Cambridge SC cheat sheet

CIA triad: Confidentiality (authorised disclosure only), Integrity (accuracy and completeness), Availability (timely, reliable access); a control is judged by which of the three it serves.

Threat = potential cause of an incident; vulnerability = weakness that a threat can exploit; risk = likelihood × impact of that exploitation against an asset.

Defence in depth layers preventive, detective and corrective controls so that failure of one layer does not expose the asset directly.

Threat actor types: script kiddie, insider, organised crime, hacktivist, nation-state; capability and persistence generally rise along that list.

Malware classes: virus (needs host and user action), worm (self-propagating over networks), trojan (disguised payload), ransomware (encrypts and extorts), rootkit (hides at kernel/firmware level).

Social engineering exploits human trust: phishing, spear phishing, vishing, smishing, pretexting, tailgating; technical controls alone do not stop it.

Common web attack patterns: SQL injection, cross-site scripting, cross-site request forgery, SSRF, insecure deserialisation; each maps to an input-validation or output-encoding control.

Kill chain / MITRE ATT&CK stages run reconnaissance, initial access, execution, persistence, privilege escalation, lateral movement, exfiltration, impact; detection value rises earlier in the chain.

Vulnerability scoring: CVSS base score 0.0–10.0 with Critical ≥9.0; EPSS estimates exploitation probability; prioritise by exposure and known exploitation, not score alone.

Authentication proves identity; authorisation decides permitted actions; accountability ties actions to an identity via logging - all three are needed for a complete access control story.

Factors: something you know, something you have, something you are; MFA requires two or more different factor types, not two instances of the same type.

Access control models: DAC (owner discretion), MAC (labels/clearances), RBAC (roles), ABAC (attributes/policy), rule-based (e.g. time or location conditions).

Least privilege and separation of duties limit blast radius; need-to-know restricts data access beyond role permissions.

Password storage uses salted, slow hashes (bcrypt, scrypt, Argon2); plain SHA-256 is unsuitable because it is fast and unsalted hashes permit rainbow-table attacks.

Session management: random high-entropy session identifiers, Secure and HttpOnly cookie flags, rotation on privilege change, idle and absolute timeouts, server-side invalidation on logout.

SSO and federation rely on SAML or OpenID Connect; OAuth 2.0 is an authorisation delegation framework and is not itself an authentication protocol.

Zero trust removes implicit network trust: every request is authenticated and authorised per session using identity, device posture and context, independent of network location.

Privileged access management: vault credentials, just-in-time elevation, session recording, and periodic recertification of privileged accounts.

Symmetric ciphers (AES) are fast and used for bulk data; asymmetric ciphers (RSA, ECC) solve key distribution and enable signatures; hybrid schemes use asymmetric to exchange a symmetric key.

AES key sizes 128/192/256 bits; RSA key sizes commonly 2048–4096 bits; ECC gives equivalent strength at much shorter key lengths (P-256 ≈ RSA 3072).

Hashing is one-way and collision-resistant (SHA-256, SHA-3); it provides integrity, not confidentiality; MD5 and SHA-1 are deprecated for security use.

HMAC combines a hash with a shared secret to give message integrity and authenticity without encryption.

Digital signature = hash of the message encrypted with the sender's private key; verification uses the sender's public key and proves integrity, authenticity and non-repudiation.

PKI trust chain: root CA (self-signed) → intermediate CA → end-entity certificate; each certificate is validated up to a trusted root in the trust store.

Modes of operation: ECB leaks patterns and must not be used for data; CBC needs a random IV and is unauthenticated; GCM provides authenticated encryption (confidentiality plus integrity).

Key management lifecycle: generation, distribution, storage, rotation, retirement and destruction; keys held in HSM or KMS, never hard-coded in source.

Data states: at rest (encryption, tokenisation, masking), in transit (TLS 1.2+/1.3, HSTS), in use (confidential computing, secure enclaves).

OSI layers map to controls: L2 MAC filtering and VLANs, L3 ACLs and routing, L4 stateful firewalls and port filtering, L7 proxies, WAF and content inspection.

TCP three-way handshake SYN → SYN/ACK → ACK; a SYN flood exhausts the half-open connection table and is mitigated by SYN cookies and rate limiting.

Firewall types: packet filter (stateless, header only), stateful inspection (tracks connections), next-generation firewall (application awareness, IPS, TLS inspection).

Network segmentation by VLAN, subnet and security group limits lateral movement; a DMZ hosts internet-facing services separated from the internal network.

IDS detects and alerts (passive); IPS detects and blocks inline; signature detection misses unknown attacks, anomaly detection produces more false positives.

TLS hardening: disable TLS 1.0/1.1 and SSL, prefer TLS 1.3, restrict cipher suites to AEAD, enforce HSTS, validate certificates and pin where risk warrants.

VPNs (IPsec, TLS-based) protect traffic over untrusted networks; IPsec uses AH for integrity and ESP for confidentiality plus integrity.

Wireless: WPA2/WPA3 with AES-CCMP; WEP and WPA-TKIP are broken; 802.1X with EAP provides port-based network access control.

DNS risks include cache poisoning, tunnelling and spoofing; mitigations are DNSSEC, resolver hardening and monitoring of anomalous query patterns.

SDL phases: requirements (security and privacy requirements), design (threat modelling), implementation (secure coding standards), verification (SAST, DAST, SCA, penetration testing), release and response.

STRIDE threat categories: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.

SAST analyses source without executing it (early, high false positives); DAST tests a running application (later, runtime issues); SCA finds vulnerable third-party dependencies.

OWASP Top 10 categories include broken access control, injection, cryptographic failures, insecure design, security misconfiguration and vulnerable components.

Input validation is allow-list based at trust boundaries; output encoding is context-specific (HTML, attribute, JavaScript, URL) to prevent XSS.

Parameterised queries and prepared statements prevent SQL injection; string concatenation of user input into queries must never be used.

Secrets management: no credentials in code or repositories, use a vault or environment-injected secrets, scan commits and rotate on exposure.

CI/CD pipeline security: signed commits and artefacts, pinned dependency versions, least-privilege build agents, automated scanning gates before deployment.

Secure configuration baselines (CIS Benchmarks) and patch management reduce exposure; immutable infrastructure and IaC scanning catch drift early.

Incident response lifecycle: preparation, detection and analysis, containment, eradication, recovery, post-incident lessons learned.

Containment options: isolate host from network, disable account, block indicator at perimeter, revoke credentials; choose based on business impact and attacker awareness.

Order of volatility for evidence: CPU registers and cache, memory, network state, running processes, disk, remote logs, archival media - collect most volatile first.

Chain of custody records who handled evidence, when and why; hashing evidence at collection supports later integrity verification.

SOC tiers: Tier 1 triage and alert closure, Tier 2 investigation and response, Tier 3 threat hunting and advanced analysis; escalation paths must be defined.

SIEM correlates logs against detection rules; tuning reduces false positives; use cases cover authentication anomalies, privilege changes, data egress and malware alerts.

Key metrics: MTTD (mean time to detect), MTTA (acknowledge), MTTR (respond/recover); track trends rather than single incidents.

Forensic soundness: write blockers for disk imaging, memory capture before shutdown, timeline analysis, and preservation of logs with synchronised time sources.

Business continuity and disaster recovery: RTO is maximum tolerable downtime, RPO is maximum tolerable data loss; backups must be tested and protected from ransomware.

Risk treatment options: mitigate (control), transfer (insurance, contract), avoid (stop activity), accept (documented residual risk with owner sign-off).

Risk assessment: identify assets and threats, assess likelihood and impact, calculate inherent risk, apply controls, then record residual risk.

Risk register holds asset, threat, vulnerability, likelihood, impact, score, owner, treatment and review date; it is a living document.

Control types: preventive, detective, corrective, deterrent, compensating; categories are administrative, technical and physical.

Frameworks: ISO/IEC 27001 for an ISMS (certifiable), NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover, plus Govern), COBIT for IT governance, SOC 2 for service organisations.

Compliance is not security: meeting a standard is a baseline; effectiveness requires testing, measurement and continuous improvement.

Policies sit above standards (mandatory specifics), procedures (step-by-step) and guidelines (recommended practice); all require ownership and review cycles.

Third-party risk: due diligence before contracting, contractual security and breach-notification clauses, right to audit, and periodic reassessment.

Audit evidence includes logs, configurations, tickets, training records and test results; segregation of duties applies to those who produce and review evidence.

Data protection principles (GDPR-style): lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability.

Personal data is any information relating to an identified or identifiable natural person; special categories (health, biometrics, ethnicity, religion, sexual orientation) need extra lawful basis.

Lawful bases: consent, contract, legal obligation, vital interests, public task, legitimate interests; consent must be freely given, specific, informed and withdrawable.

Data subject rights: access, rectification, erasure, restriction, portability, objection; requests usually must be answered within one month under GDPR.

Privacy by design and by default: minimise collection, pseudonymise or anonymise, restrict access, set retention limits at design time rather than retrofitting.

Roles: controller determines purpose and means; processor acts on the controller's instructions; a written data processing agreement is required between them.

Breach notification: GDPR requires supervisory-authority notification within 72 hours of awareness where risk to individuals exists, and notification to affected individuals where risk is high.

Cross-border transfers require a valid mechanism such as an adequacy decision, standard contractual clauses, or binding corporate rules.

Privacy impact assessment (DPIA) is required for high-risk processing such as large-scale monitoring or special-category data; record outcomes and mitigations.