ICDL IT Security cheat sheet

Confidentiality, integrity and availability (the CIA triad) are the three core properties that security controls are designed to protect.

A vulnerability is a weakness; a threat is a potential cause of harm; a risk is the likelihood that a threat exploits a vulnerability and the resulting impact.

Authentication verifies identity; authorisation determines what an authenticated identity is permitted to do; accountability links actions to an identity via logging.

Defence in depth layers independent controls so that failure of one layer does not expose the whole system.

Least privilege means each user or process receives only the permissions required for its task, for the shortest time needed.

A business continuity plan maintains critical operations during disruption; a disaster recovery plan restores systems afterwards, usually measured by RTO and RPO.

Social engineering targets people rather than technology, so technical controls alone cannot fully mitigate it.

Non-repudiation uses digital signatures or audit trails so a party cannot credibly deny having performed an action.

A virus attaches to a host file and needs user action to spread; a worm self-replicates across networks without a host file.

A trojan disguises itself as legitimate software and does not self-replicate; a backdoor grants remote access to an attacker.

Ransomware encrypts or locks data and demands payment; reliable offline backups are the primary recovery control.

Spyware covertly collects user activity; keyloggers record keystrokes and can be hardware or software.

Phishing is bulk fraudulent email; spear phishing is targeted at a specific person; whaling targets senior executives.

A rootkit hides malicious components at a privileged level, so detection often requires offline or boot-time scanning.

A logic bomb triggers malicious behaviour when a defined condition or date occurs.

Zero-day threats exploit vulnerabilities before a patch exists, so behaviour-based detection is more effective than signature matching.

A firewall filters traffic by rules on address, port and protocol; a stateful firewall also tracks connection state.

HTTPS uses TLS to provide encryption, integrity and server authentication for web traffic, shown by the padlock and certificate.

A VPN creates an encrypted tunnel over an untrusted network, protecting data in transit but not the security of the endpoints.

WPA2 or WPA3 should be used for Wi-Fi; WEP is broken and provides no meaningful protection.

A public IP address identifies a network on the internet; private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are not routed on the internet and rely on NAT.

Pharming redirects users to fraudulent sites via DNS manipulation or hosts-file modification, without needing a deceptive link.

A man-in-the-middle attack intercepts traffic between two parties; certificate validation and encrypted channels are the main countermeasures.

Port scanning probes which services a host exposes; closing unused ports reduces the attack surface.

Something you know, something you have and something you are: multi-factor authentication combines at least two different categories.

Access control models: discretionary (owner grants access), mandatory (system-wide labels, e.g. military clearance) and role-based (permissions assigned to job roles).

Password hashing should use a salted, slow algorithm; plain or fast unsalted hashes are unsuitable for stored credentials.

Encryption at rest protects stored data if media is lost or stolen; encryption in transit protects data on the network.

Data minimisation means collecting and retaining only the personal data necessary for the stated purpose.

A data controller determines the purpose of processing; a data processor acts on the controller's instructions.

A personal data breach generally must be reported to the supervisory authority within 72 hours of becoming aware, where it is likely to result in a risk to individuals.

Regular, tested backups following the 3-2-1 pattern (three copies, two media, one offsite) mitigate data loss from ransomware or hardware failure.

A URL is safer to assess than link text: check the exact domain immediately before the first single slash and look for look-alike spellings.

Unsolicited messages requesting credentials, payment or urgency are treated as suspicious regardless of apparent sender, since sender addresses can be spoofed.

Software should be installed from official sources or verified repositories; pirated software is a common malware vector.

Public Wi-Fi is untrusted; use HTTPS and a VPN rather than assuming the network is safe.

Lock the screen when leaving a device, and enable automatic locking after a short idle period.

Personal and work data should be kept separate; storing work files in personal cloud accounts breaches organisational policy.

When in doubt, verify a request through a separate, known channel before acting on it.

Digital footprint: information posted online is persistent and may be copied, so privacy settings and content choices matter.