NCCSI cheat sheet

CIA triad: Confidentiality (disclosure prevention), Integrity (unauthorized modification prevention), Availability (timely reliable access). Non-repudiation proves an action occurred and cannot be denied later.

Defense in depth layers administrative, technical, and physical controls so a single control failure does not expose the asset; each layer is independently evaluated.

Least privilege grants only the minimum rights needed for a task and for the minimum duration; separation of duties splits a critical process across two or more people so no single actor completes it alone.

Control types: preventive stops an event, detective identifies it, corrective restores after it, deterrent discourages it, compensating substitutes when a primary control is infeasible, recovery restores operations.

Governance documents hierarchy: policy (mandatory intent) > standard (specific mandatory requirements) > procedure (step-by-step) > guideline (recommended, non-binding).

Risk formula: risk = likelihood x impact. Qualitative uses ordinal scales; quantitative uses SLE (asset value x exposure factor), ALE = SLE x ARO.

Due care is the ongoing duty to maintain controls; due diligence is the investigation and verification that controls are appropriate. Negligence claims hinge on both.

Security awareness training is a control that reduces human-factor likelihood; it is distinct from role-based training required for privileged or regulated roles.

Access control models: DAC (owner assigns), MAC (labels and clearances, system enforces), RBAC (role membership grants rights), ABAC (attributes of subject, object, environment).

Authentication factors: something you know, something you have, something you are; MFA requires two or more different factor types, not two instances of one type.

AAA sequence: identification (claim an identity), authentication (verify it), authorization (grant rights), then accounting (log activity).

SSO trades convenience for blast radius: one compromised credential reaches all federated resources unless step-up authentication or conditional access is applied.

SAML is XML-based browser SSO for web apps; OAuth 2.0 delegates authorization via tokens; OIDC adds an identity layer on OAuth 2.0 issuing an ID token.

Password storage uses salted, slow hashing (bcrypt, scrypt, Argon2, PBKDF2). Plain hashes and fast hashes like MD5/SHA-1 are unsuitable for passwords.

Privileged access management covers vaulting, session recording, just-in-time elevation, and periodic recertification of admin accounts.

Access review: verify accounts against current job roles on a schedule; disable leavers immediately and remove orphaned or dormant accounts.

OSI layers: 1 physical, 2 data link (MAC, switch), 3 network (IP, router), 4 transport (TCP/UDP, ports), 5 session, 6 presentation, 7 application.

TCP three-way handshake is SYN, SYN-ACK, ACK; a SYN flood exhausts the half-open connection table and is mitigated by SYN cookies and rate limiting.

Firewall types: stateless packet filter (per-packet rules), stateful (tracks connection table), application-layer/proxy (inspects payload), next-gen (adds IPS, app awareness).

IDS detects and alerts (passive, often mirrored port); IPS sits inline and blocks. Signature detection matches known patterns; anomaly detection baselines normal behavior.

Network segmentation via VLANs, subnets, and ACLs limits lateral movement; a DMZ hosts externally reachable services separate from internal networks.

VPNs: IPsec (AH for integrity, ESP for encryption and integrity; IKE negotiates SAs) and TLS VPNs. AH does not encrypt payload.

Wi-Fi security progression: WEP (broken RC4) < WPA/TKIP < WPA2/AES-CCMP < WPA3/SAE. WPA3 replaces the PSK handshake with SAE to resist offline guessing.

DNS security: DNSSEC provides origin authentication and integrity via signatures, not confidentiality; DoH/DoT encrypt DNS in transit.

Hardening baseline: remove unused services, disable default accounts, rename or disable built-in administrator, apply least functionality, patch on a defined cadence.

EDR differs from antivirus by recording process telemetry, detecting behavioral anomalies, and enabling response actions such as isolate host and kill process.

Application allowlisting (permit known-good) is stronger against unknown malware than blocklisting (deny known-bad), which misses novel samples.

Patch management lifecycle: inventory, risk-rank, test, deploy, verify, and document exceptions with compensating controls.

Windows controls: Group Policy for centralized configuration, BitLocker for volume encryption, AppLocker/WDAC for execution control, LAPS for local admin password rotation.

Linux controls: file permissions (rwx, octal), sudo for delegated privilege, SELinux/AppArmor mandatory access control, and service minimization.

Mobile: MDM enforces configuration and remote wipe; MAM protects app data without full device control; BYOD raises data-ownership and privacy questions.

Logging and monitoring on endpoints should capture authentication events, privilege changes, and process creation; forward logs off-host so tampering does not erase evidence.

Symmetric ciphers use one shared key and are fast for bulk data (AES, ChaCha20). Asymmetric ciphers use key pairs and solve key distribution (RSA, ECC, Diffie-Hellman).

AES key sizes: 128, 192, 256 bits. Modes: ECB leaks patterns (avoid), CBC needs a random IV, GCM provides authenticated encryption (confidentiality plus integrity).

Hashing is one-way and collision-resistant (SHA-256, SHA-3). HMAC combines a hash with a shared key for message authentication without encryption.

Digital signature = hash the message, encrypt the hash with the sender's private key; verifier decrypts with the public key. Provides integrity, authenticity, non-repudiation, not confidentiality.

PKI: CA issues certificates binding a public key to an identity; the chain of trust runs leaf to intermediate to root; CRL and OCSP handle revocation.

Key management lifecycle: generate, distribute, store, rotate, archive, destroy. Keys should be protected in HSMs or KMS and never hardcoded in source.

Data states: at rest (encryption, tokenization, masking), in transit (TLS, IPsec), in use (confidential computing, secure enclaves).

Diffie-Hellman exchanges keys over an open channel; it provides no authentication by itself, so it is paired with certificates or signatures to stop man-in-the-middle attacks.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, post-incident lessons learned. Containment precedes eradication.

Containment options: isolate host, disable account, block IP or domain, segment network. Choose based on scope and business impact; preserve volatile evidence first.

Evidence order of volatility: CPU registers and cache, RAM, network connections, disk, remote logs, archival media. Capture most volatile first.

Chain of custody documents who handled evidence, when, and how; a break in the chain undermines admissibility. Forensics uses write blockers and hashes to prove integrity.

SOC tiers: T1 triage and alert validation, T2 investigation and response, T3 advanced hunting and threat intel. SIEM correlates logs; SOAR automates playbooks.

Key metrics: MTTD (mean time to detect), MTTR (mean time to respond), false positive rate, and alert dwell time.

Indicators of compromise include unusual outbound traffic, new admin accounts, unexpected scheduled tasks, and spikes in failed logins; indicators of attack focus on adversary behavior.

Business continuity vs disaster recovery: BC keeps critical functions running (RTO, RPO); DR restores systems after a disruption. BIA identifies critical processes and dependencies.

Risk treatment options: mitigate (apply controls), transfer (insurance, contract), avoid (stop the activity), accept (documented tolerance). Residual risk remains after treatment.

Qualitative risk uses scales like high/medium/low; quantitative uses monetary values. ALE = SLE x ARO; SLE = asset value x exposure factor.

Risk register records asset, threat, vulnerability, likelihood, impact, owner, treatment, and review date; it is a living document.

Frameworks: NIST CSF (identify, protect, detect, respond, recover; 2.0 adds govern), ISO/IEC 27001 (ISMS requirements), CIS Controls (prioritized safeguards), COBIT (IT governance).

Compliance regimes: GDPR (EU personal data, lawful basis, breach notification), HIPAA (US health data), PCI DSS (cardholder data), SOX (financial controls).

Audit evidence types: policies, configuration screenshots, logs, interview records, and test results. Sampling risk applies when auditing a subset of controls.

Third-party risk: vendor due diligence, contractual security requirements, right-to-audit clauses, and continuous monitoring of critical suppliers.

Gap analysis compares current state to a target framework or standard and produces a remediation plan with owners and deadlines.

Shared responsibility: provider secures the cloud (facilities, hypervisor, managed service internals); customer secures in the cloud (identity, data, configuration, patching per service model).

Service models shift responsibility: IaaS (customer patches OS and up), PaaS (customer secures app and data), SaaS (customer secures users, access, and data classification).

Identity is the primary cloud perimeter: enforce MFA, least-privilege IAM policies, role assumption instead of long-lived keys, and periodic access reviews.

Misconfiguration is a leading cloud breach cause: public storage buckets, overly permissive security groups, disabled logging. CSPM tools detect drift.

Container security: scan images for vulnerabilities, use minimal base images, run as non-root, sign images, and isolate with namespaces and network policies.

Secrets management: store credentials in a vault or managed secret store, rotate automatically, and never commit secrets to version control.

Zero trust replaces implicit network trust with continuous verification of identity, device posture, and context; microsegmentation limits east-west movement.

Emerging risks: AI/ML models face data poisoning, prompt injection, and model theft; IoT devices often ship with weak defaults, so network isolation and firmware management are essential.