SNAP cheat sheet

OSI layers map to controls: Layer 2 = MAC filtering and port security; Layer 3 = ACLs and routing policy; Layer 4 = stateful firewalls and port filtering; Layer 7 = proxies, WAFs, and content inspection.

TCP three-way handshake is SYN, SYN-ACK, ACK; a half-open flood of SYNs without completing the handshake is the signature of a SYN flood, mitigated by SYN cookies and rate limiting.

Private ranges per RFC 1918 are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16; they are non-routable on the public internet and require NAT for egress.

A stateful firewall tracks connection state in a session table; a stateless ACL evaluates each packet independently and cannot distinguish a solicited reply from an unsolicited inbound packet.

IPsec ESP provides confidentiality plus integrity and authentication; AH provides integrity and authentication only, with no encryption, so AH alone does not hide payload contents.

TLS handshake establishes a shared session key via asymmetric cryptography, then bulk data is encrypted symmetrically; certificate validation confirms server identity and chains to a trusted root CA.

VLANs segment a switched network at Layer 2; traffic between VLANs requires a Layer 3 device, so VLAN design is the primary control for limiting broadcast domains and lateral movement.

DMZ topology places externally reachable services on a segment isolated from the internal LAN by two firewall boundaries, so compromise of a public host does not directly expose internal systems.

Symantec Endpoint Protection Manager (SEPM) is the central management console and policy repository; clients check in over HTTPS and receive policy, content, and command updates.

Symantec Endpoint Protection client installs with a communication mode: push mode (server initiates), pull mode (client polls on a schedule), or mixed mode; pull mode suits clients behind NAT or intermittent links.

Group structure in SEPM determines policy inheritance: a client inherits the policy of its group unless an explicit policy is assigned, so group design is the primary lever for scoped enforcement.

Symantec Endpoint Protection combines antivirus, intrusion prevention (network threat protection), firewall, and application control in one agent; each component has its own independent policy object.

LiveUpdate retrieves virus definitions and engine content; SEPM hosts a Group Update Provider (GUP) so one client can distribute content to peers and reduce WAN load.

Symantec Protection Center / integrated reporting consolidates events from endpoints, mail, and gateway products; log data flows to a central collector for correlation rather than staying on the endpoint.

Symantec Endpoint Encryption and Symantec Data Loss Prevention are separate product lines from SEP; encryption covers full-disk and removable media, DLP inspects content against policy for data in motion and at rest.

Symantec Cloud SWG (formerly Web Security Service) is the cloud proxy for web traffic; policy is enforced in the cloud, so roaming clients receive the same web filtering as on-premises users without backhaul.

Malware categories by behavior: virus needs a host file and user action, worm self-propagates over networks, trojan disguises as legitimate software, rootkit hides its own presence, ransomware denies access until payment.

Static analysis inspects a sample without executing it (strings, headers, imports, hashes); dynamic analysis executes it in a sandbox and observes file, registry, process, and network behavior.

A cryptographic hash (SHA-256) identifies a known sample; a fuzzy or import hash (imphash) clusters variants that share code structure but differ byte-for-byte.

Indicators of compromise include file hashes, C2 domains and IPs, URI patterns, registry keys, mutex names, and user-agent strings; these are atomic and decay quickly as attackers rotate infrastructure.

MITRE ATT&CK organizes adversary behavior into tactics (the goal) and techniques (the method), for example T1566 Phishing under Initial Access and T1055 Process Injection under Defense Evasion.

Polymorphic malware changes its code on each infection while keeping behavior constant; metamorphic malware rewrites its own code structure, so signature matching alone is insufficient and behavior rules are needed.

A botnet's infected hosts beacon to command-and-control infrastructure; detection focuses on periodic outbound connections, DNS tunneling patterns, and domain-generation-algorithm (DGA) lookups.

Ransomware playbook order: isolate the host, preserve volatile evidence, identify the strain and encryption scope, restore from known-good offline backup, then remediate the initial access vector.

Signature-based detection matches known malicious code; heuristic and SONAR-style behavior detection flags suspicious action sequences, which is why both are enabled together for defense in depth.

Quarantine moves a detected file to a protected location and denies execution; it is reversible, unlike deletion, so quarantine is preferred for suspected false positives.

Exclusions in SEPM (file, folder, process, and threat-name exclusions) reduce scan overhead but create blind spots; every exclusion is a documented risk acceptance.

Tamper protection prevents local users and non-admin processes from stopping the SEP service, disabling the firewall, or altering policy, closing the common attacker step of disabling AV.

Application and Device Control policies restrict which executables run and which devices (USB, CD) mount; device control is the primary technical control against removable-media data exfiltration.

Client deployment options include push from SEPM, remote push via a deployment package, and third-party distribution; a client that never checks in shows as offline and holds stale content.

Content and engine updates follow a staged rollout; a Group Update Provider reduces bandwidth, and clients behind a proxy need explicit proxy settings in the communication policy.

Endpoint hardening baseline: patch OS and applications, disable unused services, enforce least privilege, enable host firewall, and log security events to a central collector.

802.1X roles: supplicant (client), authenticator (switch or wireless AP), and authentication server (RADIUS); EAP carries the authentication exchange between supplicant and server.

EAP methods differ in strength: EAP-TLS uses mutual certificates, PEAP and EAP-TTLS use a server certificate plus inner credential, and EAP-MD5 provides no server authentication and is deprecated.

NAC decision flow: authenticate the device or user, posture-check it (patch level, AV running, definitions current), then place it in a role VLAN or apply a downloadable ACL.

MAC authentication bypass (MAB) authenticates devices that cannot run a supplicant, but MAC addresses are spoofable, so MAB is a fallback, not a primary control.

Remediation VLANs give non-compliant hosts limited access to update servers only; the host is re-checked and moved to the production VLAN after it passes posture.

802.1X port states: unauthorized (only EAP traffic permitted), authenticated (full access per policy), and the port can be forced unauthorized on authentication failure.

Policy enforcement points include switch ports, wireless controllers, VPN concentrators, and proxies; enforcement is only as strong as the identity source behind it (AD, LDAP, RADIUS).

RADIUS attributes returned in Access-Accept (Tunnel-Type, Tunnel-Private-Group-ID, Filter-Id) drive VLAN assignment and ACL application, so server-side attribute policy defines actual access.

Incident response phases in order: preparation, identification, containment, eradication, recovery, and lessons learned; containment precedes eradication so spread is stopped before cleanup.

SIEM correlation normalizes logs from firewalls, endpoints, and directory services; a correlation rule fires when multiple events match a condition within a time window.

Windows event IDs worth memorizing: 4624 logon success, 4625 logon failure, 4634 logoff, 4672 special privileges assigned, 4720 user account created, 4769 Kerberos service ticket requested.

Log retention and integrity: centralize logs off the source host, synchronize clocks with NTP so timestamps correlate, and protect log stores from modification for evidentiary value.

Chain of custody documents who handled evidence, when, and how; volatile data (memory, connections, running processes) is captured before disk imaging because it is lost on shutdown.

Detection categories: signature (known bad), anomaly (deviation from baseline), and behavioral (sequence of actions); each produces different false-positive profiles and tuning needs.

Mean time to detect (MTTD) and mean time to respond (MTTR) are the core monitoring metrics; reducing MTTD requires coverage and correlation, reducing MTTR requires runbooks and authority to isolate.

Escalation criteria should be defined by severity: data exposure, domain admin compromise, and ransomware trigger immediate escalation; low-severity policy violations follow normal queue handling.

Symmetric algorithms (AES) are fast and used for bulk data; asymmetric algorithms (RSA, ECC) are slow and used for key exchange and signatures; hybrid schemes combine both, as in TLS.

AES key sizes are 128, 192, and 256 bits; RSA keys are commonly 2048 or 4096 bits; key length comparisons are only meaningful within the same algorithm family.

Hashing (SHA-256) is one-way and provides integrity, not confidentiality; a salted hash with a slow KDF (bcrypt, PBKDF2, Argon2) is required for password storage.

Full-disk encryption protects data at rest on a lost or stolen device but not data in use after boot and login; file-level and database encryption address narrower scopes.

Data states: at rest (storage), in motion (network), and in use (memory and processing); each state requires a different control, for example AES for at rest and TLS for in motion.

Key management lifecycle: generation, distribution, storage, rotation, retirement, and destruction; keys stored beside the encrypted data defeat the purpose of encryption.

DLP classification relies on content inspection (regex, keywords, fingerprints) plus metadata and user context; false positives are tuned with exceptions and exact-data-match fingerprints.

Tokenization replaces sensitive data with a surrogate token mapped in a secured vault; unlike encryption, the token has no mathematical relationship to the original value.

Risk = likelihood × impact; a risk register records each risk with owner, rating, treatment (mitigate, transfer, avoid, accept), and residual risk after controls.

Defense in depth layers preventive, detective, and corrective controls so a single control failure does not result in compromise.

Least privilege and separation of duties limit blast radius; privileged accounts should be individually attributable, not shared, and reviewed on a schedule.

Compliance frameworks: PCI DSS for cardholder data, HIPAA for protected health information, GDPR for EU personal data, ISO/IEC 27001 for an information security management system, SOX for financial reporting controls.

A gap assessment compares current controls to a chosen framework; a risk assessment prioritizes by likelihood and impact; the two answer different questions and are not interchangeable.

Change management requires documented approval, testing, and rollback before production change; emergency changes are permitted but must be retroactively reviewed.

Business impact analysis identifies critical processes and defines RTO (time to restore) and RPO (acceptable data loss); DR strategy is selected to meet those targets.

Audit evidence should be reproducible and time-stamped: configuration exports, log samples, access reviews, and training records; undocumented controls are treated as absent by auditors.