Cybersecurity Foundation cheat sheet

CIA triad: Confidentiality (only authorized parties read data), Integrity (data is accurate and unaltered), Availability (systems and data are accessible when needed); every control can be mapped to at least one leg.

Non-repudiation means a party cannot credibly deny an action; it is achieved with digital signatures, signed audit logs, and trusted timestamps, not with encryption alone.

Authentication verifies identity; authorization determines permitted actions; accountability ties actions to an identity via logging. Authentication must precede authorization in any access decision.

Defense in depth layers independent controls (physical, network, host, application, data) so a single failure does not cause a breach; controls in the same layer that share a failure mode do not add depth.

Least privilege grants the minimum rights and duration needed for a task; separation of duties splits a sensitive action across two people so no single account can complete it alone.

Threat vs. vulnerability vs. risk: a threat is a potential cause of harm, a vulnerability is a weakness, risk is the combination of likelihood and impact of a threat exploiting a vulnerability.

Qualitative risk uses ordinal scales (high/medium/low); quantitative risk uses dollar figures via SLE = asset value x exposure factor and ALE = SLE x annualized rate of occurrence.

Identification vs. authentication vs. authorization: claiming an identity (username), proving it (password, token, biometric), then being granted access. Multifactor requires factors from different categories (know, have, are).

Zero Trust replaces implicit network trust with continuous verification: never trust, always verify, assume breach, and enforce least privilege per request regardless of network location.

Program lifecycle: establish scope and governance, assess risk, select and implement controls, monitor and measure, then improve; the cycle repeats and feeds the risk register.

Common control frameworks: NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover, plus Govern in CSF 2.0), ISO/IEC 27001 for an ISMS, CIS Controls for prioritized safeguards, SOC 2 for service providers.

Policy hierarchy: policy (management intent, mandatory), standard (specific mandatory requirements), procedure (step-by-step instructions), guideline (recommended, non-binding).

Risk treatment options are mitigate, transfer, avoid, and accept; each accepted risk needs a named owner, documented rationale, and a review date.

Security metrics split into lagging indicators (incidents, breaches, losses already incurred) and leading indicators (patch coverage, MFA adoption, mean time to detect) that predict future outcomes.

Incident response phases per NIST SP 800-61: preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Containment precedes eradication to limit spread.

Business continuity (keep critical operations running) and disaster recovery (restore IT systems after disruption) are supported by RTO (max tolerable downtime) and RPO (max tolerable data loss).

Third-party risk management requires due diligence before onboarding, contractual security requirements, and periodic reassessment; shared-responsibility models define which controls the provider versus the customer owns.

Awareness, training, and education differ in depth: awareness changes behavior broadly, training teaches role-specific skills, education builds deep expertise; phishing simulation results are a common program metric.