ICDL Cyber Security (ICDL) cheat sheet

CIA triad: Confidentiality (only authorized access), Integrity (data unaltered and trustworthy), Availability (accessible when needed).

Authentication verifies identity; authorization determines what an authenticated entity may do; accounting/auditing logs actions.

Least privilege: grant only the minimum permissions necessary for a task, and only for the time required.

Defense in depth: multiple overlapping controls (physical, technical, administrative) so failure of one does not compromise the whole.

Risk = Threat × Vulnerability × Impact; risk treatment options are avoid, mitigate, transfer, accept.

Phishing, vishing (voice), smishing (SMS), and pharming (DNS redirection) are social-engineering attacks exploiting trust.

Non-repudiation uses digital signatures or audit logs to prevent denial of an action.

A vulnerability is a weakness; an exploit is the method or code that takes advantage of it; a threat is a potential cause of harm.

Virus: attaches to a host file and spreads when the file is executed; requires user action to propagate.

Worm: self-replicating and spreads across networks without a host file or user action.

Trojan: disguises itself as legitimate software; does not self-replicate but opens backdoors or downloads payloads.

Ransomware: encrypts files and demands payment; mitigations include offline backups, patching, and least privilege.

Spyware: covertly collects user activity or data; keyloggers are a subtype that record keystrokes.

Rootkit: hides malware and maintains privileged access at the OS or firmware level; often requires offline or specialized removal.

Adware: displays unwanted ads; may be bundled with free software and can include tracking components.

Botnet: network of compromised devices (bots) controlled by a command-and-control server, often used for DDoS or spam.

Firewall types: packet-filtering (headers only), stateful (tracks connections), application-layer/proxy (inspects payloads).

VPN creates an encrypted tunnel over an untrusted network; IPsec and TLS are common VPN protocols.

WPA2/WPA3 encrypt Wi-Fi traffic; WEP is deprecated and insecure; WPA3 uses SAE to resist offline dictionary attacks.

IDS detects and alerts; IPS detects and blocks; both may be network-based (NIDS/NIPS) or host-based (HIDS/HIPS).

DMZ is a segmented network for public-facing services, isolated from the internal LAN by firewalls.

NAT translates private IP addresses to a public address, hiding internal topology and conserving IPv4 addresses.

Port scanning (e.g., with Nmap) identifies open ports and services; it is a reconnaissance technique used by attackers and auditors.

DDoS overwhelms a target with traffic from many sources; mitigations include rate limiting, scrubbing centers, and CDNs.

HTTPS uses TLS to encrypt HTTP traffic; the padlock and valid certificate indicate an encrypted, authenticated connection.

Certificate validity: check the site name matches the certificate, the issuer is trusted, and the certificate is not expired.

URL inspection: hover over links to reveal the true destination; beware of look-alike domains (e.g., paypa1.com) and URL shorteners.

Cookies: session cookies maintain login state; persistent cookies store settings; third-party cookies enable cross-site tracking.

Private/incognito browsing prevents local history storage but does not hide traffic from ISPs or websites.

Pop-up blockers and script blockers reduce drive-by download and malvertising risk.

Browser updates patch known vulnerabilities; extensions should be installed only from official stores and reviewed for permissions.

Phishing sites often use HTTP (no padlock), mismatched domains, or urgent language; verify by navigating directly to the official site.

Email security: SPF, DKIM, and DMARC authenticate sender domains and reduce spoofing and phishing.

Digital signature provides authentication, integrity, and non-repudiation; it does not provide confidentiality.

Encryption provides confidentiality; symmetric (AES) is fast for bulk data, asymmetric (RSA, ECC) is used for key exchange and signatures.

End-to-end encryption (e.g., Signal protocol) means only sender and recipient can read messages; the service provider cannot.

SMIME and PGP are standards for encrypting and signing email.

Phishing indicators: mismatched sender display name and address, urgent requests, unexpected attachments, generic greetings, and links to unfamiliar domains.

Instant messaging risks include impersonation, malware-laden links, and oversharing; verify identities via a second channel for sensitive requests.

VoIP and video conferencing should use encrypted protocols (SRTP, TLS) and meeting passwords/waiting rooms to prevent eavesdropping and Zoombombing.

Data classification (public, internal, confidential, restricted) determines handling, storage, and sharing rules.

Backup strategy: 3-2-1 rule-3 copies, 2 different media, 1 offsite; test restores regularly.

Data at rest encryption (BitLocker, FileVault, VeraCrypt) protects stored data if a device is lost or stolen.

Data in transit encryption (TLS, VPN, SSH) protects data moving across networks.

Data minimization: collect and retain only necessary data; anonymization and pseudonymization reduce privacy risk.

Secure deletion: overwrite or crypto-erase storage; simple file deletion does not remove data from the disk.

Access controls: role-based access control (RBAC) and attribute-based access control (ABAC) enforce least privilege on data.

GDPR and similar regulations require breach notification, data subject rights, and lawful basis for processing personal data.