SCLE Module 17 cheat sheet

Confidentiality, integrity, and availability (the CIA triad) are the three canonical security objectives; each control is normally mapped to at least one of them.

Vulnerability is a weakness; threat is a potential cause of harm; risk is the combination of likelihood and impact of a threat exploiting a vulnerability.

Asset, threat agent, attack surface, and exposure factor are distinct terms: exposure factor is the percentage of asset value lost in a single incident.

SLE = asset value x exposure factor; ALE = SLE x annualized rate of occurrence (ARO).

Residual risk = total risk minus the effect of implemented controls; it is the risk the organization knowingly retains.

Defense in depth layers preventive, detective, and corrective controls so a single failure does not compromise the asset.

Authentication verifies identity, authorization grants permissions, and accountability ties actions to an identity via audit trails.

Least privilege, separation of duties, and need-to-know are foundational access principles that limit blast radius.

Security control categories: administrative (policy, training), technical (encryption, ACLs), and physical (locks, guards).

Risk treatment options are mitigate, transfer, avoid, and accept; acceptance must be documented with an owner and a review date.

A risk register records asset, threat, likelihood, impact, score, owner, treatment, and status for each identified risk.

Quantitative risk analysis uses monetary values (ALE, SLE); qualitative analysis uses ordinal scales and is faster but less defensible.

Policy sets management intent, standards are mandatory requirements, procedures are step-by-step instructions, and guidelines are recommended practice.

Compliance obligations typically include contractual terms, sector regulation, and data-protection law; map each control to the requirement it satisfies.

Segregation of duties prevents one person from initiating, approving, and recording the same transaction.

Third-party risk management requires due diligence before onboarding, contractual security clauses, and periodic reassessment.

Exception and risk-acceptance processes require senior sign-off when a control cannot be implemented or is deferred.

Governance bodies (board, steering committee, security council) set risk appetite and tolerance and review residual risk.

Trust boundaries exist wherever data or control passes between components with different privilege or ownership; place enforcement points there.

Segmentation and microsegmentation limit lateral movement; default-deny between zones is the baseline posture.

Zero trust replaces implicit network trust with per-request verification of identity, device posture, and context.

Fail-safe defaults: a failed control should deny access (fail closed) unless availability outweighs confidentiality for that asset.

Cryptography choices: symmetric (AES) for bulk data, asymmetric (RSA, ECC) for key exchange and signatures, hashing (SHA-256/3) for integrity.

Key management lifecycle: generation, distribution, storage, rotation, revocation, and destruction; keys must be protected separately from the data they encrypt.

Secure SDLC embeds threat modeling at design, static analysis in code, and security testing before release.

The principle of economy of mechanism favors simple, well-understood designs; complexity increases latent vulnerabilities.

Separation of environments (dev, test, production) prevents test data and test credentials from reaching production systems.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

Containment options are short-term (isolate host, block IP) and long-term (rebuild, reimage); preserve evidence before destructive actions.

Order of volatility: CPU registers and cache, memory, network state, disk, backups, and archival media - collect most volatile first.

Chain of custody documents who handled evidence, when, and how; hash evidence at acquisition to prove integrity.

Change management requires request, risk assessment, approval, scheduled window, rollback plan, and post-change verification.

Backup strategies: full, incremental (changes since last backup), and differential (changes since last full); test restoration, not just backup.

Business continuity uses RTO (maximum tolerable downtime) and RPO (maximum tolerable data loss) to size recovery capability.

Log retention and centralized logging support detection and forensics; time synchronization across sources is required for correlation.

Break-glass accounts and emergency change procedures must be tightly controlled, logged, and reviewed after use.

Vulnerability scanning identifies known weaknesses; penetration testing validates exploitability with authorized, scoped human effort.

False positive = alert on benign activity; false negative = missed malicious activity; tune to balance both, tracking each rate.

SIEM correlation rules combine log sources; alert fatigue from high false-positive volume degrades detection.

Sampling in audit: statistical sampling supports extrapolation, judgmental sampling does not.

Control testing types: design effectiveness (is the control designed right) and operating effectiveness (did it actually run).

Key performance and risk indicators (KPIs, KRIs) quantify control health; thresholds trigger escalation.

Penetration test rules of engagement define scope, timing, prohibited actions, and emergency contacts in writing.

Continuous monitoring uses automated checks against baselines; deviations raise findings that feed the risk register.

Assurance evidence should be reproducible: record tool versions, scope, timestamps, and results for re-verification.

Obtain written authorization before any testing; unauthorized access is unlawful even with good intent.

Scope creep during testing must be halted and re-authorized in writing; document out-of-scope discoveries without exploiting them.

Confidentiality obligations survive the engagement; client data must not be reused, disclosed, or retained beyond agreed terms.

Conflict of interest must be disclosed; decline engagements where objectivity cannot be maintained.

Report findings honestly: do not overstate or understate severity, and distinguish confirmed findings from observations.

Maintain competence within your certification scope; refer work outside your expertise to qualified parties.

Deliver reports with risk rating, evidence, business impact, and remediation guidance the client can act on.

Protect evidence and credentials; destroy or return sensitive material at engagement close per the agreement.

Follow the code of ethics of the certifying body; violations can lead to sanction regardless of client wishes.