NSA Assessment cheat sheet

CIA triad: Confidentiality (encryption, access control), Integrity (hashing, MACs, digital signatures), Availability (redundancy, DDoS mitigation); each control maps to at least one leg.

Defense in depth layers: perimeter (firewall, IPS), network segmentation (VLAN, DMZ), host (HIDS, EDR), data (encryption, DLP), and identity (MFA, least privilege).

DMZ hosts externally reachable services (web, mail relays); internal hosts initiate connections outward, and DMZ-to-internal traffic is restricted by policy.

Stateful firewall tracks connection state (SYN, ESTABLISHED); stateless ACLs filter per packet only, so they cannot distinguish replies from new sessions.

NAT/PAT hides internal addressing and conserves IPv4 space but provides no authentication; treat it as obfuscation, not a security control.

Common TCP/UDP service ports: 22 SSH, 25 SMTP, 53 DNS, 80 HTTP, 123 NTP, 389 LDAP, 443 HTTPS, 445 SMB, 3389 RDP.

Risk = Threat x Vulnerability x Impact; a threat without an exposed vulnerability yields low risk, and a control that removes the vulnerability removes the risk.

Zero trust replaces implicit network trust with per-request verification: authenticate and authorize every session regardless of source subnet.

Reference models: OSI seven layers (Physical, Data Link, Network, Transport, Session, Presentation, Application); TCP/IP collapses to Link, Internet, Transport, Application.

Security models: Bell-LaPadula enforces confidentiality (no read up, no write down); Biba enforces integrity (no read down, no write up); Clark-Wilson uses well-formed transactions and separation of duties.

Trusted Computing Base is the totality of protection mechanisms; the reference monitor must be tamper-proof, always invoked, and small enough to be verifiable.

Common Criteria evaluation assurance levels run EAL1 (functionally tested) through EAL7 (formally verified design and test); higher EAL means greater assurance, not more features.

Fail-safe defaults: fail closed for access control (deny on error), fail open only where availability outweighs confidentiality, such as life-safety systems.

Segmentation patterns: screened subnet (DMZ behind one firewall), dual-homed host, and air gap; microsegmentation applies policy per workload rather than per subnet.

Single point of failure analysis: N+1 redundancy tolerates one component loss; geographic diversity addresses site-level loss; both require tested failover.

Attack surface reduction: disable unused services and ports, remove default accounts, minimize installed software, and restrict outbound egress.

Symmetric ciphers use one shared key: AES (128/192/256-bit keys, block size 128), 3DES (deprecated), ChaCha20 (stream). Symmetric is fast and used for bulk data.

Asymmetric ciphers use key pairs: RSA (2048-bit minimum, 3072+ preferred), ECC (P-256, P-384), Diffie-Hellman/ECDH for key agreement. Used for key exchange and signatures.

Modes: ECB is insecure (identical plaintext blocks produce identical ciphertext); CBC needs a random IV and is unauthenticated; GCM provides AEAD (confidentiality plus integrity).

Hash functions: SHA-256/SHA-3 for integrity; MD5 and SHA-1 are broken for collision resistance and must not be used for signatures.

HMAC = hash(key || message) construction providing message authentication and integrity; it does not provide confidentiality.

Digital signature = hash of message encrypted with signer's private key; verified with the public key, giving integrity, authentication, and non-repudiation.

PKI: CA signs certificates binding identity to public key; CRL and OCSP handle revocation; certificate validation checks chain, validity dates, and revocation status.

Key management lifecycle: generation with sufficient entropy, distribution, storage (HSM, KMS), rotation, and destruction; key compromise invalidates all data protected by it.

Perfect forward secrecy: ephemeral Diffie-Hellman (DHE/ECDHE) per session means compromise of the long-term key does not decrypt past sessions.

TCP three-way handshake: SYN, SYN-ACK, ACK; teardown uses FIN/ACK pairs or RST. Flags: SYN, ACK, FIN, RST, PSH, URG.

TCP vs UDP: TCP is connection-oriented with retransmission and ordering; UDP is connectionless with no delivery guarantee, used by DNS, DHCP, SNMP, and VoIP.

IPv4 header fields useful in analysis: TTL (decremented per hop, reveals hop count), protocol number (6 TCP, 17 UDP, 1 ICMP), and fragmentation flags.

ARP resolves IPv4 to MAC within a broadcast domain; it is unauthenticated, so ARP spoofing enables man-in-the-middle within a LAN.

DNS record types: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), NS (authority), TXT (verification/SPF/DKIM), PTR (reverse).

TLS handshake: ClientHello (supported ciphers, SNI), ServerHello plus certificate, key exchange, Finished; TLS 1.3 reduces to one round trip and removes legacy ciphers.

Packet capture analysis: Wireshark/BPF filters (host, port, tcp[tcpflags]); follow TCP stream to reconstruct application data; verify checksums to spot corruption.

ICMP types: 0 echo reply, 3 destination unreachable, 8 echo request, 11 time exceeded (traceroute relies on TTL expiry).

Incident response phases per NIST SP 800-61: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity.

Containment options: isolate host from network, block indicator at firewall/proxy, disable account, or segment; choose based on blast radius versus evidence preservation.

Evidence handling: order of volatility (CPU/registers, memory, network state, disk, backups); maintain chain of custody with hashes and timestamps.

MITRE ATT&CK tactics sequence: Reconnaissance, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact.

Detection sources: IDS/IPS signatures and anomalies, EDR telemetry, NetFlow, DNS logs, authentication logs, and proxy logs; correlate across sources to reduce false positives.

Indicator types: atomic (IP, hash, domain) are easy to change; behavioral (TTP-based) detection is more durable against attacker adaptation.

Ransomware response: isolate affected hosts, preserve a copy of encrypted files and notes, identify initial access vector, restore from verified offline backups.

Post-incident: root cause analysis, lessons learned, control gaps mapped to remediation owners, and updated detection rules.

SIEM aggregates logs, normalizes fields, correlates events, and alerts; log sources must be time-synchronized via NTP for correlation to work.

SOC tiers: Tier 1 triage and alert validation, Tier 2 investigation and response, Tier 3 hunting and advanced analysis; escalation follows defined criteria.

Alert tuning metrics: false positive rate, mean time to detect (MTTD), mean time to respond (MTTR); high false positive volume causes alert fatigue and missed detections.

Vulnerability management cycle: asset inventory, scan, prioritize (CVSS plus exploitability and exposure), remediate, verify, and report.

CVSS base score 0.0-10.0 with severity bands: None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical 9.0-10.0.

Patch management: test in a staging environment, deploy in rings, verify installation, and track exceptions with compensating controls.

Threat intelligence tiers: strategic (executive trends), operational (campaigns), tactical (TTPs), technical (indicators); feeds require vetting for accuracy and freshness.

Baseline monitoring: establish normal for traffic volume, login times, and process behavior; deviations trigger investigation.

Access control models: DAC (owner grants), MAC (labels and clearances), RBAC (role-based), ABAC (attribute-based, policy-driven).

Access control principles: least privilege, separation of duties, need to know; authorization decisions occur after authentication.

Authentication factors: something you know (password), have (token, smart card), are (biometrics); MFA requires two or more distinct factor types.

Kerberos: KDC issues TGT, then service tickets; timestamps limit replay; clock skew tolerance is typically five minutes.

Federation protocols: SAML (XML assertions for web SSO), OAuth 2.0 (authorization delegation), OIDC (identity layer on OAuth with ID token), RADIUS/TACACS+ (network device AAA).

Password storage: salted, slow hash (bcrypt, scrypt, Argon2, PBKDF2); never store plaintext or unsalted fast hashes like MD5.

Privileged access management: vault credentials, session recording, just-in-time elevation, and periodic recertification of privileged accounts.

Identity lifecycle: provisioning on join, modification on role change, deprovisioning on leave; orphaned accounts are a common audit finding.