LPI Security Essentials cheat sheet

CIA triad: Confidentiality (only authorized read access), Integrity (data unaltered and authentic), Availability (timely access for authorized users).

AAA model: Authentication proves identity, Authorization decides permitted actions, Accounting/Auditing records what happened.

Threat vs. vulnerability vs. risk: a threat is a potential cause of harm, a vulnerability is a weakness, and risk is the combination of likelihood and impact of a threat exploiting a vulnerability.

Defense in depth: layer independent controls (physical, network, host, application, data) so a single failure does not compromise the asset.

Principle of least privilege: every subject gets only the permissions required for its task, for the shortest time needed (just-in-time access).

Fail-safe defaults vs. fail-secure: deny by default when a control cannot decide; fail-open is only acceptable when safety of life outweighs confidentiality.

Attack categories: passive (eavesdropping, traffic analysis) vs. active (tampering, replay, spoofing, DoS); controls differ accordingly.

Security control types: preventive, detective, corrective, deterrent, compensating; map each control to a type when auditing a design.

Common malware classes: virus (needs host and user action), worm (self-propagating over networks), trojan (disguised payload), rootkit (hides persistence), ransomware (encrypts and extorts).

Symmetric ciphers (AES, ChaCha20) use one shared key: fast, suitable for bulk data; key distribution is the hard problem.

Asymmetric ciphers (RSA, ECC) use a public/private key pair: solve key distribution and enable signatures, but are ~100-1000x slower than symmetric.

Hybrid scheme: use asymmetric crypto to exchange or wrap a random symmetric session key, then encrypt the payload with AES-GCM or ChaCha20-Poly1305.

Hashing (SHA-256, SHA-3) is one-way and collision-resistant: used for integrity and password storage, never for confidentiality. MD5 and SHA-1 are broken for collision resistance.

Password storage: salted, slow KDFs (Argon2id, scrypt, bcrypt, PBKDF2) with per-user random salt; a fast hash like SHA-256 is unsuitable.

MAC vs. digital signature: HMAC uses a shared secret and proves integrity plus authenticity between two parties; a signature uses the private key and provides non-repudiation.

AEAD modes (GCM, CCM, Poly1305) provide confidentiality and integrity in one pass; a nonce/IV must never repeat under the same key.

TLS 1.3 handshake: ephemeral Diffie-Hellman (X25519) gives forward secrecy; server certificate proves identity; TLS 1.0/1.1 and SSL are deprecated.

Key management lifecycle: generation with a CSPRNG, distribution, storage (HSM, TPM, keyring), rotation, revocation, and secure destruction.

Hardening baseline: remove unused packages and services, disable default accounts, apply updates, and enable a host firewall with default-deny inbound.

Patch management: track CVEs, prioritize remotely exploitable and internet-facing services, and verify kernel/library versions after updates.

Full-disk encryption (LUKS/dm-crypt, BitLocker, FileVault) protects data at rest if the device is lost; it does not protect a running, unlocked system.

Secure Boot verifies the bootloader and kernel signature chain against enrolled keys; it prevents bootkits but does not guarantee the OS is patched.

Mobile/device controls: screen lock with strong PIN or biometrics, remote wipe, encrypted storage, and app sideloading restrictions.

Storage disposal: overwrite or crypto-erase (destroy the key) before reuse; degaussing works for magnetic media only, not SSDs or flash.

File permissions: Unix mode bits (rwx for owner/group/other), umask sets defaults, setuid/setgid and world-writable files are audit targets.

Least functionality on devices: disable unused radios (Bluetooth, NFC), USB ports where policy allows, and auto-run of removable media.

Logging and integrity: centralize logs, protect them from local tampering, and monitor for unexpected privilege escalation or new autostart entries.

Firewall rule order matters: rules are evaluated top-down, first match wins; default policy should be DROP for inbound.

Stateful vs. stateless: stateful firewalls track connection state and allow return traffic automatically; stateless filters need explicit rules for each direction.

NAT is not a security control: it hides internal addressing but does not inspect or block malicious payloads.

Segmentation: separate management, user, and server networks; a DMZ hosts internet-facing services isolated from the internal LAN.

VPN: IPsec (ESP/AH, IKE) at layer 3 or WireGuard/TLS-based tunnels; a VPN encrypts transit but does not authenticate application users.

IDS vs. IPS: IDS detects and alerts passively; IPS sits inline and can drop traffic. Signature-based detection misses novel attacks; anomaly-based raises false positives.

Common service exposures: SSH (22), RDP (3389), SMB (445), HTTP/S (80/443). Never expose management interfaces to the internet without a bastion or VPN.

DNS security: DNSSEC signs records for integrity, DoH/DoT encrypt queries for privacy; neither prevents phishing domains from resolving.

Zero trust: authenticate and authorize every request regardless of network location; micro-segmentation replaces the trusted-perimeter model.

Authentication factors: something you know (password/PIN), something you have (token, phone), something you are (biometric). MFA requires two or more distinct factor types.

Password guidance: length beats complexity; check against breached-password lists; never enforce forced periodic rotation without evidence of compromise.

Password managers and passkeys (FIDO2/WebAuthn) resist phishing because the credential is bound to the origin; TOTP is phishable, SMS OTP is weakest.

SSO and federation: SAML and OIDC/OpenID Connect delegate authentication to an IdP; OAuth 2.0 is authorization delegation, not authentication by itself.

Authorization models: RBAC (roles), ABAC (attributes), MAC (labels/clearances); choose by how dynamic the access rules must be.

Privacy principles (GDPR-style): lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, accountability.

Data subject rights: access, rectification, erasure, restriction, portability; controllers must respond within statutory deadlines.

Anonymization vs. pseudonymization: pseudonymized data is still personal data (re-identifiable with the key); anonymized data falls outside scope if re-identification is truly impossible.

Privacy by design: collect only what is needed, define retention periods, encrypt personal data at rest and in transit, and log access to sensitive records.