ATP 108 cheat sheet

Risk = Threat × Vulnerability × Impact; a threat is a potential cause of harm, a vulnerability is a weakness that can be exploited, and impact is the resulting loss.

Confidentiality, Integrity, and Availability (CIA triad) are the three core security objectives; a control may support one or more of them.

Asset: anything of value to an organization (data, systems, people, facilities); information asset classification typically follows sensitivity levels such as public, internal, confidential, restricted.

Vulnerability vs. exposure: a vulnerability is an internal weakness; exposure is the condition of being open to a threat (e.g., a public-facing service).

Likelihood × Consequence = Risk level; qualitative scales (e.g., Low/Medium/High) map to prioritized treatment decisions.

Defense in depth: multiple independent layers of controls so failure of one layer does not lead to total compromise.

Least privilege: subjects receive only the minimum access rights necessary to perform their function, for the minimum time required.

Separation of duties: no single individual controls all parts of a critical transaction, reducing fraud and error risk.

Due care vs. due diligence: due care is acting on known risks; due diligence is the ongoing effort to identify and understand risks.

CIA triad plus authentication, authorization, and non-repudiation support the core security model; non-repudiation is often achieved with digital signatures.

NIST Cybersecurity Framework (CSF) core functions: Identify, Protect, Detect, Respond, Recover (plus Govern in CSF 2.0).

ISO/IEC 27001 specifies requirements for an information security management system (ISMS); ISO/IEC 27002 provides implementation guidance.

CIS Controls are prioritized safeguards; Implementation Group 1 (IG1) is the minimum baseline for small organizations.

Risk treatment options: mitigate (reduce), transfer (e.g., insurance), avoid (eliminate activity), accept (retain residual risk).

Residual risk = inherent risk − effect of controls; risk appetite is the amount of risk an organization is willing to accept.

Zero Trust principles: verify explicitly, use least privilege access, and assume breach; never trust, always verify.

COBIT is an IT governance framework focused on aligning IT with business objectives and managing IT risk.

The three lines model: management owns risk (first line), risk/compliance functions oversee (second line), internal audit provides independent assurance (third line).

Risk assessment steps: identify assets and threats, identify vulnerabilities, assess likelihood and impact, calculate risk, prioritize, and select treatment.

Qualitative vs. quantitative risk analysis: qualitative uses descriptive scales; quantitative uses monetary values such as single loss expectancy (SLE).

SLE = asset value (AV) × exposure factor (EF); annualized loss expectancy (ALE) = SLE × annualized rate of occurrence (ARO).

Business impact analysis (BIA) identifies critical business functions and their recovery time objective (RTO) and recovery point objective (RPO).

Incident response lifecycle: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity.

Change management: request, assess risk, approve, test, implement, and review; emergency changes require retrospective approval.

Vulnerability management cycle: discover, prioritize, remediate, verify, and report; risk-based prioritization uses severity plus exploitability.

Security awareness program components: policy acknowledgement, role-based training, phishing simulations, and metrics for completion and reporting.

Data backup strategy: 3-2-1 rule (3 copies, 2 media types, 1 offsite); test restores to validate recoverability.

Firewall types: packet-filtering (stateless), stateful inspection, application-layer/proxy; next-generation firewalls add IPS and application awareness.

IDS detects and alerts; IPS detects and blocks inline; signature-based detection matches known patterns, anomaly-based detection flags deviations from baselines.

SIEM aggregates logs and correlates events for detection and compliance reporting; SOAR automates response playbooks.

Encryption: symmetric (AES) is fast for bulk data; asymmetric (RSA, ECC) supports key exchange and digital signatures; hashing (SHA-256) provides integrity, not confidentiality.

Multi-factor authentication combines factors from knowledge, possession, and inherence categories; two factors from the same category are not true MFA.

Vulnerability scanners identify known weaknesses; penetration tests simulate attacker techniques to validate exploitability.

Endpoint detection and response (EDR) monitors endpoint behavior and enables containment; antivirus signature matching alone is insufficient for advanced threats.

Access control models: discretionary (owner decides), mandatory (labels/clearances), role-based (job function), attribute-based (contextual policies).

GDPR governs processing of personal data of EU residents; key principles include lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, and accountability.

HIPAA Security Rule requires administrative, physical, and technical safeguards for electronic protected health information (ePHI).

PCI DSS applies to organizations that store, process, or transmit cardholder data; core goals include building a secure network, protecting stored data, and maintaining a vulnerability management program.

SOX Section 404 requires management assessment and auditor attestation of internal controls over financial reporting.

ISO/IEC 27001 certification requires an ISMS with documented scope, risk assessment, risk treatment, and continual improvement (Plan-Do-Check-Act).

NIST SP 800-53 provides a catalog of security and privacy controls for federal information systems; SP 800-37 defines the Risk Management Framework (RMF).

Data breach notification timelines vary by jurisdiction; GDPR generally requires notification to the supervisory authority within 72 hours of awareness.

Compliance vs. security: compliance is adherence to requirements; security is protection against threats - meeting a standard does not guarantee security.

Code of ethics core tenets: act honestly, objectively, and with due care; protect the public and organizational interests; avoid conflicts of interest.

Confidentiality obligation: sensitive information learned during engagements is not disclosed without authorization, even after the engagement ends.

Scope and authorization: obtain written authorization before testing or assessing systems; unauthorized access is unethical and often illegal.

Conflict of interest: disclose any relationship that could impair objectivity; recuse when independence cannot be maintained.

Due professional care: maintain competence through continuing education, use accepted methodologies, and document work sufficiently for peer review.

Reporting: findings should be accurate, evidence-based, and communicated to appropriate stakeholders; avoid exaggeration or omission.

Whistleblowing: report illegal or unethical conduct through designated channels; retaliation against good-faith reporters is prohibited.

Professional skepticism: validate assertions with evidence rather than relying solely on management representations.