CISSO cheat sheet

Risk = Threat × Vulnerability × Impact; Annualized Loss Expectancy (ALE) = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO).

SLE = Asset Value (AV) × Exposure Factor (EF); EF is the percentage of asset value lost in a single incident.

Residual risk = total risk minus the effect of controls; risk acceptance must be documented by the accountable asset or business owner, not by IT alone.

Risk treatment options are mitigate, transfer, avoid, and accept; control types are preventive, detective, corrective, deterrent, and compensating.

Qualitative analysis uses ordinal scales (high/medium/low); quantitative analysis uses monetary values and yields ALE, enabling cost-benefit comparison of controls.

Governance sets direction and accountability at the top; management executes. The security steering committee approves policy and risk appetite; senior management owns the overall risk posture.

Policy hierarchy: policy (mandatory intent) → standards (specific mandatory requirements) → procedures (step-by-step) → guidelines (recommended).

Separation of duties and least privilege are governance controls; the security function should not report to the IT operations group it is meant to oversee.

Key risk indicators and KRIs feed a risk register reviewed on a defined cadence; risk appetite is the amount of risk an organization is willing to accept.

Reference models: OSI seven layers vs. TCP/IP four layers; defense in depth layers people, process, and technology across physical, network, host, application, and data tiers.

Bell-LaPadula enforces confidentiality (no read up, no write down); Biba enforces integrity (no read down, no write up); Clark-Wilson uses well-formed transactions and separation of duty.

Common Criteria EAL1–EAL7 rates assurance; EAL4 is the typical commercial target. TCSEC used divisions D, C, B, A.

Cryptography: symmetric (AES) is fast and needs key distribution; asymmetric (RSA, ECC) solves key exchange and enables digital signatures; hashing (SHA-2/SHA-3) provides integrity, not confidentiality.

Digital signature provides authentication, integrity, and non-repudiation; it does not by itself provide confidentiality.

TLS combines asymmetric key exchange with symmetric bulk encryption; certificate validation chains to a trusted root CA.

Network segmentation, DMZs, and least-privilege firewall rules reduce attack surface; NAC enforces endpoint posture before network admission.

Change management and configuration baselines prevent operational drift; patch management cadence is defined by risk rating, not by vendor release date alone.

Zero trust removes implicit trust based on network location; every request is authenticated and authorized continuously.

Incident response lifecycle: preparation → detection and analysis → containment, eradication, and recovery → post-incident activity (lessons learned).

Order of volatility: CPU registers and cache → RAM → network state → running processes → disk → backups and archival media. Collect the most volatile first.

Forensic soundness requires a write blocker, hash verification (e.g., SHA-256) of the image, documented chain of custody, and evidence stored in a tamper-evident manner.

Recovery metrics: RTO is the maximum tolerable downtime; RPO is the maximum tolerable data loss (acceptable backup interval). MTD is the point at which the impact becomes unacceptable.

DR site types: hot (near-zero RTO, highest cost), warm (partial readiness), cold (space and power only, longest RTO).

BCP addresses business continuity during disruption; DR focuses on restoring IT infrastructure. BIA identifies critical processes and their dependencies.

Containment options include isolating the host, blocking the account, and segmenting the network; eradication removes the root cause before recovery.

Forensic imaging captures a bit-for-bit copy; live response captures volatile evidence but alters the system, so it must be documented.

Post-incident review produces corrective actions tracked to closure; metrics include time to detect, time to contain, and time to recover.

Accreditation is the formal authorization to operate (ATO) granted by an authorizing official based on the security assessment; certification is the assessment that supports it.

NIST RMF steps: categorize → select → implement → assess → authorize → monitor.

Common frameworks: ISO/IEC 27001 (ISMS requirements) and 27002 (controls); NIST SP 800-53 (control catalog); SOC 2 (trust services criteria); PCI DSS (cardholder data).

GDPR principles include lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, and accountability; breach notification generally within 72 hours.

Evidence types: best evidence is the original; secondary evidence is a copy; hearsay is generally inadmissible; direct evidence is firsthand, circumstantial is inferential.

Legal hold suspends routine destruction of records when litigation is reasonably anticipated; spoliation is the destruction of evidence.

Data classification (public, internal, confidential, restricted) drives handling, retention, and access controls.

Third-party risk: due diligence, contractual security clauses, right-to-audit, and continuous monitoring of vendors with access to sensitive data.

Compliance is adherence to requirements; it does not equal security. Audit findings must be tracked to remediation with an owner and due date.