Military Cyber Test cheat sheet

Cyberspace is defined in US doctrine as a global domain within the information environment consisting of interdependent networks of IT infrastructures and resident data; it is a man-made domain, unlike land, sea, air, and space.

The three cyberspace layers are physical (hardware, links, geography), logical (protocols, software, logical addressing), and cyber-persona (identities and accounts); effects can be planned at any layer independently of the others.

DOD cyberspace operations comprise three mission types: offensive cyberspace operations (OCO), defensive cyberspace operations (DCO), and DOD information network (DODIN) operations; DCO is further split into DCO-internal defensive measures (DCO-IDM) and DCO-response actions (DCO-RA).

Cyberspace attack is defined as actions that create denial, degradation, disruption, or destruction (D4) effects; exploitation (data exfiltration, intelligence gain) is distinct from attack and is not itself an attack under this definition.

The CIA triad (confidentiality, integrity, availability) plus non-repudiation and authentication are the standard security services; map each mission effect to the service it degrades before writing an objective.

DODIN operations are actions to design, build, configure, secure, operate, maintain, and sustain DOD networks; they are normally defensive and steady-state, and they are the foundation that enables OCO and DCO.

Active defense, as used in doctrine, means employing limited offensive actions and counterattacks to deny an adversary freedom of action in the network; it is not synonymous with passive monitoring.

Mission assurance is the protection of key capabilities and their supporting infrastructure; prioritize by mission impact (task critical assets) rather than by vulnerability count or CVSS score alone.

The cyber kill chain (reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objective) is a descriptive model, not a checklist; modern intrusion activity often skips or compresses stages.

Joint targeting cycle phases: end state and commander's objectives; target development and prioritization; capabilities analysis and force assignment; commander's decision and force assignment; mission planning and force execution; assessment.

Target development produces target system components, target system analysis, and entity-level nomination; each nominated target requires validated intelligence, a stated effect, and a measure of effectiveness before approval.

The joint munitions effectiveness manual concept applies to cyber as an effects-estimation problem: estimate probability of effect, collateral risk, and duration of effect, not just access.

A cyber capability is characterized by access (persistence, privilege), effect (D4 or exploitation), and duration; a plan that achieves access without a defined effect has no objective.

Deconfliction must cover both friendly-force collisions (two elements targeting the same host) and geographic/virtual boundaries; maintain a target list with unique identifiers and a no-strike list for protected systems.

Operational risk management for OCO weighs mission benefit against collateral effects, unintended propagation (self-replicating code, wormable exploits), and third-party systems sharing the same infrastructure.

Precision and reversibility are planning variables: payloads that persist, self-propagate, or destroy data raise escalation and collateral risk and generally require higher approval authority.

Measures of performance (was the payload delivered?) differ from measures of effectiveness (did the adversary's behavior change?); assessment must use the latter to judge mission success.

Operational security for the mission includes infrastructure segregation (attribution-resistant infrastructure), tooling fingerprint hygiene, and limiting the number of personnel with knowledge of the operation.

NIST SP 800-61 incident response lifecycle: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Containment strategy options are segmentation, isolation, and threat removal, chosen by balancing evidence preservation against operational impact.

Incident severity is typically scored on functional impact, information impact (confidentiality/integrity loss), and recoverability; these three factors drive escalation and notification decisions.

Order of volatility for evidence collection: CPU registers and cache, RAM and swap, network state (connections, ARP, routing), running processes, disk, remote logs, archival media. Collect most volatile first.

Chain of custody requires documented transfer of every item, hash values computed at acquisition (e.g., SHA-256 of an image), and storage in a controlled evidence repository; a break in custody can render evidence inadmissible or unusable.

Indicator types: atomic (IP, domain, hash, filename), computed (regex, YARA rule), and behavioral (TTP). Atomic indicators are cheap to change and decay quickly; behavioral detection is the most durable.

Defense in depth layers: perimeter (firewall, proxy, IDS/IPS), network segmentation and ACLs, endpoint (EDR, application allowlisting), identity (MFA, least privilege), data (encryption, DLP), and monitoring/logging.

Detection engineering uses the pyramid of pain: TTPs > tools > network/host artifacts > domains/IPs > hash values; prioritize detections that force the adversary to change behavior, not just infrastructure.

Eradication is not complete until the initial access vector is closed and persistence mechanisms are removed; reimaging without root-cause analysis risks reinfection by the same vector.

Post-incident activity includes lessons learned, detection gap analysis, and updating playbooks; document timeline reconstruction from log sources with synchronized time (NTP) to avoid ordering errors.

TCP three-way handshake: SYN, SYN-ACK, ACK. A scan producing many SYNs with RST responses indicates closed ports (connect/half-open scan); SYN floods exhaust the backlog with half-open connections.

TCP flags and their analytic meaning: SYN (connection initiation), FIN/RST (teardown or rejection), PSH (data push), URG. Unusual flag combinations (e.g., FIN+SYN, NULL scans) are common scan signatures.

Port and protocol reference: 22 SSH, 23 Telnet (cleartext), 25 SMTP, 53 DNS (UDP/TCP), 80 HTTP, 123 NTP, 161/162 SNMP, 389 LDAP, 443 HTTPS/TLS, 445 SMB, 3389 RDP, 5060 SIP.

DNS analysis: query types A, AAAA, MX, TXT, NS, CNAME, PTR; large TXT records, high-entropy subdomains, or long label sequences suggest DNS tunneling or data exfiltration.

TLS inspection limits: SNI reveals the requested hostname in the ClientHello (unless ECH is used), but the certificate subject is visible only in the server response; encrypted payloads require endpoint telemetry or TLS interception.

Beaconing detection: periodic connections of near-constant interval with jitter, small request/response sizes, and consistent destination are hallmarks of command-and-control; measure inter-arrival time variance.

NAT and proxy logs map internal hosts to external sessions; correlate by timestamp, source port, and session identifiers to attribute activity to a specific internal asset.

Network segmentation (VLANs, DMZs, enclaves, microsegmentation) limits lateral movement; east-west traffic analysis is often more valuable than north-south perimeter monitoring.

IPv6 considerations: no NAT by default, neighbor discovery replaces ARP, and extension headers complicate filtering; dual-stack networks often have weaker IPv6 monitoring than IPv4.

Windows authentication: NTLM challenge-response (hash usable in pass-the-hash), Kerberos (TGT from KDC, service ticket from TGS). Kerberoasting requests service tickets for offline cracking of weak service account passwords.

Windows persistence locations to audit: Run/RunOnce registry keys, scheduled tasks, services, WMI event subscriptions, startup folders, and logon scripts.

Windows event IDs of analytic value: 4624 logon, 4625 failed logon, 4672 special privileges assigned, 4688 process creation (requires audit policy), 4720 account created, 7045 service installed.

Linux persistence and privilege escalation: cron jobs, systemd units, ~/.bashrc, authorized_keys, SUID/SGID binaries, sudoers misconfigurations, and kernel exploits.

Linux authentication logs: /var/log/auth.log or /var/log/secure (sshd, sudo, su); failed then successful SSH logins from a new source indicate credential guessing or compromise.

Application allowlisting (e.g., AppLocker, WDAC) blocks execution of unapproved binaries and is a strong control against commodity malware; it is bypassed by living-off-the-land binaries if those are allowed.

Living-off-the-land binaries (LOLBins) such as PowerShell, certutil, rundll32, wmic, and mshta are signed system tools abused for download, execution, and evasion; monitor command-line content, not just process names.

Patch and configuration management: prioritize internet-facing and privilege-escalation vulnerabilities; CIS Benchmarks and STIGs provide measurable configuration baselines for hardening audits.

Endpoint detection and response relies on kernel-level telemetry (process trees, file writes, registry changes, network connections); alert on parent-child process anomalies such as Office spawning PowerShell.

Symmetric encryption (AES) is fast and used for bulk data; asymmetric encryption (RSA, ECC) is used for key exchange and digital signatures. Hybrid schemes combine both, as in TLS.

Key length guidance: AES-128/256 for symmetric; RSA >= 2048 bits (3072 preferred) or ECC P-256/P-384; SHA-256 or stronger for hashing. MD5 and SHA-1 are deprecated for security use.

Modes of operation: ECB is insecure (identical plaintext blocks produce identical ciphertext); CBC needs a random IV and is vulnerable to padding-oracle attacks without authentication; GCM provides authenticated encryption (AEAD).

Hashing provides integrity, not confidentiality, and is not encryption; a password must be stored with a salted, slow KDF (PBKDF2, bcrypt, scrypt, Argon2), never with a fast hash alone.

Digital signature = hash of message encrypted with the signer's private key; verification uses the signer's public key and provides integrity, authentication, and non-repudiation.

TLS handshake establishes a shared session key using ephemeral Diffie-Hellman (forward secrecy); certificate validation checks chain of trust, validity dates, hostname match, and revocation (CRL/OCSP).

PKI components: CA, registration authority, certificate repository, CRL/OCSP responder. Compromise of a CA private key compromises every certificate it issued.

Quantum risk: Shor's algorithm breaks RSA/ECC key exchange and signatures; Grover's algorithm halves effective symmetric strength, so AES-256 remains adequate. Plan migration to post-quantum algorithms.

Key management lifecycle: generation, distribution, storage, rotation, revocation, destruction. Keys stored alongside ciphertext or in code provide no protection.

Intelligence levels: strategic (leadership decisions, long horizon), operational (campaigns and intent), tactical (TTPs, indicators for immediate detection). Match the product to the consumer.

The intelligence cycle: requirements and planning, collection, processing, analysis and production, dissemination, and feedback. Requirements must be answerable and tied to a decision.

Structured analytic techniques (ACH, key assumptions check, red team analysis) mitigate cognitive bias; confidence levels and probability language must be defined and used consistently.

Attribution tiers: infrastructure, tooling, and victimology are technical indicators; true attribution requires all-source intelligence (SIGINT, HUMINT, geopolitical context) and should be stated with confidence, not certainty.

Adversary tradecraft maps to MITRE ATT&CK tactics: initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, C2, exfiltration, impact.

Threat actor taxonomy: nation-state/APT (persistent, resourced, strategic), criminal (financially motivated, ransomware), hacktivist (ideological, defacement/DDoS), insider (authorized access, hardest to detect).

Intelligence sharing standards: STIX for structured threat information, TAXII for transport, and indicator confidence/expiry metadata; sharing raw indicators without context produces false positives.

Collection sources: OSINT, commercial feeds, ISACs, government reporting, and internal telemetry. Internal telemetry is the highest-fidelity source for detecting targeting of your own network.

Warning analysis requires distinguishing capability from intent; a capable adversary with no observed intent does not automatically warrant the same response as an active campaign.

Jus ad bellum: use of force is governed by the UN Charter (Article 2(4) prohibition, Article 51 self-defense). A cyber operation causing effects equivalent to kinetic force (scale, severity, immediacy) may constitute a use of force.

Jus in bello (LOAC/IHL): distinction (military vs civilian objects), proportionality (expected collateral damage not excessive relative to anticipated military advantage), and precaution in attack. These apply to cyber operations in armed conflict.

The Tallinn Manual (a scholarly study, not law) analyzes how existing international law applies to cyber operations; it is persuasive authority, not binding treaty.

Sovereignty and non-intervention: a cyber operation violating another state's sovereignty or intervening in its domestic affairs (coercion) may be unlawful even below the use-of-force threshold.

Domestic legal authorities in the US: Title 10 (military operations), Title 50 (covert action, requires presidential finding), and the Computer Fraud and Abuse Act for civilian law enforcement. The Posse Comitatus Act limits domestic military enforcement.

Rules of engagement must specify authorized targets, prohibited effects, collateral-damage thresholds, self-defense authority, and the approval chain; ambiguity in ROE is resolved before execution, not during.

Duty to protect: commanders must take feasible precautions to protect civilians and civilian infrastructure, including data and networks that support civilian life (hospitals, power, water).

Neutrality and third-party systems: operations that transit or affect neutral states' infrastructure raise legal risk; consider whether the effect is intended or merely incidental.

Accountability: operations require legal review, recorded authorities, and audit trails; attribution and intent matter for both legal justification and policy escalation decisions.