NCCSA cheat sheet

CIA triad: Confidentiality protects disclosure, Integrity protects modification, Availability protects timely access; a control may support more than one leg and trade-offs between legs are explicit design decisions.

Least privilege grants the minimum rights needed for a task; separation of duties splits a sensitive action across two or more people so no single account can complete it alone.

Defense in depth layers preventive, detective, and corrective controls so that failure of one layer does not expose the asset; no single control is assumed perfect.

Fail-safe defaults: a system denied access on error (fail closed) is chosen for high-integrity assets; fail-open is chosen only where availability outweighs exposure risk.

Authentication proves identity, authorization decides permitted actions, and accountability ties actions to an identity through logging; each is a separate control objective.

Non-repudiation requires evidence binding an action to a principal, typically digital signatures or tamper-evident audit logs, not merely a password login.

Threat modeling identifies assets, entry points, and trust boundaries, then enumerates threats (for example STRIDE categories) before controls are selected.

Zero trust removes implicit trust from the network location and evaluates every request on identity, device posture, and policy each time.

OSI layer mapping for controls: layer 3 filtering by IP, layer 4 by port and protocol, layer 7 by application content; placement of a control determines what it can inspect.

Stateful firewalls track connection state and permit return traffic for established sessions; stateless ACLs must explicitly permit both directions.

A DMZ segments internet-facing services from internal networks so a compromise of a public host does not grant direct internal access.

IPsec provides confidentiality and integrity at layer 3 via AH (integrity only) or ESP (encryption plus integrity); TLS protects at the transport/session layer for specific applications.

VLANs segment broadcast domains but are not a security boundary by themselves; inter-VLAN traffic must pass a policy enforcement point.

Common service ports: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 443 HTTPS, 3389 RDP; port and protocol anomalies are a primary network detection signal.

DNS security: DNSSEC signs records for origin authenticity and integrity but does not encrypt queries; DNS over HTTPS or TLS adds confidentiality.

Wireless: WPA2/WPA3 with AES-CCMP or GCMP replaces WEP; 802.1X with EAP authenticates users or devices before network access is granted.

Patch priority is driven by exploitability and exposure: internet-facing, remotely exploitable, no-authentication vulnerabilities are remediated first.

Application allowlisting permits only approved executables by hash or publisher, blocking unknown malware even without a signature; denylisting only blocks known-bad items.

EDR collects process, file, network, and registry telemetry and enables response actions such as isolate host, kill process, and quarantine file.

Full-disk encryption protects data at rest when a device is lost or stolen; it does not protect data from a logged-in user or running malware.

Host hardening baseline: disable unused services and accounts, remove default credentials, enforce host firewall rules, enable logging, and restrict administrative rights.

Secure boot and measured boot verify boot chain integrity; TPM-backed attestation reports platform state to a policy decision point.

Configuration drift detection compares endpoints to a hardened baseline; unapproved change is treated as a finding, not merely a documentation gap.

Backup strategy: the 3-2-1 rule keeps three copies, on two media types, with one offsite; at least one copy must be offline or immutable to resist ransomware.

Access control models: DAC (owner grants), MAC (labels and clearances), RBAC (role membership), ABAC (attributes and policy) - choice follows how permissions are naturally expressed.

Multi-factor authentication combines factors from different categories (knowledge, possession, inherence); two passwords are single-factor, not MFA.

Federated identity uses SAML or OpenID Connect so a relying party trusts assertions from an identity provider without holding the credential.

Single sign-on improves usability and centralizes revocation, but compromise of the central identity extends reach, so the IdP becomes a tier-0 asset.

Privileged access management: vault credentials, use just-in-time elevation with time-bound grants, and record privileged sessions.

Credential storage uses salted, slow hashes (bcrypt, scrypt, Argon2) with per-user salts; fast hashes such as MD5 or SHA-1 are unsuitable for passwords.

Account lifecycle: joiner-mover-leaver processes must revoke access on role change and termination; orphaned accounts are a recurring audit finding.

Kerberos issues time-limited tickets from a KDC; ticket-granting-ticket theft enables pass-the-ticket attacks, so ticket lifetime and logon restrictions matter.

Risk = likelihood × impact; qualitative scales (high/medium/low) and quantitative methods (annualized loss expectancy) answer different questions and are chosen by decision need.

SLE = asset value × exposure factor; ALE = SLE × annualized rate of occurrence; control value is judged by ALE reduction versus control cost.

Risk responses: mitigate, transfer (insurance), avoid (stop the activity), accept (documented tolerance); each accepted risk needs an owner and review date.

Vulnerability versus threat versus risk: a vulnerability is a weakness, a threat is an actor or event that could exploit it, risk is the potential loss from that pairing.

CVSS base score reflects intrinsic severity; environmental and temporal metrics adjust it, and a high CVSS score on an unreachable host may still be low operational risk.

Threat categories: phishing and social engineering, malware including ransomware, supply chain compromise, insider misuse, and denial of service.

Threat intelligence feeds (IOC, TTP) inform detection but require context and expiry; stale indicators generate false positives.

Vulnerability management cycle: discover assets, scan, prioritize by exploitability and business criticality, remediate, then verify and rescan.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned.

Containment options: isolate host, disable account, block indicator at perimeter, or segment network; choice balances stopping spread against preserving evidence.

Order of volatility for evidence collection: CPU registers and cache, memory, network state, running processes, disk, remote logs, archival media.

Chain of custody records who handled evidence, when, and how; a documented hash of the image supports integrity verification.

SIEM correlates logs and alerts; detection quality depends on log coverage, time synchronization (NTP), and tuned rules rather than tool brand.

Key metrics: MTTD (mean time to detect) and MTTR (mean time to respond); both are measured from a defined start event.

Log retention must satisfy legal and investigative needs; short retention defeats retrospective investigation of slow or long-dwell intrusions.

Business continuity uses RTO (time to restore) and RPO (acceptable data loss) to set recovery design; DR tests validate that these targets are achievable.

Policy hierarchy: policy states intent and is mandatory; standards specify requirements; procedures give step-by-step instructions; guidelines are recommended practice.

Segregation of duties between policy author, control operator, and auditor prevents one person from both performing and attesting a control.

Risk register entries record asset, threat, likelihood, impact, owner, treatment, and review date; the register is the audit trail of risk decisions.

Compliance frameworks (ISO 27001, NIST CSF, PCI DSS, SOC 2) differ in purpose: certification, voluntary framework, contractual standard, and attestation report.

Data classification drives handling rules; regulated categories such as PII and PHI carry notification duties and retention limits set by law or contract.

Third-party risk: contracts must include security requirements, breach notification timelines, and right-to-audit clauses; assessments recur at defined intervals.

Audit evidence should be produced from systems of record, not reconstructed narratives; sampling scope and period are stated in the report.

Exceptions to policy require documented approval, compensating controls, and an expiry date; permanent undocumented exceptions are audit failures.