account created), Sysmon telemetry, and Linux auth.log and auditd records.

Risk formula: risk = likelihood x impact; treatment options are mitigate, transfer (insurance), avoid, and accept; residual risk remains after controls are applied.

Qualitative vs quantitative assessment: qualitative uses scales and matrices; quantitative uses SLE (asset value x exposure factor), ALE (SLE x annualized rate of occurrence), and cost-benefit of controls.

Control categories: preventive, detective, corrective, deterrent, compensating; control types: administrative, technical, physical; frameworks map controls to requirements.

Common frameworks: NIST CSF (Identify, Protect, Detect, Respond, Recover, plus Govern), ISO/IEC 27001 (ISMS requirements, Annex A controls), CIS Controls, SOC 2 trust criteria.

Regulations to know: GDPR (EU personal data, breach notification within 72 hours), HIPAA (US health data), PCI DSS (cardholder data, applies to any entity handling card data), SOX (financial reporting controls).

Policy hierarchy: policy (management intent, mandatory), standard (specific requirements), procedure (step-by-step), guideline (recommended); policies need ownership, review cadence, and exception handling.

Third-party risk: vendor tiering by data sensitivity and access, due diligence questionnaires, contractual security clauses, right-to-audit, and continuous monitoring.

Business continuity: BIA identifies critical processes and dependencies; RTO is maximum tolerable downtime, RPO is maximum tolerable data loss; BCP and DR plans are tested on a schedule.

Secure design principles: least privilege, separation of duties, defense in depth, fail-safe defaults, complete mediation, open design (no security by obscurity), and minimize attack surface.

Threat modeling with STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege); data flow diagrams plus trust boundaries drive findings.

OWASP Top 10 categories include injection, broken access control, cryptographic failures, insecure design, security misconfiguration, and vulnerable components; parameterized queries stop SQL injection.

SDLC security gates: secure coding standards, SAST (white-box source scanning), DAST (black-box running app), SCA (dependency vulnerability scanning), and secrets scanning in CI/CD.

Cloud shared responsibility: provider secures the cloud (facilities, hypervisor, managed service internals); customer secures what is in the cloud (identity, data, configuration, patching of IaaS guests).

Cloud identity is the primary control plane: enforce least-privilege IAM policies, avoid long-lived access keys (prefer roles and federation), enable MFA on root/administrative accounts, and monitor for privilege escalation paths.

Storage misconfiguration is a recurring exposure: block public bucket/container access by default, enforce encryption at rest and in transit, and use policy-as-code (SCP, Azure Policy) to prevent drift.

Container and IaC security: scan images for CVEs, run as non-root with read-only filesystems, sign images, and scan Terraform/CloudFormation for misconfigurations before deployment.

Zero trust: no implicit trust from network location; every request is authenticated and authorized per session using identity, device posture, and policy (never trust, always verify).