ICSP CS cheat sheet

Risk = Threat x Vulnerability x Impact; SLE = Asset Value x Exposure Factor; ALE = SLE x Annualized Rate of Occurrence.

Qualitative analysis ranks risk by ordinal scales; quantitative analysis assigns monetary values and supports cost-benefit comparison against control cost.

Risk treatment options are mitigate, transfer, avoid, and accept; residual risk remains after controls and must be formally accepted by management.

Due care is the standard of prudence expected of a reasonable organization; due diligence is the ongoing verification that controls work.

Policies are management intent and mandatory; standards are specific mandatory requirements; procedures are step-by-step instructions; guidelines are recommended.

Separation of duties prevents one person from completing a critical transaction alone; least privilege limits rights to those needed for the task.

Business impact analysis identifies critical business functions, RTO (maximum tolerable downtime) and RPO (maximum tolerable data loss) before recovery strategy selection.

Key risk indicators are leading metrics that signal rising exposure; KPIs measure performance and KRIs measure risk, and both feed management review.

Access control models: DAC (owner discretion), MAC (labels and clearances), RBAC (role-based), ABAC (attribute-based, policy-driven).

Authentication factors are knowledge (something you know), possession (something you have), inherence (something you are); two factors must come from different categories.

Identification claims an identity; authentication verifies it; authorization determines permitted actions; accountability ties actions to an identity via logging.

Biometric error rates: FRR (Type I, valid user rejected) and FAR (Type II, impostor accepted); the crossover error rate compares systems, lower is better.

SSO reduces credential sprawl but concentrates risk; federation protocols include SAML, OAuth 2.0 (authorization) and OpenID Connect (authentication).

Physical controls include mantraps, turnstiles, and piggybacking prevention; tailgating is following an authorized person through a controlled door.

Access review and recertification removes stale entitlements; privileged access management vaults and rotates administrative credentials.

RADIUS and TACACS+ centralize AAA for network devices; TACACS+ encrypts the full payload and separates authentication from authorization.

Symmetric ciphers (AES, 3DES) are fast and used for bulk data; asymmetric ciphers (RSA, ECC) solve key distribution and enable signatures.

AES block size is 128 bits with 128/192/256-bit keys; RSA security depends on factoring difficulty; ECC achieves equivalent strength with shorter keys.

Hashing (SHA-256, SHA-3) provides integrity and is one-way; HMAC combines a hash with a shared key for message authentication.

Digital signature = hash of message encrypted with sender's private key; verification uses sender's public key and proves integrity, authenticity, nonrepudiation.

Public key infrastructure binds keys to identities via certificates signed by a CA; CRL and OCSP communicate revocation status.

Modes: ECB is insecure for multi-block data; CBC needs a unique IV; GCM provides authenticated encryption (confidentiality plus integrity).

Key management lifecycle: generation, distribution, storage, rotation, archival/recovery, destruction; key escrow enables recovery but adds risk.

Steganography hides the existence of data; cryptography hides content. Salting defeats rainbow tables; PBKDF2, bcrypt, Argon2 slow password guessing.

OSI mapping: IP and ICMP at layer 3; TCP/UDP at layer 4; TLS, SSH at upper layers; ARP maps IP to MAC within a broadcast domain.

TLS provides confidentiality, integrity and server authentication; certificate validation failure means the client cannot trust the presented key.

IPsec: AH provides integrity and authentication only; ESP provides confidentiality plus integrity; IKE negotiates SAs; transport mode vs tunnel mode.

Firewall types: packet filter (L3/L4), stateful inspection (connection state), application proxy/WAF (L7 content inspection).

Network segmentation and DMZs limit lateral movement; VLANs separate broadcast domains; NAC enforces endpoint posture before network admission.

Attacks: ARP spoofing and DNS poisoning target name resolution; MITM intercepts; DDoS exhausts availability; SYN flood consumes half-open connections.

802.1X port-based NAC uses supplicant, authenticator and authentication server; EAP variants differ in whether they require server certificates.

Wireless: WPA2 uses AES-CCMP, WPA3 uses SAE to resist offline dictionary attacks; WEP and WPA/TKIP are deprecated.

Security models: Bell-LaPadula (confidentiality, no read up/no write down), Biba (integrity, no read down/no write up), Clark-Wilson (well-formed transactions).

Common Criteria evaluates products at EAL levels; TCSEC (Orange Book) defined D through A divisions; both assess assurance, not fitness for a specific site.

Trusted computing base is the totality of protection mechanisms; a security kernel mediates all access and must be verifiable and tamper-resistant.

Reference monitor properties: complete mediation, isolation/tamper-proof, verifiability.

Defense in depth layers controls; a single point of failure defeats it. Fail-safe defaults deny access on failure; fail-open permits it.

Virtualization risks include VM escape, hypervisor compromise and resource contention; containers share the host kernel so isolation is weaker than VMs.

Cryptographic module standards: FIPS 140-3 validates module security; side-channel attacks exploit timing, power or cache behavior rather than algorithm weakness.

Site controls: HVAC and humidity limits protect hardware; fire suppression uses clean agents (FM-200, inert gas) where water would damage equipment.

Vulnerability scanning enumerates known weaknesses; penetration testing actively exploits them to prove impact; both require authorization and scope.

Black-box tests with no internal knowledge; white-box provides full knowledge; gray-box is partial.

False positive = reported vulnerability that does not exist; false negative = missed real vulnerability; tune scanners to balance both.

Sampling methods: statistical sampling supports generalization to a population; judgmental sampling does not.

SOC reports: SOC 1 covers financial reporting controls; SOC 2 covers trust services criteria; SOC 3 is a general-use summary without detailed controls.

Software testing levels: unit, integration, system, acceptance; regression testing confirms changes did not break existing behavior.

Coverage metrics: statement and branch coverage measure test thoroughness, not correctness; code review and static analysis find defects before runtime.

Log review, configuration compliance checks and control testing feed continuous monitoring; metrics must be reproducible and evidence retained.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, lessons learned.

Evidence handling preserves integrity: chain of custody, write blockers, hashing of images, and order of volatility (memory and network state before disk).

BCP/DR metrics: RTO is target restoration time; RPO is acceptable data loss; MTD is maximum tolerable downtime; MTBF measures reliability, MTTR repair time.

Recovery sites: hot (ready now), warm (partial), cold (space only); backups are full, incremental (changes since last backup), differential (changes since last full).

Change management requires request, approval, testing, implementation, rollback plan; emergency changes are documented retroactively.

Least privilege and separation of duties apply to operations staff; privileged activity is logged and reviewed.

Monitoring sources include IDS/IPS alerts, SIEM correlation, file integrity monitoring, and endpoint detection and response.

Media handling: sanitization methods are clearing (logical overwrite), purging (degaussing, crypto-erase), and destruction; classification dictates method.

SDLC phases: requirements, design, development, testing, deployment, maintenance; security activities belong in every phase, not only testing.

Threat modeling (e.g., STRIDE) identifies threats at design time; data flow diagrams show trust boundaries and entry points.

OWASP Top 10 classes include injection, broken access control, cryptographic failures, insecure design, and security misconfiguration.

Input validation is allow-list based; parameterized queries prevent SQL injection; output encoding prevents cross-site scripting.

SAST analyzes source code without executing it; DAST tests a running application; SCA identifies vulnerable third-party dependencies.

DevSecOps automates security gates in CI/CD pipelines; secrets must be stored in vaults, never committed to repositories.

Secure coding requires authentication and session management controls, least privilege for service accounts, and safe error handling that leaks no internals.

API security: enforce authorization on every object reference (IDOR), rate limit, validate tokens, and version/deprecate endpoints deliberately.

Data classification levels (public, internal, confidential, restricted) drive handling, labeling, retention and destruction requirements.

Data roles: owner (accountable, sets classification), custodian (implements controls), user (follows rules); data controller determines purpose, processor acts on behalf.

Data states: at rest (storage encryption), in transit (TLS/IPsec), in use (memory protection, secure enclaves).

Retention schedules must satisfy legal, regulatory and business needs; legal hold suspends destruction.

PII, PHI and cardholder data carry specific obligations (privacy law, HIPAA, PCI DSS); scope minimization reduces compliance burden.

Asset inventory records owner, location, classification and value; CMDB supports impact analysis and incident scoping.

Destruction methods: shredding, degaussing (magnetic media only), crypto-erase; SSD and cloud media require verified sanitization.

Data remanence is residual data on media after deletion; proper sanitization is required before reuse or disposal.