PAPA cheat sheet

Prompt injection is either direct (attacker text in the user turn) or indirect (malicious instructions embedded in retrieved documents, tool output, or web pages); defenses must treat all model-visible content as untrusted input.

Training-time threats: data poisoning corrupts the training set to embed backdoors; model poisoning alters weights directly. Backdoor triggers are rare input patterns that flip output only when present, so clean-validation accuracy does not detect them.

Model extraction (model stealing) is a confidentiality attack: the adversary queries the API to train a substitute model. Mitigations include query rate limiting, watermarking, and output perturbation.

Membership inference and attribute inference are privacy attacks on model outputs. Differential privacy during training, output truncation, and not exposing per-sample confidence scores reduce leakage.

Adversarial examples are inputs perturbed to change classification; transferability means a perturbation crafted on a surrogate model often fools the target. Adversarial training raises robustness but is not complete.

OWASP LLM Top 10 categories to know: prompt injection, insecure output handling, training data poisoning, model denial of service, supply chain, sensitive information disclosure, insecure plugin design, excessive agency, overreliance, model theft.

Excessive agency rule: an LLM should not be granted write, delete, or financial actions beyond its task; require human approval gates and least-privilege tool scopes for any irreversible action.

Insecure output handling means downstream systems execute or render model output without validation - the same sink classes as XSS/SQLi/SSRF. Model output is untrusted data, never trusted code or markup.

AI supply chain risk includes pretrained weights from public hubs, pickle-format model files that can execute code on load, and third-party plugins; prefer safetensors-style formats and pinned, scanned artifacts.

TCP three-way handshake: SYN, SYN-ACK, ACK. A SYN flood exhausts the backlog with half-open connections; SYN cookies avoid allocating state until the ACK arrives.

TLS 1.3 removes RSA key exchange and static DH, mandates forward secrecy via ephemeral (EC)DHE, and encrypts the handshake after ServerHello. TLS 1.2 with RSA key exchange lacks forward secrecy.

IPsec: AH provides integrity and authentication only; ESP provides confidentiality plus integrity. Transport mode protects payload; tunnel mode encapsulates the whole packet and is used for site-to-site VPNs.

NAT does not provide security; it breaks end-to-end reachability and complicates protocols that embed IP addresses. PAT overloads many internal flows onto one public IP using port translation.

Segmentation rule: place untrusted-facing services in a DMZ, enforce default-deny inter-zone policy, and require traffic to pass an inspecting control rather than routing directly between zones.

Common ports to recall: 22 SSH, 53 DNS, 80 HTTP, 123 NTP, 389/636 LDAP/LDAPS, 443 HTTPS, 445 SMB, 3389 RDP, 5060 SIP. DNS over 53 carries both UDP and TCP.

IDS vs IPS: an IDS detects and alerts passively (often via SPAN/TAP), an IPS sits inline and can drop. Signature detection matches known patterns; anomaly detection baselines normal behavior and yields more false positives.

ARP spoofing poisons the IP-to-MAC mapping on a LAN; defenses are dynamic ARP inspection and DHCP snooping. DNS cache poisoning targets resolver trust; DNSSEC authenticates origin but does not encrypt.

Incident response phases (NIST SP 800-61): preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Containment precedes eradication, and evidence preservation constrains containment choices.

Order of volatility for evidence collection: CPU registers and cache, RAM, swap/pagefile, network state, disk, remote logs, archival media. Collect volatile data first.

Chain of custody requires documenting who handled evidence, when, and why at every transfer; a hash (e.g., SHA-256) taken at acquisition proves integrity later.

SOC alert triage rule: true positive, false positive, or benign true positive. Severity derives from asset criticality and confirmed impact, not from raw alert volume.

MITRE ATT&CK tactics are the adversary's 'why' (e.g., Initial Access, Persistence, Privilege Escalation, Lateral Movement, Exfiltration); techniques are the 'how' and carry IDs such as T1059.

SIEM correlation combines normalized logs with rules and threat-intel matches; tuning reduces false positives by whitelisting known-good behavior rather than disabling the rule.

Log retention and time sync: NTP-normalized UTC timestamps are required to correlate across sources; skewed clocks break timeline reconstruction and can invalidate evidence.

Containment options: isolate host from network, disable account, block indicator at perimeter, revoke tokens/sessions. Isolating a host preserves memory for forensics; powering it off destroys volatile evidence.

Mean time to detect (MTTD) and mean time to respond (MTTR) are the core SOC metrics; reducing MTTD requires better telemetry coverage, not more analysts alone.

Shared responsibility: the provider secures the cloud (facilities, hypervisor, managed service internals); the customer secures what is in the cloud (identity, data, configuration, and anything they deploy). The boundary shifts by service model: IaaS, PaaS, SaaS.

Identity is the primary cloud perimeter. Enforce least privilege, avoid long-lived access keys, prefer federated/role-based short-lived credentials, and require MFA on privileged and root accounts.

Storage exposure rule: a bucket or blob is public only if policy grants it; check bucket policy, ACLs, and account-level public-access blocks together, since any one can override intent.

Encryption: at rest via provider-managed or customer-managed keys (KMS); in transit via TLS. Customer-managed keys enable revocation and separation of duties but add key-policy complexity.

Logging and detection baselines: control-plane audit logs (e.g., CloudTrail-style), flow logs, and configuration-change history should be centralized to an account the workload cannot modify.

Network controls in cloud: security groups are stateful and instance-level; network ACLs are stateless and subnet-level. Default-deny ingress plus explicit egress rules limits data exfiltration.

Misconfiguration is the leading cloud breach cause: public snapshots, permissive IAM roles, disabled logging, and unpatched images. Infrastructure-as-code scanning catches these pre-deployment.

Container and serverless risk: vulnerable base images, secrets baked into images, and over-privileged function roles. Immutable images plus short-lived role credentials reduce blast radius.

Multi-tenancy means provider-side isolation failures are catastrophic; customer-side controls (separate accounts/projects per environment, resource tagging) limit cross-environment impact.