NICA CCCA cheat sheet

CIA triad: Confidentiality (authorized disclosure only), Integrity (unauthorized modification prevented), Availability (timely, reliable access).

Risk = Threat x Vulnerability x Impact; a threat with no vulnerability yields no risk, and a vulnerability with no threat yields no risk.

Qualitative risk uses ordinal scales (High/Medium/Low); quantitative risk uses dollar values, SLE, ARO, and ALE.

SLE = Asset Value x Exposure Factor; ALE = SLE x Annualized Rate of Occurrence (ARO).

Risk responses: mitigate (reduce), transfer (insurance), avoid (eliminate activity), accept (retain with sign-off).

Residual risk = total risk minus controls applied; it must be documented and accepted by an accountable owner.

Due care = acting on known risk; due diligence = ongoing verification that controls and processes work.

Defense in depth layers preventive, detective, and corrective controls so no single failure exposes the asset.

Least privilege, separation of duties, and mandatory vacation/rotation are administrative controls against insider abuse.

OSI layers: 1 Physical, 2 Data Link, 3 Network, 4 Transport, 5 Session, 6 Presentation, 7 Application; map controls to the layer they act on.

Stateful firewalls track connection state; stateless ACLs filter per packet and cannot infer session context.

NGFW adds application identification, user identity, and IPS to traditional stateful filtering.

IDS detects and alerts (passive, often SPAN/TAP); IPS sits inline and can block (fail-open vs fail-closed is a design choice).

DMZ (screened subnet) hosts externally reachable services between two filtering points; internal hosts are not directly exposed.

802.1X port-based access control uses supplicant, authenticator (switch), and authentication server (RADIUS) roles.

VLAN hopping defenses: disable unused ports, avoid native VLAN 1, do not use access ports as trunks, set native VLAN to an unused ID.

Zero trust removes implicit network trust: every request is authenticated, authorized, and encrypted regardless of network location.

Segmentation (microsegmentation) limits lateral movement by enforcing east-west policy between workloads.

Detection categories: signature-based (known patterns, low false positives), anomaly-based (baseline deviation, higher false positives), behavior/heuristic.

SIEM aggregates logs, correlates events, and alerts; SOAR automates response playbooks against SIEM/EDR findings.

Log source priorities: authentication servers, EDR/AV, firewalls, DNS, proxy, cloud control planes, and critical application logs.

MITRE ATT&CK organizes adversary behavior into tactics (why) and techniques (how); use it to map detections and gaps.

Indicators of compromise (hashes, IPs, domains) are low-cost to change; TTPs are more durable detection targets.

Syslog severity 0 (Emergency) through 7 (Debug); NTP synchronization is required for reliable log correlation.

Honeytokens and canary files generate high-fidelity alerts because legitimate users have no reason to touch them.

File integrity monitoring (FIM) detects unauthorized change to critical system and configuration files.

NIST IR lifecycle: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.

Containment options: isolate host, disable account, block indicator, segment network; choose based on spread risk vs business impact.

Order of volatility (RFC 3227): CPU/cache, memory, network state, running processes, disk, remote logs, backups, archival media.

Capture memory before powering off; pulling the plug destroys volatile evidence. Hash evidence at collection and maintain chain of custody.

Eradication removes root cause (malware, persistence, vulnerable entry point); recovery restores validated, monitored service.

Post-incident review produces lessons learned, control gaps, and measurable corrective actions with owners and dates.

Escalation criteria and communication plans (internal, legal, regulator, customer) belong in the preparation phase.

Tabletop exercises validate the plan without production impact; they test decision-making and notification paths.

CVSS base score reflects intrinsic severity (0.0-10.0) and excludes environmental factors; temporal and environmental metrics adjust it.

CVE identifies a specific vulnerability; CWE classifies the weakness type; NVD enriches CVEs with CVSS and references.

Risk-based prioritization combines CVSS, exploitability (EPSS, known exploited vulnerabilities catalog), asset criticality, and exposure.

Scan types: unauthenticated (external view), authenticated (host configuration and patch level), and agent-based (continuous).

False positive = scanner reports an issue that does not exist; false negative = real issue missed; tune to balance both.

Patch cycle stages: inventory, scan, prioritize, test, deploy, verify, and document exceptions with compensating controls.

Penetration testing is authorized, scoped, rules-of-engagement-bound exploitation; scanning only identifies, it does not exploit.

SAST reviews source code, DAST tests running applications, and SCA identifies vulnerable third-party dependencies.

AAA: Authentication (prove identity), Authorization (grant rights), Accounting (log activity).

Factors: something you know, have, are; MFA requires two or more different factor types, not two instances of one type.

RBAC assigns permissions to roles, then users to roles; ABAC evaluates attributes (user, resource, environment) at request time.

SSO via SAML or OIDC centralizes authentication; federation trusts an external identity provider.

Kerberos uses a KDC, TGT, and service tickets; ticket-granting tickets are high-value targets for pass-the-ticket attacks.

Privileged access management: vault credentials, just-in-time elevation, session recording, and periodic recertification.

Access review (recertification) confirms entitlements remain appropriate; orphaned and dormant accounts are removed.

Password storage uses salted, slow hashes (bcrypt, scrypt, Argon2); fast hashes like MD5/SHA-1 are unsuitable for passwords.

Symmetric encryption (AES) is fast and used for bulk data; asymmetric (RSA, ECC) solves key distribution and enables signatures.

AES key sizes: 128, 192, 256 bits; prefer GCM/CCM authenticated modes to gain integrity plus confidentiality.

Hashing (SHA-256, SHA-3) is one-way and collision-resistant; HMAC adds a shared key for message authentication.

Digital signature = hash of message encrypted with sender's private key; verified with sender's public key, giving integrity, authenticity, non-repudiation.

TLS handshake: negotiate parameters, authenticate server via certificate, derive session keys (e.g., ECDHE) for forward secrecy.

PKI: CA signs certificates binding public key to identity; CRL and OCSP handle revocation; pinning and short lifetimes reduce exposure.

Data states: at rest (encryption, key management), in transit (TLS, IPsec), in use (confidential computing, memory protections).

Key management lifecycle: generation, distribution, storage, rotation, retirement, destruction; never hard-code keys in source.

Policy hierarchy: policy (intent) > standard (mandatory requirements) > procedure (steps) > guideline (recommended).

Frameworks: ISO/IEC 27001 (ISMS requirements), NIST CSF (Identify, Protect, Detect, Respond, Recover; Govern in 2.0), CIS Controls (safeguards).

Regulations vs frameworks: laws (GDPR, HIPAA) are mandatory; frameworks provide structure for meeting obligations.

Change management requires request, risk assessment, approval, testing, rollback plan, and post-implementation review.

Business continuity (sustain operations) vs disaster recovery (restore IT); RTO is max downtime, RPO is max data loss.

Metrics: MTTD, MTTR, patch latency, phishing failure rate, control coverage; report to management with trends and owners.

Third-party risk: due diligence, contractual security requirements, right-to-audit, and periodic reassessment of vendors.

Audit evidence must be complete, dated, and traceable to the control it supports; exceptions require documented risk acceptance.