NCJOSI cheat sheet

OSI layers map to controls: L2 MAC filtering and port security; L3 ACLs and routing policy; L4 stateful firewalling and port filtering; L7 application proxies and WAF.

TCP three-way handshake is SYN, SYN-ACK, ACK; a half-open SYN flood leaves many connections in SYN_RECEIVED state, distinguishable from completed sessions.

Private address ranges per RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 169.254.0.0/16 is link-local APIPA, and 127.0.0.0/8 is loopback.

A DMZ segments internet-facing services from the internal LAN; traffic from DMZ to LAN must be explicitly permitted, never implicit.

VLAN hopping via double-tagged 802.1Q frames is mitigated by disabling unused ports, setting native VLAN to an unused ID, and not trunking to hosts.

Stateful firewalls track connection state; stateless ACLs must permit return traffic explicitly or use established/related matching.

IPsec ESP provides confidentiality and integrity; AH provides integrity and authentication only, with no encryption.

NAT translates addresses at a boundary; PAT multiplexes many internal hosts over one public IP using source port translation.

Phishing is untargeted mass email; spear phishing is targeted; whaling targets executives; vishing uses voice and smishing uses SMS.

SQL injection is mitigated by parameterized queries, not by input blacklists; error-based, blind, and union-based are common variants.

Cross-site scripting types: reflected (payload in request), stored (payload persisted server-side), and DOM-based (sink in client-side JavaScript).

Ransomware kill chain: initial access, credential theft, lateral movement, data exfiltration, encryption; backups offline and immutable defeat the extortion.

MITRE ATT&CK organizes adversary behavior into tactics (the why) and techniques (the how); T1566 is phishing, T1486 is data encrypted for impact.

Supply chain attacks compromise trusted software or vendors, e.g., a trojanized update; indicators include unexpected outbound connections from signed binaries.

Zero-day means no vendor patch exists; exploitation is detected by behavior, not signature, so anomaly and EDR telemetry matter.

Social engineering exploits authority, urgency, and familiarity; pretexting fabricates a scenario, baiting offers something enticing.

SIEM correlates logs across sources; a use case defines the logic and threshold that triggers an alert, and tuning reduces false positives.

Syslog severity 0 is Emergency and 7 is Debug; lower numbers are more severe.

EDR records process, file, registry, and network telemetry on endpoints and supports containment actions such as host isolation.

Network detection via NetFlow or Zeek reveals beaconing: regular, low-volume callbacks at consistent intervals to a single destination.

Alert triage order: validate the alert, determine scope, check for true versus false positive, then escalate or close with documented rationale.

Log retention must satisfy both investigative need and legal hold; volatile evidence such as memory and ARP caches is lost on reboot.

NIDS is passive and alerts on a copy of traffic; NIPS is inline and can drop malicious packets but adds latency and a failure point.

Honeypots and honeytokens generate high-fidelity alerts because legitimate users have no reason to interact with them.

NIST IR lifecycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.

Order of volatility: CPU registers and cache, memory, network state, running processes, disk, remote logs, archival media.

Chain of custody documents who handled evidence, when, and why; a hash (SHA-256) taken at collection proves integrity.

Forensic imaging uses a write blocker; the image hash must match the source hash before analysis begins.

Containment options: isolate host from network, disable account, block IP or domain, revoke tokens; choose based on scope and attacker awareness.

Windows artifacts: Event ID 4624 logon, 4625 failed logon, 4688 process creation, 7045 service installation; ShimCache and Amcache show execution.

Linux artifacts: /var/log/auth.log, ~/.bash_history, cron entries, and file MAC times (modify, access, change) support timeline building.

Lessons learned is a post-incident step producing corrective actions with owners and due dates; it is not a blame exercise.

CVSS base score ranges 0.0-10.0; severity bands are None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical 9.0-10.0.

CVSS base metrics are exploitability (attack vector, complexity, privileges, user interaction) and impact (confidentiality, integrity, availability).

Risk = likelihood x impact; a critical CVSS score on an isolated, unreachable host can still be low organizational risk.

Qualitative scales (high/medium/low) are fast and subjective; quantitative uses monetary values such as SLE = asset value x exposure factor.

ALE = SLE x ARO (annualized rate of occurrence); use it to compare control cost against expected loss reduction.

Authenticated (credentialed) scans find far more than unauthenticated scans because they can read installed package versions and registry.

False positive means a reported vulnerability does not exist; false negative means an existing vulnerability was missed.

Patch priority combines severity, internet exposure, known exploitation (KEV catalog), and compensating controls already in place.

Symmetric ciphers (AES, ChaCha20) are fast and used for bulk data; asymmetric (RSA, ECC) solves key exchange and signatures but is slow.

AES key sizes are 128, 192, and 256 bits; block size is 128 bits. RSA key size recommendations start at 2048 bits, with 3072+ preferred.

Modes: ECB is insecure because identical plaintext blocks produce identical ciphertext; CBC needs a random IV; GCM provides authenticated encryption.

Hashes (SHA-256, SHA-3) are one-way and collision-resistant; MD5 and SHA-1 are deprecated for security use.

Digital signature = hash of message encrypted with sender's private key; verification uses the sender's public key and proves integrity plus origin.

TLS handshake negotiates cipher suite, authenticates the server certificate, and derives session keys; forward secrecy comes from ephemeral DH (ECDHE).

PKI trust: a certificate is trusted if a chain leads to a trusted root CA, the name matches, the validity period is current, and it is not revoked.

Data states: at rest (encryption, e.g., AES with KMS-managed keys), in transit (TLS, IPsec), and in use (confidential computing, memory encryption).

Authentication proves identity (something you know, have, are); authorization decides permissions; accounting logs activity.

MFA combines factors from different categories; two passwords are single-factor, and a password plus SMS code is two factors.

RBAC grants by role; ABAC evaluates attributes (department, time, device); MAC uses labels and clearance levels.

Least privilege grants the minimum access needed; separation of duties prevents one person from completing a sensitive transaction alone.

SSO with SAML or OIDC centralizes authentication; the identity provider asserts identity and the service provider consumes the assertion.

OAuth 2.0 is an authorization framework issuing access tokens; OpenID Connect adds an identity layer with an ID token (JWT).

Password storage uses salted, slow hashes (bcrypt, scrypt, Argon2), never plain or fast hashes like MD5/SHA-1.

Privileged access management: vault credentials, just-in-time elevation, session recording, and periodic recertification of entitlements.

Policy hierarchy: policy (management intent) > standard (mandatory requirements) > procedure (step-by-step) > guideline (recommended, non-binding).

Due care is acting on risk; due diligence is the ongoing effort to identify it. Negligence claims hinge on whether a reasonable standard was met.

GDPR governs EU personal data with 72-hour breach notification; HIPAA covers US protected health information; PCI DSS applies to cardholder data.

ISO/IEC 27001 specifies an information security management system (ISMS) with risk assessment, treatment, and continual improvement.

NIST Cybersecurity Framework functions: Identify, Protect, Detect, Respond, Recover; Governance was added in CSF 2.0.

Data classification (public, internal, confidential, restricted) drives handling, retention, and encryption requirements.

Acceptable use policy defines permitted use of organizational assets; violations are handled through the disciplinary process.

Third-party risk: vendor due diligence, contractual security requirements, right-to-audit clauses, and periodic reassessment.