IBM Cybersecurity Analyst cheat sheet

CIA triad: Confidentiality (authorized disclosure only), Integrity (unauthorized modification prevented), Availability (timely, reliable access); most controls map to at least one leg.

Threat vs. vulnerability vs. risk: threat = actor or event with potential to cause harm; vulnerability = weakness; risk = likelihood × impact of a threat exploiting a vulnerability.

Defense in depth layers preventive, detective, and corrective controls so no single failure grants full compromise; assume-breach design treats perimeter loss as inevitable.

Malware taxonomy: virus needs a host and user action; worm self-propagates over networks; trojan disguises as legitimate; ransomware encrypts or exfiltrates for extortion; rootkit hides at kernel/firmware level.

Social engineering exploits authority, urgency, and familiarity; phishing (email), vishing (voice), smishing (SMS), and pretexting differ by channel, not by goal.

MITRE ATT&CK organizes adversary behavior into tactics (the why) and techniques (the how); PRE-ATT&CK/reconnaissance sits earliest in the kill chain.

Cyber Kill Chain order: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives; defenders can break the chain at any link.

Threat actor tiers: script kiddies (low skill, commodity tools), hacktivists (ideology), organized crime (financial), nation-state/APT (persistence, zero-days, long dwell time).

Indicator of compromise examples: unusual outbound beaconing, new admin accounts, hash mismatches, anomalous login geography; indicators of attack focus on intent and behavior rather than artifacts.

OSI mapping for controls: TLS at layers 5-6, TCP/UDP at layer 4, IPsec at layer 3, MAC filtering and ARP inspection at layer 2.

Stateful firewall tracks connection state and permits return traffic; stateless ACLs must explicitly allow both directions and are evaluated top-down until first match.

Next-generation firewall adds application identification, user identity, and TLS inspection; a WAF protects HTTP(S) applications rather than the network perimeter.

IDS is passive and alerts; IPS is inline and can drop. Signature detection matches known patterns; anomaly detection baselines normal behavior and flags deviation.

DMZ (screened subnet) hosts internet-facing services between two firewall boundaries so a compromised public server does not directly reach the internal LAN.

IPsec: AH provides integrity/authentication only; ESP provides confidentiality plus integrity. IKE negotiates SAs; tunnel mode encapsulates whole packets, transport mode payload only.

802.1X port-based access control uses supplicant, authenticator (switch), and authentication server (RADIUS); EAP variants carry the credential exchange.

Network segmentation and microsegmentation limit lateral movement; VLANs are logical separation, not a security boundary without ACLs or firewalls between them.

DNS security: DNSSEC signs records for integrity, not confidentiality; DNS tunneling and fast-flux are common exfiltration and resilience techniques to detect.

EDR collects process, file, registry, and network telemetry, enabling detection, hunting, and response (isolate host, kill process, quarantine file) beyond signature AV.

Application allowlisting (default-deny) blocks unapproved executables; it is stronger against unknown malware than blocklisting but requires maintenance of the approved set.

Patch management cycle: inventory, risk-rank, test, deploy, verify; mean time to remediate is a key operational metric.

Least privilege on endpoints: remove local admin rights, use just-in-time elevation, and separate administrative accounts from daily-use accounts.

CIS Benchmarks and DISA STIGs provide concrete hardening settings: disable SMBv1, enforce SMB signing, restrict LLMNR/NBT-NS, disable unused services and default accounts.

Full-disk encryption (BitLocker, LUKS, FileVault) protects data at rest; TPM-bound keys with measured boot defend against offline tampering.

Host firewall plus endpoint antivirus/EDR are complementary: firewall controls reachability, EDR controls behavior; neither substitutes for the other.

Windows credential protections: Credential Guard isolates LSASS secrets; disabling cached domain logons reduces offline credential theft; LAPS randomizes local admin passwords.

Logging baseline: enable process creation with command line, PowerShell script block logging, and audit policy for account and object access to feed SIEM detection.

CVSS base score components: attack vector, attack complexity, privileges required, user interaction, scope, and the CIA impact triad; temporal and environmental scores modify the base.

CVSS qualitative bands: 0.0 none, 0.1-3.9 low, 4.0-6.9 medium, 7.0-8.9 high, 9.0-10.0 critical.

CVE identifies a specific vulnerability; CWE classifies the weakness type; NVD enriches CVEs with CVSS and product mappings; EPSS estimates exploitation probability.

Scan types: unauthenticated (external attacker view) vs. credentialed (deeper, fewer false positives); active scanning sends probes, passive scanning observes traffic.

False positive = reported but not present; false negative = present but not reported. Tuning must balance both; credentialed scans reduce false positives substantially.

Risk-based prioritization combines severity, exploitability (EPSS, known exploited vulnerabilities catalog), asset criticality, and exposure, not CVSS alone.

Remediation options in order of preference: patch/upgrade, configuration change or compensating control, isolation/segmentation, and documented risk acceptance.

Scanning cadence and scope: define asset inventory first, schedule recurring scans, rescan to verify closure, and track SLA by severity tier.

Common web findings and fixes: SQL injection (parameterized queries), XSS (output encoding plus CSP), IDOR (server-side authorization checks), misconfiguration (baseline hardening).

NIST IR lifecycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity (lessons learned).

Order of volatility: CPU registers/cache, RAM and network state, running processes, temp files, disk, remote logs, archival backups; collect most volatile first.

Chain of custody documents who handled evidence, when, and why; use write blockers and hash evidence (SHA-256) at acquisition and again at analysis.

Forensic soundness: work on images, not originals; document tool versions; maintain hashes to prove integrity in legal or disciplinary proceedings.

Windows artifacts: event logs (Security, System, Application), prefetch, shimcache/Amcache, MFT, USN journal, registry hives, and $LOGFILE for timeline reconstruction.

Linux artifacts: /var/log/auth.log and secure, wtmp/btmp, bash history, cron entries, systemd journal, and file timestamps (atime, mtime, ctime, btime).

Memory forensics reveals injected code, encryption keys, network connections, and process hollowing that disk analysis can miss.

Containment strategies: isolate host from network (not power off, to preserve memory), block indicators at perimeter, disable compromised accounts, rotate credentials.

Eradication vs. recovery: remove root cause and persistence, then restore from known-good backups, validate integrity, and monitor for re-entry before declaring closure.

SIEM pipeline: log collection/parsing, normalization, correlation rules, alerting, dashboards, and retention; log sources include endpoints, network devices, identity, and cloud.

SOC tiers: Tier 1 triage and escalation, Tier 2 investigation and containment, Tier 3 hunting and advanced response; detection engineering supports all tiers.

Alert triage decision: true positive (escalate), false positive (tune rule), benign true positive (document and close); track false positive rate to control analyst fatigue.

Key metrics: MTTD (mean time to detect), MTTA (acknowledge), MTTR (respond/remediate), alert volume per analyst, and percentage of alerts auto-closed.

Log retention and time sync: NTP-synchronized clocks across sources are required for reliable correlation; mismatched timestamps break timelines.

Use cases to build: impossible travel, brute-force followed by success, privilege escalation, mass file encryption, unusual outbound data volume, disabled logging.

SOAR automates enrichment and repetitive response steps (lookup, ticket creation, block); playbooks must include human approval for destructive actions.

Baseline and anomaly: user and entity behavior analytics (UEBA) flags deviations from peer or historical norms; requires a learning period and tuning.

Threat intelligence feeds (STIX/TAXII) enrich detections with IOCs; low-fidelity feeds create noise, so score feeds by relevance and freshness.

AAA: authentication proves identity, authorization grants permissions, accounting records activity; each must be implemented and logged separately.

Access control models: DAC (owner discretion), MAC (labels/clearances), RBAC (role-based, most common in enterprises), ABAC (attribute/policy-based, context-aware).

Authentication factors: something you know, have, are; MFA requires two or more distinct factor types; two passwords are not MFA.

Password storage: salted, slow hashes (bcrypt, scrypt, Argon2, PBKDF2); never reversible encryption; NIST guidance favors length and breach checks over forced rotation.

Kerberos: TGT from the KDC, then service tickets; Kerberoasting requests service tickets to crack offline, so service account passwords must be long and rotated.

SSO and federation: SAML and OIDC issue assertions/tokens after IdP authentication; OAuth 2.0 is authorization delegation, not authentication by itself.

Privileged access management: vault credentials, session recording, just-in-time elevation, and periodic recertification of privileged entitlements.

Data classification (public, internal, confidential, restricted) drives handling, encryption, and retention rules; DLP enforces policy at endpoint, network, and cloud.

Data states: at rest (encryption, key management), in transit (TLS, IPsec), in use (confidential computing, memory protections); tokenization and masking reduce exposure scope.

Shared responsibility: provider secures the cloud (physical, hypervisor, managed service internals); customer secures in the cloud (identity, configuration, data, workloads).

Identity is the primary cloud perimeter: enforce least privilege, avoid long-lived access keys, use roles and federation, and enable MFA on all privileged identities.

Common cloud misconfigurations: public storage buckets, overly permissive security groups, unencrypted volumes, disabled logging, wildcard IAM policies.

CSPM continuously checks configuration against benchmarks; CWPP protects workloads; CASB mediates SaaS usage; the three are complementary, not interchangeable.

OWASP Top 10 themes: broken access control, cryptographic failures, injection, insecure design, misconfiguration, vulnerable components, identification/authentication failures.

Secure SDLC: threat modeling early, SAST on source, DAST on running apps, SCA for dependencies, secrets scanning, and security gates in CI/CD.

Defense against injection: parameterized queries and input validation; against XSS: output encoding and Content Security Policy; against CSRF: anti-CSRF tokens and SameSite cookies.

Container and IaC security: scan images for CVEs, run non-root and minimal base images, sign artifacts, and scan Terraform/CloudFormation before deployment.

API security: authenticate every call, enforce object-level authorization, rate-limit, validate schemas, and inventory shadow and deprecated endpoints.

Risk treatment options: mitigate (controls), transfer (insurance, contract), avoid (stop activity), accept (documented sign-off by accountable owner).

Qualitative risk = likelihood × impact on a defined scale; quantitative uses SLE = asset value × exposure factor, ALE = SLE × annualized rate of occurrence.

Frameworks: NIST CSF (identify, protect, detect, respond, recover), ISO/IEC 27001 (certifiable ISMS), NIST 800-53 (control catalog), CIS Controls (prioritized safeguards).

Policy hierarchy: policy (intent, mandatory) → standard (specific requirements) → procedure (steps) → guideline (recommendation); policies require management approval and review cycles.

Compliance evidence: audit logs, access reviews, training records, vulnerability reports, and incident records; compliance does not equal security, it is a baseline.

Privacy and data protection: GDPR lawful basis, data subject rights, breach notification timelines; HIPAA protects PHI; PCI DSS applies to cardholder data environments.

Segregation of duties and least privilege are detective and preventive controls against fraud; compensating controls may substitute when separation is impractical.

Ethics for analysts: act within authorized scope, protect confidentiality, report findings honestly, avoid conflicts of interest, and disclose vulnerabilities responsibly.

Business continuity vs. disaster recovery: BCP keeps the business operating; DR restores IT. RTO is maximum tolerable downtime; RPO is maximum tolerable data loss.

CIA triad: Confidentiality (authorized disclosure only), Integrity (unauthorized modification prevented), Availability (timely, reliable access); most controls map to at least one leg.

Threat vs. vulnerability vs. risk: threat = actor or event with potential to cause harm; vulnerability = weakness; risk = likelihood × impact of a threat exploiting a vulnerability.

Defense in depth layers preventive, detective, and corrective controls so no single failure grants full compromise; assume-breach design treats perimeter loss as inevitable.

Malware taxonomy: virus needs a host and user action; worm self-propagates over networks; trojan disguises as legitimate; ransomware encrypts or exfiltrates for extortion; rootkit hides at kernel/firmware level.

Social engineering exploits authority, urgency, and familiarity; phishing (email), vishing (voice), smishing (SMS), and pretexting differ by channel, not by goal.

MITRE ATT&CK organizes adversary behavior into tactics (the why) and techniques (the how); PRE-ATT&CK/reconnaissance sits earliest in the kill chain.

Cyber Kill Chain order: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives; defenders can break the chain at any link.

Threat actor tiers: script kiddies (low skill, commodity tools), hacktivists (ideology), organized crime (financial), nation-state/APT (persistence, zero-days, long dwell time).

Indicator of compromise examples: unusual outbound beaconing, new admin accounts, hash mismatches, anomalous login geography; indicators of attack focus on intent and behavior rather than artifacts.

OSI mapping for controls: TLS at layers 5-6, TCP/UDP at layer 4, IPsec at layer 3, MAC filtering and ARP inspection at layer 2.

Stateful firewall tracks connection state and permits return traffic; stateless ACLs must explicitly allow both directions and are evaluated top-down until first match.

Next-generation firewall adds application identification, user identity, and TLS inspection; a WAF protects HTTP(S) applications rather than the network perimeter.

IDS is passive and alerts; IPS is inline and can drop. Signature detection matches known patterns; anomaly detection baselines normal behavior and flags deviation.

DMZ (screened subnet) hosts internet-facing services between two firewall boundaries so a compromised public server does not directly reach the internal LAN.

IPsec: AH provides integrity/authentication only; ESP provides confidentiality plus integrity. IKE negotiates SAs; tunnel mode encapsulates whole packets, transport mode payload only.

802.1X port-based access control uses supplicant, authenticator (switch), and authentication server (RADIUS); EAP variants carry the credential exchange.

Network segmentation and microsegmentation limit lateral movement; VLANs are logical separation, not a security boundary without ACLs or firewalls between them.

DNS security: DNSSEC signs records for integrity, not confidentiality; DNS tunneling and fast-flux are common exfiltration and resilience techniques to detect.

EDR collects process, file, registry, and network telemetry, enabling detection, hunting, and response (isolate host, kill process, quarantine file) beyond signature AV.

Application allowlisting (default-deny) blocks unapproved executables; it is stronger against unknown malware than blocklisting but requires maintenance of the approved set.

Patch management cycle: inventory, risk-rank, test, deploy, verify; mean time to remediate is a key operational metric.

Least privilege on endpoints: remove local admin rights, use just-in-time elevation, and separate administrative accounts from daily-use accounts.

CIS Benchmarks and DISA STIGs provide concrete hardening settings: disable SMBv1, enforce SMB signing, restrict LLMNR/NBT-NS, disable unused services and default accounts.

Full-disk encryption (BitLocker, LUKS, FileVault) protects data at rest; TPM-bound keys with measured boot defend against offline tampering.

Host firewall plus endpoint antivirus/EDR are complementary: firewall controls reachability, EDR controls behavior; neither substitutes for the other.

Windows credential protections: Credential Guard isolates LSASS secrets; disabling cached domain logons reduces offline credential theft; LAPS randomizes local admin passwords.

Logging baseline: enable process creation with command line, PowerShell script block logging, and audit policy for account and object access to feed SIEM detection.

CVSS base score components: attack vector, attack complexity, privileges required, user interaction, scope, and the CIA impact triad; temporal and environmental scores modify the base.

CVSS qualitative bands: 0.0 none, 0.1-3.9 low, 4.0-6.9 medium, 7.0-8.9 high, 9.0-10.0 critical.

CVE identifies a specific vulnerability; CWE classifies the weakness type; NVD enriches CVEs with CVSS and product mappings; EPSS estimates exploitation probability.

Scan types: unauthenticated (external attacker view) vs. credentialed (deeper, fewer false positives); active scanning sends probes, passive scanning observes traffic.

False positive = reported but not present; false negative = present but not reported. Tuning must balance both; credentialed scans reduce false positives substantially.

Risk-based prioritization combines severity, exploitability (EPSS, known exploited vulnerabilities catalog), asset criticality, and exposure, not CVSS alone.

Remediation options in order of preference: patch/upgrade, configuration change or compensating control, isolation/segmentation, and documented risk acceptance.

Scanning cadence and scope: define asset inventory first, schedule recurring scans, rescan to verify closure, and track SLA by severity tier.

Common web findings and fixes: SQL injection (parameterized queries), XSS (output encoding plus CSP), IDOR (server-side authorization checks), misconfiguration (baseline hardening).

NIST IR lifecycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity (lessons learned).

Order of volatility: CPU registers/cache, RAM and network state, running processes, temp files, disk, remote logs, archival backups; collect most volatile first.

Chain of custody documents who handled evidence, when, and why; use write blockers and hash evidence (SHA-256) at acquisition and again at analysis.

Forensic soundness: work on images, not originals; document tool versions; maintain hashes to prove integrity in legal or disciplinary proceedings.

Windows artifacts: event logs (Security, System, Application), prefetch, shimcache/Amcache, MFT, USN journal, registry hives, and $LOGFILE for timeline reconstruction.

Linux artifacts: /var/log/auth.log and secure, wtmp/btmp, bash history, cron entries, systemd journal, and file timestamps (atime, mtime, ctime, btime).

Memory forensics reveals injected code, encryption keys, network connections, and process hollowing that disk analysis can miss.

Containment strategies: isolate host from network (not power off, to preserve memory), block indicators at perimeter, disable compromised accounts, rotate credentials.

Eradication vs. recovery: remove root cause and persistence, then restore from known-good backups, validate integrity, and monitor for re-entry before declaring closure.

SIEM pipeline: log collection/parsing, normalization, correlation rules, alerting, dashboards, and retention; log sources include endpoints, network devices, identity, and cloud.

SOC tiers: Tier 1 triage and escalation, Tier 2 investigation and containment, Tier 3 hunting and advanced response; detection engineering supports all tiers.

Alert triage decision: true positive (escalate), false positive (tune rule), benign true positive (document and close); track false positive rate to control analyst fatigue.

Key metrics: MTTD (mean time to detect), MTTA (acknowledge), MTTR (respond/remediate), alert volume per analyst, and percentage of alerts auto-closed.

Log retention and time sync: NTP-synchronized clocks across sources are required for reliable correlation; mismatched timestamps break timelines.

Use cases to build: impossible travel, brute-force followed by success, privilege escalation, mass file encryption, unusual outbound data volume, disabled logging.

SOAR automates enrichment and repetitive response steps (lookup, ticket creation, block); playbooks must include human approval for destructive actions.

Baseline and anomaly: user and entity behavior analytics (UEBA) flags deviations from peer or historical norms; requires a learning period and tuning.

Threat intelligence feeds (STIX/TAXII) enrich detections with IOCs; low-fidelity feeds create noise, so score feeds by relevance and freshness.

AAA: authentication proves identity, authorization grants permissions, accounting records activity; each must be implemented and logged separately.

Access control models: DAC (owner discretion), MAC (labels/clearances), RBAC (role-based, most common in enterprises), ABAC (attribute/policy-based, context-aware).

Authentication factors: something you know, have, are; MFA requires two or more distinct factor types; two passwords are not MFA.

Password storage: salted, slow hashes (bcrypt, scrypt, Argon2, PBKDF2); never reversible encryption; NIST guidance favors length and breach checks over forced rotation.

Kerberos: TGT from the KDC, then service tickets; Kerberoasting requests service tickets to crack offline, so service account passwords must be long and rotated.

SSO and federation: SAML and OIDC issue assertions/tokens after IdP authentication; OAuth 2.0 is authorization delegation, not authentication by itself.

Privileged access management: vault credentials, session recording, just-in-time elevation, and periodic recertification of privileged entitlements.

Data classification (public, internal, confidential, restricted) drives handling, encryption, and retention rules; DLP enforces policy at endpoint, network, and cloud.

Data states: at rest (encryption, key management), in transit (TLS, IPsec), in use (confidential computing, memory protections); tokenization and masking reduce exposure scope.

Shared responsibility: provider secures the cloud (physical, hypervisor, managed service internals); customer secures in the cloud (identity, configuration, data, workloads).

Identity is the primary cloud perimeter: enforce least privilege, avoid long-lived access keys, use roles and federation, and enable MFA on all privileged identities.

Common cloud misconfigurations: public storage buckets, overly permissive security groups, unencrypted volumes, disabled logging, wildcard IAM policies.

CSPM continuously checks configuration against benchmarks; CWPP protects workloads; CASB mediates SaaS usage; the three are complementary, not interchangeable.

OWASP Top 10 themes: broken access control, cryptographic failures, injection, insecure design, misconfiguration, vulnerable components, identification/authentication failures.

Secure SDLC: threat modeling early, SAST on source, DAST on running apps, SCA for dependencies, secrets scanning, and security gates in CI/CD.

Defense against injection: parameterized queries and input validation; against XSS: output encoding and Content Security Policy; against CSRF: anti-CSRF tokens and SameSite cookies.

Container and IaC security: scan images for CVEs, run non-root and minimal base images, sign artifacts, and scan Terraform/CloudFormation before deployment.

API security: authenticate every call, enforce object-level authorization, rate-limit, validate schemas, and inventory shadow and deprecated endpoints.

Risk treatment options: mitigate (controls), transfer (insurance, contract), avoid (stop activity), accept (documented sign-off by accountable owner).

Qualitative risk = likelihood × impact on a defined scale; quantitative uses SLE = asset value × exposure factor, ALE = SLE × annualized rate of occurrence.

Frameworks: NIST CSF (identify, protect, detect, respond, recover), ISO/IEC 27001 (certifiable ISMS), NIST 800-53 (control catalog), CIS Controls (prioritized safeguards).

Policy hierarchy: policy (intent, mandatory) → standard (specific requirements) → procedure (steps) → guideline (recommendation); policies require management approval and review cycles.

Compliance evidence: audit logs, access reviews, training records, vulnerability reports, and incident records; compliance does not equal security, it is a baseline.

Privacy and data protection: GDPR lawful basis, data subject rights, breach notification timelines; HIPAA protects PHI; PCI DSS applies to cardholder data environments.

Segregation of duties and least privilege are detective and preventive controls against fraud; compensating controls may substitute when separation is impractical.

Ethics for analysts: act within authorized scope, protect confidentiality, report findings honestly, avoid conflicts of interest, and disclose vulnerabilities responsibly.

Business continuity vs. disaster recovery: BCP keeps the business operating; DR restores IT. RTO is maximum tolerable downtime; RPO is maximum tolerable data loss.