Engineer Information Security cheat sheet
Engineer Information Security · Keep the key ideas within reach.
Information Security Fundamentals and Laws and Regulations
CIA triad: Confidentiality (no unauthorized disclosure), Integrity (no unauthorized modification), Availability (timely reliable access); a control is classified by which property it primarily protects.
China's Cybersecurity Law (2017) requires network operators to retain logs for at least 6 months; the Data Security Law (2021) creates a data classification/grading system and restricts important data exports.
PIPL (Personal Information Protection Law, 2021) requires separate consent for sensitive personal information (biometrics, medical, financial, location, minors under 14) and permits fines up to 50 million RMB or 5% of prior-year turnover.
GB/T 22239 (Classified Protection of Cybersecurity, MLPS 2.0) defines five protection levels; Level 3 and above require annual测评 and mandatory filing with public security authorities.
China's Cryptography Law (2020) splits cryptography into core, common, and commercial; commercial cryptography is voluntary, but used in critical information infrastructure it must pass certification.
Due care = actions taken to comply with obligations; due diligence = ongoing verification. Negligence claims hinge on whether a reasonable standard of care was applied.
Separation of duties prevents a single actor from completing a high-risk transaction end to end; least privilege limits each subject to the minimum rights needed for its function.
Non-repudiation requires evidence binding an action to an identity - typically digital signatures plus trusted timestamping - and is distinct from authentication alone.
Network Security
TCP three-way handshake SYN → SYN/ACK → ACK; a SYN flood exhausts the backlog queue, mitigated by SYN cookies, which encode connection state in the sequence number.
TLS 1.3 removed RSA key transport and static DH, mandates forward secrecy (ECDHE), and cuts the handshake to one round trip (1-RTT) or zero (0-RTT, replay-prone).
IPsec: AH provides integrity/authentication only (protocol 51); ESP provides confidentiality plus integrity (protocol 50). IKE uses UDP 500, NAT-T uses UDP 4500.
Firewall rule order matters: most engines evaluate top-down and apply the first match; an implicit deny-all should terminate every rule base.
IDS detects and alerts (passive, out-of-band); IPS blocks inline. Signature detection misses zero-days; anomaly detection produces higher false positives.
802.1X port-based access control uses EAP over LAN; EAP-TLS requires certificates on both sides, PEAP/MSCHAPv2 only on the server.
DNS poisoning defenses include DNSSEC (origin authentication via signatures, no encryption), 0x20 encoding, and source-port randomization.
VLAN hopping via double tagging exploits native-VLAN handling on trunk ports; disabling unused ports and never using VLAN 1 as native mitigates it.
Subnetting: usable hosts = 2^(32−prefix) − 2; a /26 yields 62 hosts and 4 subnets per /24.
Operating System Security
Linux permission bits rwx = 4/2/1 for owner, group, other; setuid (4000) runs as file owner, setgid (2000) as group, sticky bit (1000) restricts deletion to owners.
SELinux enforcing mode blocks policy violations; permissive logs only; disabled bypasses entirely. Contexts are user:role:type:level, and type enforcement is the core control.
Windows access control: each object has a DACL (grants/denies) and SACL (auditing); access is evaluated by comparing the token's SIDs against ACEs in order.
Windows AD defenses: tiered admin model, Protected Users group (blocks NTLM, DES, RC4, unconstrained delegation), and LAPS for local admin password rotation.
ASLR randomizes memory layout; DEP/NX marks pages non-executable; both are bypassed by return-oriented programming, which chains existing code gadgets.
Rootkits at ring 0 or below evade user-mode tools; detection requires integrity checking from trusted media, secure boot attestation, or TPM-based measurement.
Patch management priority follows exploitability × exposure: internet-facing, remotely exploitable, no-auth vulnerabilities are patched first.
Mandatory access control (SELinux, AppArmor) constrains even root; discretionary access control (standard rwx/ACL) lets owners change permissions.
Database Security
SQL injection defenses, in priority order: parameterized queries/prepared statements, then allow-list input validation, then least-privilege DB accounts; escaping alone is fragile.
ACID: Atomicity (all-or-nothing), Consistency (constraints preserved), Isolation (concurrent effects equivalent to serial), Durability (committed survives crash).
Isolation levels vs anomalies: Read Uncommitted allows dirty reads; Read Committed stops dirty reads; Repeatable Read stops non-repeatable reads; Serializable also stops phantom reads.
Inference attacks reconstruct sensitive data from aggregate queries; countermeasures include query-size thresholds, result suppression, and noise injection.
Database roles should separate DDL (schema owner), DML (application account), and read-only reporting; the app account must never own its tables.
TDE encrypts data and logs at rest but not the network path; column-level encryption protects against DBA snooping but breaks range queries and indexing.
Backups must be encrypted and restore-tested; an untested backup is an unverified assumption, not a control.
Audit trails should be append-only or shipped off-host so a compromised DBA account cannot erase evidence of its own activity.
Application Security
OWASP Top 10 (2021) ordering: A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection, A04 Insecure Design, A05 Security Misconfiguration, A06 Vulnerable Components, A07 Authentication Failures, A08 Data Integrity Failures, A09 Logging Failures, A10 SSRF.
XSS types: reflected (payload in request echoed back), stored (persisted in DB), DOM-based (client-side sink). Primary defense is context-aware output encoding plus CSP.
CSRF defense: synchronizer token or double-submit cookie plus SameSite=Lax/Strict; GET requests must never change state.
IDOR is a broken-access-control case where an object reference is trusted; fix by enforcing server-side authorization on every object access, not by obscuring IDs.
SAST analyzes source without execution (early, high false positives); DAST tests a running app (late, runtime-visible); SCA maps third-party dependencies to CVEs.
Secure SDLC gates: threat modeling at design, SAST in commit, DAST/pen test pre-release, and dependency scanning continuously.
Input validation is allow-list based and server-side; client-side validation is a UX feature, never a security control.
Deserialization of untrusted data enables remote code execution; prefer signed/allow-listed formats such as JSON with strict schemas.
Cryptography and Authentication
Symmetric: AES (128/192/256-bit keys, block 128) and ChaCha20; asymmetric: RSA (≥2048-bit), ECC (256-bit ≈ RSA 3072), Diffie-Hellman for key agreement.
AES-GCM provides AEAD (confidentiality + integrity); never reuse a nonce with the same key, or both properties collapse.
Hash properties: preimage and second-preimage resistance, collision resistance. SHA-256/SHA-3 are current; MD5 and SHA-1 are broken for collision resistance.
Digital signature = hash then encrypt with signer's private key; verification uses the public key and proves integrity, origin, and non-repudiation, not confidentiality.
PKI trust chain: root CA (self-signed) → intermediate → leaf; revocation via CRL (pull, periodic) or OCSP (real-time); certificate pinning bypasses CA compromise risk.
Password storage: salted, slow KDF (bcrypt, scrypt, Argon2id); a per-user salt defeats rainbow tables, work factor defeats brute force.
MFA factors: something you know/have/are; TOTP is possession-based and phishable in real time, FIDO2/WebAuthn is origin-bound and resists phishing.
HMAC = hash(key ‖ message ‖ key) construction providing integrity and authenticity without encryption; used in API signing and JWT (HS256).
Security Management and Risk Assessment
Risk = likelihood × impact. SLE = asset value × exposure factor; ALE = SLE × annualized rate of occurrence (ARO).
Risk treatment options: mitigate, transfer (insurance), avoid, accept. Acceptance must be documented with an accountable owner.
Qualitative (high/medium/low) suits speed and unclear data; quantitative (monetary) supports cost-benefit but depends on estimate quality.
ISO/IEC 27001 is the certifiable ISMS requirements standard; ISO/IEC 27002 supplies implementation guidance and is not certifiable.
Defense in depth layers controls so one failure is not fatal; the weakest link determines overall posture.
Business impact analysis identifies MTD (max tolerable downtime), RTO (recovery time objective), and RPO (recovery point objective); RTO/RPO ≤ MTD for a viable plan.
SOC 2 reports on Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy) and is an attestation, not a certification.
Third-party risk: tier vendors by data sensitivity and access, require right-to-audit clauses, and reassess on contract renewal or breach disclosure.
Security Engineering and Operations
Incident response phases: preparation → detection/analysis → containment → eradication → recovery → lessons learned; containment precedes eradication to stop spread.
Forensics order of volatility: registers/cache → RAM → network state → disk → backups/archives. Capture volatile data first; hash evidence and maintain chain of custody.
SIEM correlates logs and alerts; SOAR automates response playbooks. Log sources must be time-synchronized (NTP) or correlation fails.
RTO drives recovery strategy; RPO drives backup frequency. Full + incremental backups restore slower than full + differential.
Change management requires documented approval, rollback plan, and testing; emergency changes are retro-reviewed.
Network segmentation limits lateral movement; zero trust replaces implicit internal trust with per-request authentication and authorization.
Vulnerability management cycle: discover → prioritize (CVSS + asset criticality + known exploitation) → remediate → verify; CVSS base score alone ignores context.
Red team = adversary simulation with objectives; penetration test = scoped exploit assessment; both require written authorization and rules of engagement.
Emerging Security Technologies and Trends
Zero trust architecture (NIST SP 800-207): no implicit trust from network location; decisions use identity, device posture, and policy per request (PDP/PEP).
SASE converges SD-WAN with cloud-delivered security (SWG, CASB, ZTNA, FWaaS); SSE is the security-only subset without the networking component.
Cloud shared responsibility: provider secures the cloud (physical, hypervisor); customer secures what is in the cloud (data, identity, configuration). IaaS shifts most to the customer.
Container security: image scanning, minimal base images, no root, read-only filesystems, and admission control via OPA/Kyverno; Kubernetes RBAC and network policies limit blast radius.
AI/ML risks: data poisoning, adversarial examples, model inversion/extraction, prompt injection for LLMs. LLM defenses include input/output filtering and least-privilege tool access.
DevSecOps shifts security left: secrets scanning, IaC scanning (e.g., Terraform misconfig), signed artifacts (Sigstore/cosign), and SBOM generation (SPDX, CycloneDX).
Post-quantum migration: NIST standardized ML-KEM (FIPS 203), ML-DSA (204), SLH-DSA (205); harvest-now-decrypt-later makes long-lived secrets urgent.
Privacy-enhancing tech: differential privacy adds calibrated noise to aggregates; homomorphic encryption computes on ciphertext; federated learning keeps data local but leaks via gradients.