SSCP cheat sheet

CIA triad: confidentiality prevents unauthorized disclosure, integrity prevents unauthorized modification, availability ensures timely and reliable access.

Control categories are administrative (policies, training), technical/logical (firewalls, encryption), and physical (locks, guards); each category can hold any control type.

Control types: preventive stops an event, detective discovers it, corrective restores after it, deterrent discourages it, compensating substitutes for another control, recovery restores operations.

Defense in depth layers independent controls so the failure of one layer does not expose the asset; no single control is assumed sufficient.

Least privilege grants only the access needed for a task; separation of duties splits a critical function so no single person can complete it alone.

Due care is the reasonable protection actually implemented; due diligence is the ongoing verification that those protections remain adequate.

Risk = likelihood x impact; risk falls only by reducing threat, vulnerability, or impact, not by ignoring likelihood.

Policy states mandatory management intent; a standard specifies mandatory requirements; a procedure gives step-by-step actions; a guideline is discretionary advice.

Data roles: the owner is accountable for classification, the custodian implements protections, the user follows the rules.

Access control sequence: identification, then authentication, then authorization, with accountability maintained through auditing.

Authentication factors are something you know, have, are, do, or somewhere you are; two-factor authentication requires factors from two different categories.

DAC lets the object owner set permissions via ACLs; MAC uses system labels and clearances; RBAC assigns permissions to roles and users to roles.

ABAC evaluates attributes of subject, object, action, and environment; rule-based access applies conditional statements such as time-of-day restrictions.

Fail-safe default and implicit deny mean access is refused unless a rule explicitly permits it.

Kerberos: the KDC issues a TGT after authentication, the TGT is exchanged for service tickets, port 88, and clock skew must be limited to prevent replay.

RADIUS encrypts only the password field and is common for network access; TACACS+ encrypts the full payload and separates authentication, authorization, and accounting.

Biometrics: FRR (Type II) rejects valid users, FAR (Type I) admits impostors, and the CER is the threshold where FAR equals FRR.

SSO reduces credential sprawl but makes the primary credential a single point of failure; federation trusts an external identity provider across security domains.

SLE = asset value x exposure factor; ALE = SLE x annualized rate of occurrence.

Quantitative assessment expresses loss in money and annualized terms; qualitative assessment uses ordinal scales such as high, medium, and low.

Risk responses: mitigate (reduce), transfer (insurance or contract), avoid (stop the activity), accept (documented decision); residual risk is what remains after treatment.

STRIDE categories: spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege.

A vulnerability scan identifies known weaknesses; a penetration test exploits them to validate business impact; neither substitutes for the other.

Signature-based detection matches known patterns and misses novel attacks; anomaly-based detection baselines normal behavior and produces more false positives.

BIA metrics: RTO is the maximum acceptable downtime, RPO is the maximum tolerable data loss, MTD is the time before impact becomes unacceptable.

A clipping level sets the threshold for flagging events, trading false positives against false negatives during log review.

A risk register records asset, threat, vulnerability, likelihood, impact, owner, chosen response, and current status for each identified risk.

NIST incident response lifecycle: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.

Order of volatility: CPU and cache, then RAM, network connections, temporary files, disk storage, and finally backups and archives; collect the most volatile evidence first.

Chain of custody records who handled evidence, when, where, and why; an unbroken record is required for the evidence to be admissible.

Forensic imaging uses a write blocker, and the hash of the acquired image must match the hash of the original media.

Backups: full copies everything, incremental copies changes since the last backup of any type, differential copies changes since the last full backup.

Recovery sites: hot is fully operational, warm has infrastructure with partial or stale data, cold provides only space, power, and connectivity.

Containment options include isolating the host, disabling the account, blocking the indicator, and segmenting the network, all while preserving evidence.

Lessons learned is part of post-incident activity and feeds updates to procedures, controls, and training.

Symmetric encryption uses one shared key: fast and suited to bulk data, but poor at key distribution and unable to provide non-repudiation.

Asymmetric encryption uses a public/private pair: encrypt with the recipient's public key for confidentiality, sign with the sender's private key for origin and integrity.

A cryptographic hash is one-way and collision-resistant; it provides integrity but not confidentiality.

A digital signature is a message hash encrypted with the sender's private key and verified with the sender's public key.

PKI trust chain: root CA, intermediate CA, end-entity certificate; CRLs and OCSP communicate revocation status.

AES is a symmetric block cipher with a 128-bit block and 128-, 192-, or 256-bit keys; ECB must not be used for data because identical blocks encrypt identically.

HMAC combines a hash with a shared secret key to provide integrity and authenticity without encrypting the payload.

Key management covers generation, distribution, storage, rotation, and destruction; escrow enables recovery at the cost of another party holding the key.

TLS provides confidentiality and integrity in transit with certificate-based server authentication; IPsec operates at layer 3 using AH for integrity and ESP for encryption.

OSI layers are physical, data link, network, transport, session, presentation, and application; TCP/IP collapses them into network access, internet, transport, and application.

Firewall types: packet filter inspects headers, stateful tracks connection state, application proxy inspects payload at layer 7, NGFW adds IPS and application awareness.

A DMZ hosts externally reachable services and separates them from the internal network; internal-only traffic should not terminate in the DMZ.

IPsec transport mode protects host-to-host payload; tunnel mode encapsulates the entire original packet for gateway-to-gateway VPNs.

WEP is broken; WPA2 uses AES-CCMP; WPA3 adds SAE and forward secrecy; 802.1X with EAP provides port-based network access control.

Common attacks: ARP spoofing enables LAN man-in-the-middle, SYN flood exhausts half-open connection tables, DNS poisoning redirects resolution.

Well-known ports: 22 SSH, 23 Telnet, 25 SMTP, 53 DNS, 88 Kerberos, 389/636 LDAP, 443 HTTPS, 3389 RDP.

Email authentication: SPF authorizes sending IP addresses, DKIM signs messages cryptographically, DMARC aligns SPF or DKIM results with the From domain.

Segmentation limits lateral movement; microsegmentation applies per-workload policy; zero trust removes implicit trust based on network location.

Malware behavior: a virus needs a host and user action, a worm self-propagates across networks, a trojan disguises itself as legitimate, a rootkit hides privileged access, ransomware encrypts data and demands payment.

Injection is prevented with parameterized queries and input validation; cross-site scripting is prevented with output encoding and content security policy.

A secure SDLC places threat modeling in design, static analysis and code review in build, and dynamic testing or penetration testing before release.

Cloud shared responsibility: the provider secures the underlying infrastructure; the customer secures data, identities, and configuration, plus the guest OS in IaaS.

Containers share the host kernel and rely on namespaces and cgroups for isolation; a hypervisor provides stronger separation between virtual machines.

Endpoint controls: HIDS monitors host activity, HIPS blocks it, EDR records and supports response, and application allowlisting blocks unapproved executables.

Mobile risks: jailbreaking or rooting removes OS controls and sideloading bypasses store review; MDM enforces encryption, patching, and remote wipe.

DLP classifies and blocks sensitive data in motion, at rest, and in use; a CASB brokers visibility and policy between users and cloud services.