NCCS cheat sheet

CIA triad: Confidentiality (unauthorized disclosure prevented), Integrity (unauthorized modification prevented), Availability (timely, reliable access). A control is mapped to the property it primarily protects.

Threat vs. vulnerability vs. risk: a threat is a potential cause of harm, a vulnerability is a weakness that a threat can exploit, and risk is the combination of likelihood and impact of that exploitation.

Defense in depth layers preventive, detective, and corrective controls; no single control is assumed sufficient, so failure of one layer is contained by the next.

Threat actor tiers: script kiddie (low skill, known tools), hacktivist (ideology), organized crime (financial), insider (authorized access), nation-state/APT (high resources, long dwell time, custom tooling).

Malware classes by propagation and payload: virus (needs host and user action), worm (self-propagating over network), trojan (disguised, no self-replication), ransomware (encrypts or exfiltrates for extortion), rootkit (persistence and hiding).

Social engineering exploits human trust rather than technical flaws: phishing, spear phishing (targeted), whaling (executives), vishing (voice), smishing (SMS), pretexting, and tailgating.

Kill chain phases in order: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives. Breaking any phase disrupts the intrusion.

MITRE ATT&CK organizes adversary behavior into tactics (the goal) and techniques (how the goal is achieved); it is used for detection coverage mapping, not for exploit execution.

Insider threat indicators include access outside role scope, bulk data movement before resignation, and off-hours privileged activity; detection relies on behavior baselines rather than perimeter controls.

Firewall rule evaluation: stateful firewalls track connection state and permit return traffic implicitly; stateless ACLs evaluate each packet independently and require explicit rules in both directions.

Default-deny is the baseline posture: the rule set ends with an implicit deny, and explicit allow rules are ordered most-specific to least-specific because evaluation stops at the first match.

DMZ (screened subnet) placement rule: internet-facing services sit in a segment reachable from the internet and from the internal network, but the internal network is not directly reachable from the DMZ.

IDS vs. IPS: an IDS passively detects and alerts on mirrored traffic; an IPS sits inline and can drop or reset malicious traffic. Signature-based detection misses zero-days; anomaly-based detection raises more false positives.

VPN types: site-to-site IPsec connects networks; remote-access VPNs (IPsec or TLS) connect individual users. IPsec modes are transport (payload protected, original IP header intact) and tunnel (entire packet encapsulated).

Network segmentation limits lateral movement; VLANs provide logical separation, but VLAN-hopping and misconfigured trunk ports mean security zoning should be enforced by firewalls or ACLs between segments.

DDoS mitigation categories: volumetric (bandwidth saturation, absorbed by scrubbing or CDN capacity), protocol/state exhaustion (SYN floods), and application-layer (HTTP floods, detected by behavioral rate analysis).

Wireless controls: WPA2/WPA3 with AES-CCMP is the minimum acceptable; WEP and WPA-TKIP are deprecated. WPA3 adds SAE, which resists offline dictionary attacks on captured handshakes.

NAC enforces endpoint posture (patch level, AV presence, credentials) before granting network access; 802.1X with RADIUS is the standard enforcement mechanism.

Baseline hardening order: remove unneeded services and accounts, apply least functionality, patch, then enable logging and monitoring; hardening before monitoring avoids blind spots.

Antivirus signature detection matches known malware hashes and patterns; EDR adds behavioral analytics, process lineage tracking, memory inspection, and response actions such as isolation and kill.

Application allowlisting (default-deny execution) defeats unknown malware better than blocklisting, because blocklists always lag new variants.

Patch management tiers: critical/high severity on an accelerated cycle, moderate on a standard cycle, low on a deferred cycle; compensating controls (virtual patching, segmentation) apply when patching is not feasible.

Host-based firewall rules complement network firewalls by controlling traffic between processes on the same host and by restricting egress to known destinations.

Full-disk encryption protects data at rest on a lost or stolen device only when the key is not stored alongside the device; TPM-bound keys with pre-boot authentication are the stronger configuration.

Least privilege on endpoints means standard user accounts for daily work and elevation only when required; admin-to-admin lateral movement is a common privilege-escalation path.

Logging sources for host detection: OS security event logs, process creation (with command line), file integrity monitoring, and PowerShell or script-block logging. Absent these, endpoint telemetry is insufficient for investigation.

Mobile device management modes: BYOD (personal device, containerized corporate data), COPE (corporate-owned, personally enabled), and COBO (corporate-owned, business only); the mode determines what the organization may wipe.

Access control models: DAC (owner sets permissions), MAC (system-enforced labels, e.g., classification clearance), RBAC (permissions tied to role), ABAC (attributes such as department, time, location, and resource sensitivity).

Authentication factors: something you know, something you have, something you are. MFA requires factors from different categories; two passwords are not MFA.

AAA components: authentication (verify identity), authorization (determine permitted actions), accounting (record activity). Each is a separate control with separate failure modes.

Least privilege and separation of duties: least privilege limits the scope of an account's rights; separation of duties ensures no single person can complete a sensitive transaction alone.

Identity lifecycle: provisioning, review/recertification, transfer (rights must be re-evaluated, not carried over), and deprovisioning. Orphaned accounts from missed deprovisioning are a leading audit finding.

SSO and federation: SAML and OIDC federate authentication across domains; the identity provider asserts identity, and the service provider trusts the assertion. Compromise of the IdP compromises all relying parties.

Privileged access management: vaulting, session recording, just-in-time elevation, and credential rotation for administrative accounts; shared admin accounts break accountability.

Zero trust principle: no implicit trust from network location; every request is authenticated and authorized per session based on identity, device posture, and context.

Biometric error rates: FRR (false rejection rate) and FAR (false acceptance rate) trade off against each other; the crossover point is the CER/EER, used to compare biometric systems.

Symmetric encryption (AES) is fast and used for bulk data; asymmetric encryption (RSA, ECC) is slow and used for key exchange and digital signatures. Hybrid schemes combine both.

Key length guidance: AES-128/192/256 for symmetric; RSA 2048-bit minimum, 3072+ preferred; ECC 256-bit provides roughly RSA-3072 strength.

Hashing (SHA-256, SHA-3) is one-way and used for integrity; a hash alone does not provide authentication. HMAC adds a shared secret to bind integrity to a key holder.

Digital signatures provide integrity, authentication, and non-repudiation: sign with the sender's private key, verify with the sender's public key. Encryption provides confidentiality, not non-repudiation.

PKI trust chain: root CA (self-signed, offline) signs intermediate CAs, which sign end-entity certificates. Validation checks signature chain, validity dates, revocation (CRL/OCSP), and name matching.

TLS provides confidentiality and integrity in transit; it does not protect data at rest. Certificate pinning reduces man-in-the-middle risk but complicates rotation.

Data states: at rest (encryption, tokenization, masking), in transit (TLS, IPsec), and in use (secure enclaves, homomorphic encryption, confidential computing).

Crypto failures to recognize: hard-coded keys, ECB mode (pattern leakage), static IVs, deprecated algorithms (MD5, SHA-1, DES, RC4), and self-signed certificates in production.

Data classification drives handling: public, internal, confidential, restricted. Retention and destruction rules attach to the classification, and secure destruction requires verified media sanitization.

Incident response phases in order: preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Containment precedes eradication to stop spread.

Containment options: isolate the host, disable the account, block the indicator at the perimeter, or segment the network. Choose based on business impact and attacker awareness.

Evidence handling: maintain chain of custody, capture volatile data first (memory, connections, processes) because it is lost on shutdown, then disk images with hash verification.

SIEM correlates logs from multiple sources and generates alerts; SOAR automates response playbooks. Neither replaces tuning - untuned rules produce alert fatigue and missed detections.

Key metrics: MTTD (mean time to detect), MTTR (mean time to respond/recover), alert volume, and false positive rate. Dwell time measures how long an intruder remains undetected.

Log retention and time synchronization: centralized logging with NTP-synced clocks is required for correlation and admissibility; short retention defeats retrospective investigation.

Tabletop exercises and post-incident reviews test the plan and update it; a plan that has never been exercised is assumed to have gaps.

Threat intelligence types: strategic (trends for leadership), tactical (TTPs for defenders), operational (campaign details), technical (IOCs such as IPs, hashes, domains). IOCs age quickly; TTPs endure.

Business continuity vs. disaster recovery: BC keeps critical functions running during disruption; DR restores IT systems after. RTO is the maximum acceptable downtime; RPO is the maximum acceptable data loss.

Risk formula: risk = likelihood × impact. Qualitative scales (low/medium/high) are common; quantitative analysis uses SLE (asset value × exposure factor) and ALE (SLE × annualized rate of occurrence).

Risk treatment options: mitigate (apply controls), transfer (insurance, contracts), avoid (stop the activity), and accept (documented decision by the accountable owner). Acceptance without documentation is a governance failure.

Residual risk is what remains after controls; it must be accepted by management, not by the security team alone. Inherent risk is the risk before controls.

Control types: preventive, detective, corrective, deterrent, and compensating. Classify by what the control does, not by the technology used.

Frameworks map to different purposes: NIST CSF (outcomes: identify, protect, detect, respond, recover, govern), ISO 27001 (certifiable ISMS), CIS Controls (prioritized safeguards), SOC 2 (assurance report on trust criteria).

Governance structure: policies (management intent, mandatory), standards (specific requirements), procedures (step-by-step), and guidelines (recommended). Policies are approved at the executive level.

Third-party risk: vendor due diligence, contractual security requirements, right-to-audit clauses, and periodic reassessment proportional to data sensitivity and criticality.

Compliance vs. security: compliance is meeting a defined requirement at a point in time; security is reducing actual risk continuously. Passing an audit does not prove the absence of exploitable weaknesses.

Key risk indicators and KRIs track exposure trends; risk registers record owner, rating, treatment, and review date for each identified risk.

Shared responsibility model: the provider secures the cloud (facilities, hardware, hypervisor); the customer secures what is in the cloud (data, identities, configurations, and, for IaaS, the guest OS). The boundary shifts by service model (IaaS, PaaS, SaaS).

Cloud service models shift control: IaaS gives the customer OS-level control; PaaS gives application and data control; SaaS gives data and identity configuration control only.

Misconfiguration is the dominant cloud risk: publicly readable storage, overly permissive IAM, disabled logging, and unencrypted databases. Configuration scanning and policy-as-code address it.

Identity is the primary cloud perimeter: enforce least privilege, require MFA on privileged and root accounts, avoid long-lived access keys, and use role assumption with short-lived credentials.

Container security layers: image scanning for vulnerabilities, minimal base images, no secrets baked into layers, runtime protection, and admission control. Containers share the host kernel, so kernel isolation is weaker than VMs.

Serverless risks: over-privileged function roles, event injection, dependency vulnerabilities, and limited runtime visibility; per-function least privilege and dependency scanning are the primary controls.

Data residency and sovereignty: cloud regions determine where data is stored and processed; contractual and regulatory obligations may prohibit cross-border replication.

Zero trust and SASE converge network and identity controls: identity-aware proxies and microsegmentation replace perimeter trust for remote and cloud workloads.

AI/ML system risks: training data poisoning, model inversion and extraction, prompt injection against LLM applications, and unvetted third-party models; controls include input validation, output filtering, and provenance tracking.