CC cheat sheet

CIA triad: Confidentiality = encryption, access control, classification; Integrity = hashing, digital signatures, change control; Availability = redundancy, backups, DDoS protection.

Risk = Threat x Vulnerability x Impact; a control lowers risk by reducing likelihood, impact, or both.

Control categories: administrative (policies, training, background checks), technical/logical (firewalls, encryption, ACLs), physical (locks, guards, badges).

Control functions: preventive stops an event, detective discovers it, corrective restores service, deterrent discourages, compensating substitutes for a missing control.

Least privilege plus need-to-know: grant the minimum rights required, for the minimum duration, and remove them when the task ends.

Defense in depth: any asset protected by only one control has a single point of failure; layer independent preventive, detective, and corrective controls.

Due diligence = ongoing identification and assessment of risk; due care = the reasonable action taken in response. Accountability cannot be delegated.

Non-repudiation requires proof of origin plus integrity: digital signatures combined with tamper-evident audit logs.

Privacy by design: collect the minimum data, state the purpose, limit retention, and delete data when no longer needed.

Document hierarchy: Policy (management intent, why/what) then Standard (mandatory specifics) then Procedure (step-by-step) then Guideline (recommended, optional).

SLE = asset value x exposure factor; ALE = SLE x ARO. A control is justified when annual cost is below the ALE reduction it produces.

Risk responses: avoid (eliminate activity), mitigate (apply controls), transfer (insurance, contract), accept. Residual risk must be formally accepted by management.

Data roles: owner classifies and is accountable; custodian implements safeguards; steward governs quality and definitions; user follows policy.

RTO = maximum tolerable downtime; RPO = maximum tolerable data loss (backup frequency); MTD = downtime before unacceptable harm; RTO must be less than or equal to MTD.

BCP keeps critical business functions running during disruption; DR restores technology, data, and infrastructure afterward.

Regulations: GDPR (EU personal data, 72-hour breach notification), HIPAA (US health data), PCI DSS (cardholder data), SOX (financial reporting controls).

Third-party risk: contracts must specify security requirements, right to audit, breach notification timelines, and data return or destruction on exit.

Separation of duties, job rotation, and mandatory vacation are administrative controls that limit and detect fraud.

Sequence: Identification (claiming an identity) then Authentication (proving it) then Authorization (what is allowed) then Accounting (logging and review).

Factors: Type 1 something you know, Type 2 something you have, Type 3 something you are (biometric), plus location and behavior. MFA requires two or more different types.

Models: DAC = owner discretion via ACLs; MAC = system-enforced labels and clearances; RBAC = roles; ABAC = attributes and policy; rule-based = conditional rules.

Kerberos: the KDC issues a TGT, then service tickets; symmetric keys and time synchronization; the basis of Windows Active Directory SSO.

Federation protocols: SAML for browser SSO assertions, OAuth 2.0 for delegated authorization, OIDC as an identity/authentication layer on top of OAuth 2.0.

Password storage: salted, deliberately slow hash (bcrypt, Argon2, PBKDF2); never reversible encryption; length is a stronger control than forced complexity.

Provision access at hire, deprovision at termination: orphan and dormant accounts are a leading audit finding; recertify entitlements periodically.

Biometrics: FAR is the rate of unauthorized users accepted, FRR the rate of authorized users rejected; the CER/EER is where they cross, and lower is better.

Separation of duties prevents one person from completing fraud alone; dual control requires two people to act together; PAM vaults and rotates admin credentials.

OSI: 7 application, 6 presentation, 5 session, 4 transport, 3 network, 2 data link, 1 physical. Attacks map to layers: ARP spoofing L2, IP spoofing L3, SYN flood L4, XSS/SQLi L7.

Firewalls: packet filter (stateless L3/L4), stateful (session table), proxy/application gateway and WAF (L7); NGFW adds IPS, application awareness, and TLS inspection.

Segmentation: VLANs and subnets separate trust zones, a DMZ hosts internet-facing services, and microsegmentation restricts east-west traffic inside the data center.

IPsec: AH provides integrity and authentication only; ESP adds confidentiality; tunnel mode encrypts the whole packet for site-to-site, transport mode protects payload only.

TLS protects data in transit; the certificate chain must validate to a trusted root CA and the hostname must match the certificate subject or SAN.

Network attacks to recognize: DDoS, on-path/MITM, ARP and DNS cache poisoning, VLAN hopping, rogue AP and evil twin, deauthentication floods.

Wireless: WEP is broken; WPA2 with AES-CCMP is the baseline; WPA3 adds SAE for offline dictionary resistance and forward secrecy.

Cloud service models: IaaS (customer manages OS and above), PaaS (customer manages application and data), SaaS (customer manages data and users only).

Zero trust: verify explicitly, apply least privilege, assume breach; enablers are an identity provider, MFA, device posture checks, microsegmentation, and CASB/SASE.

IR lifecycle (NIST): Preparation then Detection and Analysis then Containment, Eradication and Recovery then Post-Incident Activity with lessons learned.

Contain before eradicating: short-term containment isolates and preserves evidence; long-term containment rebuilds and restores production service.

Order of volatility: registers and cache, RAM, swap/pagefile, network state, disk, backups and archives. Collect the most volatile evidence first.

Chain of custody: label and hash every item (SHA-256), log every transfer, use write blockers and forensic images, and never analyze the original media.

IDS is detective, out-of-band, signature or anomaly based; IPS is preventive and inline, so it can drop traffic and cause outages when poorly tuned.

Log management: centralize with agents/syslog, synchronize clocks via NTP, retain per policy; SIEM correlates and alerts, SOAR automates response playbooks.

Backup types: full copies everything, incremental captures changes since the last backup of any type, differential captures changes since the last full; apply the 3-2-1 rule.

Vulnerability assessment finds and ranks weaknesses; penetration testing exploits them to prove impact; patching is the corrective control that closes them.

Malware classes: virus needs a host and user action, worm self-propagates across networks, trojan disguises as legitimate software, rootkit hides, ransomware encrypts for extortion.