SCLE Module 6 cheat sheet

Risk = Threat × Vulnerability × Impact; Annualized Loss Expectancy (ALE) = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO).

SLE = Asset Value (AV) × Exposure Factor (EF); EF is the percentage of asset value lost in a single incident.

Risk treatment options: avoid (eliminate activity), transfer (insurance/contract), mitigate (controls), accept (documented tolerance).

Due diligence is the investigation and verification of controls; due care is the ongoing application of those controls.

Quantitative risk analysis uses monetary values (ALE, SLE); qualitative uses ordinal scales (high/medium/low).

Business Impact Analysis (BIA) identifies critical business functions and sets Maximum Tolerable Downtime (MTD); Recovery Time Objective (RTO) ≤ MTD.

Recovery Point Objective (RPO) defines maximum acceptable data loss measured in time; it drives backup frequency.

Separation of duties prevents one person from completing a critical transaction alone; least privilege limits rights to the minimum needed.

Policies are management intent (mandatory); standards are specific requirements; procedures are step-by-step; guidelines are recommendations.

Data classification levels typically: public, internal/private, confidential, restricted/secret; each level maps to handling rules.

Data roles: owner (accountable, sets classification), custodian (implements controls), user (follows rules), processor (handles on behalf of controller).

Data states: at rest (storage encryption), in transit (TLS/IPsec), in use (memory encryption, secure enclaves).

Scoping and tailoring: reduce controls to those applicable to the system; no control is removed without documented justification.

Retention: data should be kept only as long as legally or operationally required; destruction must be verifiable (certificate of destruction).

Sanitization methods: clearing (logical overwrite), purging (degaussing, crypto-erase), destruction (physical shredding/incineration).

Asset inventory must record owner, location, classification, and value; unclassified assets default to the highest protection level until classified.

Privacy principles: collection limitation, purpose specification, use limitation, accountability; GDPR requires lawful basis and data subject rights.

Security models: Bell-LaPadula (confidentiality: no read up, no write down), Biba (integrity: no read down, no write up), Clark-Wilson (integrity via well-formed transactions).

Common Criteria evaluation levels EAL1–EAL7; higher EAL means more rigorous evaluation, not necessarily more secure.

TCSEC (Orange Book) divisions: D (minimal), C (discretionary), B (mandatory), A (verified); B1 = labeled security, B3 = security domains.

Trusted Computing Base (TCB) is the totality of protection mechanisms; the reference monitor must be tamper-proof, always invoked, and small enough to verify.

Cryptography: symmetric (AES, 3DES) is fast and uses one key; asymmetric (RSA, ECC) solves key distribution but is slow.

Hashing (SHA-256) provides integrity, not confidentiality; HMAC combines a hash with a shared secret for message authentication.

Digital signature = hash encrypted with sender's private key; provides integrity, authentication, and non-repudiation.

PKI: CA issues certificates binding identity to public key; CRL and OCSP provide revocation status.

Physical controls: CPTED (natural surveillance, access control), mantrap, fail-safe vs fail-secure locks (fail-safe opens on power loss for life safety).

OSI layers: Physical, Data Link, Network, Transport, Session, Presentation, Application; TCP/IP maps to Link, Internet, Transport, Application.

IPsec: AH provides integrity/authentication only; ESP provides confidentiality plus integrity; transport mode protects host-to-host, tunnel mode protects gateway-to-gateway.

TLS handshake establishes session keys using asymmetric crypto, then bulk data is encrypted symmetrically.

Network segmentation: VLANs isolate Layer 2 broadcast domains; subnets isolate Layer 3; DMZ hosts public-facing services.

Firewall types: packet filter (Layer 3/4), stateful inspection (tracks connections), application proxy (Layer 7, deep inspection).

IDS detects and alerts (passive); IPS detects and blocks (inline); signature-based vs anomaly-based detection trade false positives for unknown threats.

Wi-Fi security: WEP broken; WPA2 uses AES-CCMP; WPA3 uses SAE (Simultaneous Authentication of Equals) to resist offline dictionary attacks.

DDoS mitigation: rate limiting, anycast scrubbing, blackhole routing; SYN flood mitigated by SYN cookies.

Secure protocols replace insecure ones: SSH for Telnet, HTTPS for HTTP, SFTP/SCP for FTP, DNSSEC for DNS integrity.

AAA: Authentication (verify identity), Authorization (grant rights), Accounting (log activity).

Factors: something you know, have, are; MFA requires two or more different factor types.

Access control models: DAC (owner discretion), MAC (labels/clearance), RBAC (role-based), ABAC (attributes/policy).

Least privilege and need-to-know apply to both users and processes; privileged accounts require extra controls (PAM, just-in-time access).

SSO reduces password sprawl but concentrates risk; federation uses standards such as SAML 2.0 and OpenID Connect.

Kerberos: KDC issues TGT, then service tickets; mutual authentication; time synchronization is required to limit replay.

Password storage: salted hash with slow KDF (bcrypt, scrypt, Argon2); never store plaintext or fast unsalted hashes.

Biometrics: FAR (false accept rate) and FRR (false reject rate) trade off; CER/EER is where FAR equals FRR.

Provisioning/deprovisioning lifecycle: joiner-mover-leaver processes must revoke access promptly on termination.

Vulnerability scan identifies known weaknesses; penetration test exploits them to demonstrate impact; neither alone proves full security.

Scan types: authenticated (credentialed) scans find more internal issues; unauthenticated scans mimic external attacker view.

False positive = reported issue that is not real; false negative = real issue not reported (more dangerous).

CVSS base score combines exploitability and impact metrics; temporal and environmental metrics adjust the score.

Audit log requirements: sufficient detail, protected from modification, retained per policy, reviewed regularly.

Synthetic transactions monitor business process availability; real user monitoring (RUM) captures actual user experience.

Code review types: static analysis (source inspection), dynamic analysis (runtime), fuzzing (malformed input).

SOC reports: SOC 1 (financial controls), SOC 2 (trust services criteria), SOC 3 (public summary); Type I is point-in-time, Type II covers a period.

Disaster recovery test types from least to most disruptive: checklist review, tabletop, simulation, parallel, full interruption.

Incident response phases: preparation, detection/analysis, containment, eradication, recovery, lessons learned.

Containment options: isolate host, block IP, disable account; choose based on business impact and evidence preservation.

Evidence handling: maintain chain of custody, hash evidence (SHA-256), store in tamper-evident containers; order of volatility guides collection.

Backup types: full (all data), incremental (changes since last backup), differential (changes since last full); restoration speed vs storage trade-off.

Change management: request, approve, test, implement, back out; emergency changes require retrospective approval.

Configuration management baselines reduce drift; hardening guides (CIS Benchmarks) define secure settings.

Log management: centralize logs, synchronize clocks (NTP), protect integrity, set retention aligned to legal requirements.

Physical security: perimeter controls, CCTV retention, visitor logs, environmental controls (HVAC, fire suppression).

Malware categories: virus (needs host), worm (self-propagating), trojan (disguised), ransomware (encrypts for extortion), rootkit (hides).

SDLC phases: requirements, design, development, testing, deployment, maintenance; security activities belong in every phase.

OWASP Top 10 categories include injection, broken access control, cryptographic failures, insecure design, security misconfiguration.

Input validation: allowlist (preferred) vs denylist; validate on server side; encode output to prevent XSS.

SQL injection prevented by parameterized queries/prepared statements, not by client-side filtering.

DevSecOps integrates security into CI/CD: SAST in code commit, DAST in staging, dependency scanning in build.

Maturity models: SAMM and BSIMM assess software security practices; CMMI measures process maturity.

Secure coding: avoid hard-coded secrets, use vetted libraries, handle errors without leaking stack traces.

Testing types: unit, integration, system, acceptance; security testing adds SAST, DAST, IAST, fuzzing.

Threat modeling (STRIDE: spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) identifies design risks early.