WBCHSE HS Cyber Security cheat sheet

CIA triad: Confidentiality (only authorized read), Integrity (only authorized change), Availability (timely access); a control is judged by which leg it protects.

Threat vs vulnerability vs risk: threat is a potential cause of harm, vulnerability is a weakness, risk = likelihood × impact of a threat exploiting a vulnerability.

Malware classes by propagation: virus needs a host file and user action, worm self-replicates over networks, trojan disguises as legitimate software, ransomware denies access until payment.

Social engineering exploits people, not code: phishing (email), vishing (voice), smishing (SMS), pretexting (fabricated scenario), tailgating (physical entry).

Phishing indicators: mismatched display vs actual domain, urgency and threat language, generic greeting, unexpected attachments, requests for credentials or OTP.

Denial-of-Service floods a service with traffic; DDoS uses many distributed hosts (botnet) so blocking one source fails; volumetric, protocol, and application-layer variants exist.

Attack lifecycle (Cyber Kill Chain): reconnaissance, weaponization, delivery, exploitation, installation, command-and-control, actions on objectives.

Authentication factors: something you know (password), have (token), are (biometric); MFA requires two or more different factor types, not two passwords.

Defence in depth layers controls (physical, network, host, application, data, user) so one failure does not compromise the whole system.

OSI layers 1–7: Physical, Data Link, Network, Transport, Session, Presentation, Application; TCP/IP maps to Link, Internet, Transport, Application.

TCP is connection-oriented with a 3-way handshake (SYN, SYN-ACK, ACK) and guarantees ordered delivery; UDP is connectionless with no delivery guarantee.

IPv4 address is 32 bits; private ranges are 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; /24 mask 255.255.255.0 gives 254 usable hosts.

Well-known ports: 20/21 FTP, 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 3389 RDP.

Firewall types: packet-filtering (header only), stateful (tracks connections), application-layer/proxy (inspects payload); default-deny is the safer policy.

IDS detects and alerts (passive); IPS detects and blocks inline (active); signature-based detects known patterns, anomaly-based detects deviation from baseline.

VLAN segments broadcast domains; a switch forwards by MAC address at Layer 2, a router forwards by IP address at Layer 3.

VPN creates an encrypted tunnel over an untrusted network; IPsec uses AH for integrity/authentication and ESP for confidentiality plus integrity.

DNS poisoning corrupts resolver cache to redirect names; DNSSEC adds cryptographic signatures to DNS answers to detect forgery.

Principle of least privilege: each user and process gets only the rights needed for its task; root/administrator accounts are used only for administration.

Access control models: DAC (owner decides), MAC (system labels, e.g. SELinux), RBAC (rights by role); ACLs list permitted principals per object.

Windows file permissions: Full Control, Modify, Read & Execute, Read, Write; NTFS permissions apply locally, share permissions apply over the network, most restrictive wins.

Linux permissions rwx for user/group/other: chmod 755 = rwxr-xr-x, 644 = rw-r--r--; chmod 777 grants everyone full access and is unsafe.

Patch management cycle: inventory, classify, test, deploy, verify; unpatched software is the leading exploited weakness in endpoint attacks.

Antivirus/EDR: signature detection matches known hashes and patterns; heuristic and behavioural detection flag suspicious actions such as mass file encryption.

Boot security: BIOS/UEFI password, Secure Boot verifies bootloader signatures, full-disk encryption (BitLocker, LUKS) protects data at rest on a stolen device.

Logging and auditing: Windows Event Viewer and Linux syslog/auth.log record logons and privilege changes; log review detects brute force and lateral movement.

Application whitelisting allows only approved executables to run; blacklisting blocks known-bad programs and is weaker against new malware.

Symmetric encryption uses one shared key (AES, DES, 3DES) and is fast; asymmetric uses a public/private key pair (RSA, ECC) and solves key distribution.

Key sizes: AES supports 128, 192, 256 bits; DES uses 56-bit effective keys and is obsolete; RSA keys of 2048 bits or more are current practice.

Hashing is one-way and fixed-length: MD5 (128-bit, broken), SHA-1 (160-bit, deprecated), SHA-256 (256-bit); it provides integrity, not confidentiality.

Encryption provides confidentiality; hashing provides integrity; HMAC combines a hash with a secret key for message authentication.

Digital signature = hash of message encrypted with sender's private key; verifier uses sender's public key, giving authentication, integrity and non-repudiation.

PKI: a Certificate Authority signs a certificate binding a public key to an identity; the client validates the chain to a trusted root.

TLS handshake negotiates cipher suite, authenticates the server certificate, and derives a shared session key for symmetric bulk encryption.

Password storage uses salted hashes (bcrypt, PBKDF2, Argon2) so identical passwords yield different hashes and precomputed rainbow tables fail.

Steganography hides the existence of a message inside a carrier (image, audio); encryption hides the content but not the fact that a message exists.

OWASP Top 10 categories include broken access control, injection, cryptographic failures, insecure design, security misconfiguration and vulnerable components.

SQL injection occurs when user input is concatenated into queries; parameterized queries/prepared statements separate code from data and stop it.

XSS injects script into pages viewed by others: stored (persisted in database), reflected (in URL response), DOM-based (client-side script).

CSRF tricks a logged-in browser into sending a state-changing request; defences are anti-CSRF tokens and SameSite cookies.

Input validation: allow-list (accept known good) is stronger than deny-list (reject known bad); output encoding prevents injection at render time.

Authentication controls: strong password policy, account lockout after repeated failures, MFA, secure session cookies marked HttpOnly and Secure.

HTTPS protects data in transit; HSTS header forces browsers to use HTTPS; a mixed-content page loads HTTP resources inside HTTPS and breaks protection.

Directory traversal uses ../ sequences to read files outside the web root; canonicalize and validate requested paths against an allowed list.

Security headers: Content-Security-Policy restricts script sources, X-Frame-Options blocks clickjacking, X-Content-Type-Options stops MIME sniffing.

India's IT Act 2000 (amended 2008) governs electronic records and cyber offences; Sections 43, 65, 66, 66C, 66D, 66E, 66F and 67 cover damage, tampering, identity theft, cheating, privacy and obscenity.

Section 66C: punishment for identity theft; Section 66D: cheating by personation using a computer resource; Section 66F: cyber terrorism.

DPDP Act 2023 governs personal data processing in India: consent, purpose limitation, data-principal rights, and breach notification duties.

Evidence admissibility: Section 65B of the Indian Evidence Act (now Bharatiya Sakshya Adhiniyam) requires a certificate for electronic records.

Forensic principles: preserve the original, work on a verified copy, maintain chain of custody, document every action with timestamps.

Order of volatility (RFC 3227): collect CPU registers/cache, RAM, network state, then disk, then backups and archives - most volatile first.

Hashing a disk image (SHA-256) before and after acquisition proves integrity; a write blocker prevents alteration of the source device.

Ethics: authorized testing only with written scope, no data exfiltration beyond proof, responsible disclosure, confidentiality of findings.

Anti-forensics: timestomping alters file metadata, data wiping destroys evidence, encryption hides content; investigators corroborate with multiple artifacts.

Incident response phases (NIST): Preparation; Detection and Analysis; Containment, Eradication and Recovery; Post-Incident Activity.

Containment choices: isolate host from network, block IP/domain at firewall, disable compromised account, preserve volatile evidence before shutdown.

SOC roles: L1 triage and alert monitoring, L2 investigation, L3 threat hunting and detection engineering; SIEM correlates logs and raises alerts.

Risk treatment options: mitigate (reduce), transfer (insurance), avoid (stop activity), accept (documented tolerance).

Risk assessment: qualitative (High/Medium/Low scales) vs quantitative (SLE × ARO = ALE; ALE compares against control cost).

Recovery metrics: RTO is maximum tolerable downtime, RPO is maximum tolerable data loss; backups must be tested, not just scheduled.

Indicators of compromise: unusual outbound traffic, new admin accounts, abnormal login times, unexpected file encryption, disabled logging.

Business continuity uses BIA to rank critical processes; tabletop exercises and lessons-learned reviews test the plan before a real incident.

Log retention and time synchronization (NTP) make correlation possible; missing or skewed timestamps break incident timelines.

Cloud service models: IaaS (provider gives infrastructure), PaaS (platform/runtime), SaaS (application); security responsibility shifts toward the provider as you move up.

Shared responsibility model: provider secures the cloud (physical, hypervisor), customer secures in the cloud (data, identities, configuration).

Cloud risks: misconfigured public storage buckets, over-permissive IAM roles, exposed API keys in code repositories, weak tenant isolation assumptions.

IoT weaknesses: default/hardcoded credentials, no patch channel, insecure protocols (Telnet, plain MQTT), long device lifetimes; network segmentation limits blast radius.

AI in security: anomaly detection, malware classification, phishing detection; limits include false positives, poisoning of training data and adversarial inputs.

AI-enabled attacks: deepfake voice/video for fraud, automated phishing text, CAPTCHA-solving bots; verify identity out-of-band.

Zero Trust: no implicit trust from network location; every request is authenticated and authorized per session (never trust, always verify).

Container and serverless security: scan images for vulnerable components, run least-privilege, avoid secrets in environment variables and images.

Data protection in cloud: encryption at rest and in transit, key management (KMS/HSM), data residency and retention rules under applicable law.

Lab isolation: run vulnerable targets in a host-only or internal virtual network so experiments cannot reach production or the internet.

Reconnaissance tools: whois and nslookup for registration/DNS, nmap for host and port discovery; -sS is a SYN scan, -sV probes service versions.

Vulnerability scanning (Nessus, OpenVAS) reports findings but does not prove exploitability; manual validation separates real risk from noise.

Web testing basics: intercept traffic with a proxy, test input fields for injection and XSS, inspect cookies and headers, check access control on object IDs.

Password audit: hash capture and offline cracking with wordlists demonstrate password strength; only on systems you are authorized to test.

Report structure: scope, methodology, findings with severity (CVSS score), evidence, business impact, remediation and retest result.

Case study pattern: identify the initial vector (phishing, unpatched service, misconfiguration), the failed control, the spread, and the lesson applied.

Wireshark/packet analysis: filter by protocol or IP, follow a TCP stream to reconstruct a session, look for cleartext credentials in HTTP/FTP/Telnet.

Evidence handling in project work: anonymize real data, obtain written authorization, keep logs of actions, and store artefacts with hashes.

CVSS base score ranges 0.0–10.0; 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High, 9.0–10.0 Critical; base metrics are exploitability plus impact.

Vulnerability management loop: discover assets, scan, prioritize by exploitability and asset criticality, patch, verify, report.

Threat intelligence feeds (IOC lists, TAXII/STIX) enrich SIEM rules; stale indicators decay and must be aged out.

Phishing response: preserve headers, extract URLs and hashes, block sender/domain, search mailboxes for other recipients, reset affected credentials.

Ransomware response: isolate affected hosts, identify strain and encryption scope, restore from verified offline backup, do not pay as a control strategy.

Chain of custody record fields: item ID, description, collector, date/time, location, transfer signatures; a break makes evidence challengeable.

Regulatory reporting: data breaches may require notification to the regulator and affected individuals within statutory timelines; document the decision.

Metrics that matter: MTTD (mean time to detect), MTTR (mean time to respond), patch compliance percentage, number of repeat findings.

Tabletop scenario design: pick a plausible threat, assign roles, inject escalating events, record decisions and gaps, then update the plan.

Cloud identity: enforce MFA on all privileged accounts, use role-based least privilege, rotate keys, prefer short-lived tokens over static credentials.

Cloud logging: enable provider audit trails (CloudTrail, Activity Log), centralize them outside the account so an attacker cannot delete evidence.

IoT hardening: change default credentials at install, disable unused services (UPnP, Telnet), apply firmware updates, place devices on a separate VLAN.

Edge computing pushes processing near devices; it increases the physical attack surface and complicates centralized patching and monitoring.

AI model risks: data poisoning corrupts training, model inversion leaks training data, prompt injection manipulates LLM-driven applications.

Defences for AI systems: input sanitization, output filtering, human approval for high-impact actions, logging of prompts and responses.

5G and SD-WAN expand the perimeter; segmentation and per-flow policy replace the assumption of a trusted internal network.

Supply chain risk: third-party components and APIs inherit trust; require SBOM visibility and vendor security attestations.

Privacy-enhancing technologies: differential privacy adds noise to aggregates, homomorphic encryption allows computation on encrypted data, tokenization replaces sensitive values.

Scope statement must list in-scope hosts/applications, out-of-scope systems, test window, contacts and authorization signature before any testing.

Reconnaissance order: passive (public records, search engines, certificate transparency) before active (port scans, banner grabs) to reduce detection and risk.

Common lab findings and fixes: default admin credentials (change), verbose error pages (disable), missing HTTPS (deploy TLS), open SMB (restrict), outdated CMS (patch).

CVSS vector string records the exact metrics used; two findings with the same score can differ in vector and remediation urgency.

Reproduction steps in a report must be precise enough for a defender to verify the finding, with request/response or command output as evidence.

Retest confirms remediation; a closed finding without retest evidence is only a claim.

Case study analysis template: timeline, initial access, privilege escalation, lateral movement, data impact, detection gap, control improvement.

Project documentation: risk register, test log, evidence folder with hashes, final report, and a short executive summary in plain language.

Ethics checkpoints in coursework: no testing outside authorized lab, no real personal data, no publication of exploitable details without disclosure process.

Choose algorithm by purpose: AES-GCM for authenticated symmetric encryption, RSA/ECC for key exchange and signatures, SHA-256 for integrity.

Never reuse a nonce/IV with the same key in stream or GCM modes; reuse leaks plaintext relationships and breaks authentication.

Key management lifecycle: generate with a CSPRNG, distribute securely, store in KMS/HSM, rotate periodically, revoke and destroy on compromise.

TLS certificate checks: validity dates, hostname match, chain to trusted root, revocation status; a self-signed cert in production signals misconfiguration.

Password hashing parameters: increase work factor (bcrypt cost, PBKDF2 iterations) as hardware improves; store the salt with the hash, never the plaintext.

Digital signature verification fails if the message changed by one bit - that is the integrity guarantee in practice.

Data states: at rest (disk/database encryption), in transit (TLS/VPN), in use (limited protection; confidential computing is emerging).

Backup encryption: encrypt backups and protect the key separately; an encrypted backup with a lost key is unrecoverable data loss.

Common mistakes to flag in audits: hardcoded keys in source, MD5 for passwords, ECB mode for multi-block data, disabled certificate validation.

Authentication vs authorization: authentication proves identity, authorization decides access; broken access control (IDOR) is testing object references across users.

Injection testing: send quote characters and boolean conditions, observe errors and response differences; remediation is parameterization, not input stripping alone.

Session security: session ID must be long, random, transmitted only over HTTPS, rotated at login, and invalidated at logout.

File upload risk: validate type and size, store outside web root, rename files, never execute uploaded content.

Error handling: generic messages to users, detailed logs server-side; stack traces reveal framework versions and paths.

API security: enforce authentication on every endpoint, validate object ownership, rate-limit, and avoid excessive data exposure in responses.

Dependency risk: outdated libraries carry known CVEs; track versions, subscribe to advisories, and patch or replace unsupported components.

WAF is a compensating control, not a fix; it reduces exploit traffic but the vulnerable code still needs correction.

Secure SDLC: threat modelling at design, code review, SAST/DAST in the pipeline, and security acceptance criteria before release.

First responder priorities: secure the scene, preserve volatile data, photograph the setup, note running processes and network connections before shutdown.

Disk imaging: use a write blocker, compute hash of source and image, compare hashes; any mismatch invalidates the copy.

Windows artefacts: event logs (Security.evtx), registry hives, prefetch, $MFT, recycle bin; Linux: /var/log/auth.log, bash history, cron entries.

Timeline analysis correlates file system MAC times (modified, accessed, changed) with log events to reconstruct attacker actions.

Mobile forensics: logical extraction (backup/API), file system extraction, physical extraction; isolation from network prevents remote wipe.

Email evidence: full headers show originating IP and relay path; spoofed sender is revealed by SPF/DKIM/DMARC results.

Legal boundaries: consent and legal authority are required for search and seizure of devices; unauthorized access is an offence even for investigation.

Ethical hacking code: written permission, stay in scope, report vulnerabilities responsibly, protect confidential data found during testing.

Documentation standard: contemporaneous notes, hashed evidence inventory, chain-of-custody form, and a report separating facts from opinion.

ISO/IEC 27001 defines an ISMS: risk-based controls, documented policies, management review, continual improvement (Plan-Do-Check-Act).

NIST Cybersecurity Framework functions: Identify, Protect, Detect, Respond, Recover (plus Govern in CSF 2.0).

Control types: preventive (firewall, MFA), detective (IDS, logs), corrective (restore, patch), compensating (WAF for unfixed code).

Defence metrics: coverage of assets in logging, percentage of critical patches within SLA, phishing simulation click rate, incident closure time.

Third-party risk: vendor questionnaires, contractual security clauses, right to audit, and periodic reassessment for critical suppliers.

Access review: quarterly recertification of privileged accounts, removal of dormant accounts, separation of duties for sensitive operations.

Change management reduces outages and attack windows: test in staging, approve, deploy, rollback plan, record the change.

Incident severity classification drives escalation: define criteria (data loss, service impact, affected users) before an incident occurs.

Awareness training effectiveness is measured by behaviour change (reporting rate, simulation results), not by course completion alone.

Public S3-style bucket exposure: disable public access at account level, audit bucket policies, enable access logging and encryption by default.

Serverless risk: event injection through untrusted inputs, over-privileged execution roles, and secrets in environment variables; validate inputs and scope roles.

IoT botnet pattern (Mirai-style): default credentials + internet-exposed Telnet/SSH leads to mass recruitment; block inbound management ports.

AI phishing detection bypass: attackers craft text to avoid trigger words; combine technical indicators (domain age, header anomalies) with content analysis.

Deepfake verification: use a pre-agreed callback or code word for high-value requests; never authenticate money transfers on voice alone.

Model supply chain: pre-trained models downloaded from public hubs can carry backdoors; verify source, checksum and provenance.

Privacy by design in IoT: collect minimum data, encrypt telemetry, provide a retention policy and user deletion path.

Cloud incident response: use provider APIs to snapshot volumes and capture logs before terminating instances; preserve identity and audit evidence.

Regulatory overlap: data localization, breach notification and consent requirements apply across cloud, IoT and AI deployments.

Build a lab: hypervisor, one attacker VM, one target VM, host-only network, snapshots before each exercise for fast rollback.

Exercise 1 – port scan: run nmap against the target, record open ports, map each to a service and a known risk, then close unused services.

Exercise 2 – password strength: create hashes of test passwords, attempt dictionary attack offline, compare time-to-crack for weak vs strong policy.

Exercise 3 – web input test: submit crafted input to a deliberately vulnerable app, capture the request, then apply parameterization and retest.

Exercise 4 – packet capture: capture a login over HTTP vs HTTPS, show cleartext credentials in the first and TLS ciphertext in the second.

Exercise 5 – log analysis: search authentication logs for repeated failures, identify the source IP and time window, write a short incident note.

Exercise 6 – file integrity: hash a directory, modify one file, re-hash, and show how the changed hash reveals tampering.

Case study write-up: state facts with evidence, identify the failed control, propose a specific fix, and state how success would be measured.

Deliverable checklist: authorization, scope, method, evidence with hashes, findings with severity, remediation, retest, lessons learned.

Attacker categories: script kiddies (existing tools), insiders (authorized access), organized crime (financial), nation-state (espionage, persistence), hacktivists (ideology).

Insider threat controls: least privilege, separation of duties, logging of privileged actions, exit procedures revoking access promptly.

Attack surface = sum of exposed entry points (ports, APIs, users, third parties); reducing it is a primary security strategy.

Vulnerability scoring in practice: severity alone is insufficient; combine with asset criticality and known exploitation in the wild.

Security awareness targets the human layer: recognize phishing, verify requests, report incidents quickly, handle data correctly.

Backup strategy 3-2-1: three copies, two different media, one offsite; test restores because an untested backup is an assumption.

Physical security supports cyber defence: locked server rooms, visitor logs, screen locks, secure disposal of storage media.

Incident reporting culture: fast reporting reduces damage; blame-free reporting increases detection speed.

Network segmentation limits lateral movement: separate user, server, management and IoT VLANs with firewall rules between them.

Endpoint detection and response records process trees and network connections; it can isolate a host remotely while preserving memory evidence.

Patch priority: internet-facing services and known-exploited vulnerabilities first, then internal critical systems, then the remainder.

Remote access: VPN with MFA, no direct RDP exposure to the internet, restrict management interfaces to jump hosts.

Wireless security: WPA2/WPA3 with strong passphrase or 802.1X; open Wi-Fi plus a rogue access point enables credential capture.

Email security stack: SPF, DKIM, DMARC authenticate senders; attachment sandboxing and link rewriting reduce phishing success.

USB and removable media control: block unauthorized devices, scan on connect, encrypt portable drives.

Endpoint baseline: host firewall enabled, disk encryption on, screen lock, automatic updates, EDR agent healthy - verify by report, not assumption.

Monitoring coverage gaps: unmanaged devices and shadow IT produce blind spots; asset inventory is a prerequisite for detection.

Injection family: SQL, command, LDAP, XML - root cause is untrusted data interpreted as code; fix by parameterization and strict typing.

Broken access control is the most common serious web flaw: enforce server-side checks on every request, never rely on hidden UI elements.

XSS defence: contextual output encoding, CSP, HttpOnly cookies; input filtering alone is insufficient because contexts differ.

SSRF: attacker makes the server fetch internal URLs; validate and allow-list destinations, block link-local and metadata endpoints.

Insecure deserialization can lead to remote code execution; avoid deserializing untrusted data, use safe formats and integrity checks.

Security misconfiguration examples: default accounts, directory listing, verbose errors, unnecessary services, missing security headers.

Logging and monitoring failures delay detection; log authentication events, access control failures, and validate that alerts fire.

Rate limiting and account lockout reduce credential stuffing; CAPTCHA and MFA further raise the cost of automated attacks.

Secure code review checklist: input validation, output encoding, authentication, authorization, secrets handling, error handling, dependency versions.