PSAA cheat sheet

Prompt injection is untrusted text steering model behavior: direct injection arrives in user input, indirect injection hides in retrieved documents, web pages, or tool output; treat all model input as attacker-controlled.

Defense in depth for LLM apps: input/output filtering, least-privilege tool scopes, human approval for irreversible actions, and per-session authorization checks before every tool call.

Training-data poisoning alters model behavior at the source; retrieval poisoning alters it at query time. Both require provenance tracking and integrity checks on data and index content.

Model output is untrusted data: never pass it directly to shell, SQL, or downstream APIs without validation and parameterization.

Sensitive-information disclosure risk grows with context size: minimize what is placed in prompts, redact secrets, and log prompts with the same controls as other sensitive data.

Excessive agency is a design flaw: a model granted broad credentials can be steered into destructive calls. Bind tool credentials to the requesting user, not to the model.

LLM denial-of-service includes token-flooding and context-window exhaustion; apply rate limits, max-token caps, and per-tenant quotas.

Classify AI assets by data sensitivity and autonomy level; higher autonomy plus higher data sensitivity demands stronger gating and monitoring.

Zero Trust principle: no implicit trust from network location; every request is authenticated and authorized per session using identity, device posture, and context.

Segmentation reduces blast radius: east-west controls (microsegmentation) matter as much as perimeter controls, because lateral movement follows flat internal networks.

Stateful inspection tracks connection state; stateless ACLs match packets independently. Default-deny rules must be paired with an explicit allow list to avoid outages.

TLS inspection requires a trusted re-signing CA distributed to endpoints; without it, clients fail certificate validation and inspection silently degrades to passthrough.

IDS detects and alerts; IPS detects and blocks inline. Placement matters: out-of-band IDS cannot stop traffic, only report it.

DNS is a high-value control point: tunneling and beaconing often evade port-based rules, so log and inspect DNS queries and responses.

NAT hides internal addressing but is not a security control; do not treat address translation as authorization.

Encrypted traffic analysis uses metadata (SNI, certificate, flow timing and size) when payload decryption is not feasible.

SASE converges network-as-a-service and security-as-a-service: SWG, CASB, ZTNA, FWaaS, and DLP delivered from a cloud edge close to the user.

ZTNA replaces network-level VPN access with per-application access brokered by identity and device posture; applications are not exposed to the internet.

SWG filters web traffic by category and risk; CASB governs SaaS usage including shadow IT discovery and inline versus API-based control.

API-mode CASB gives deep visibility but is not inline, so it cannot block in real time; inline proxy mode can block but sees less historical data.

Traffic steering options include client-based agents, explicit proxy, and IPsec/GRE tunnels from branch sites; the choice determines how much traffic is inspected.

Single-pass architecture inspects traffic once across all engines; stitching separate proxies adds latency and policy inconsistency.

Local breakout at the branch sends internet-bound traffic to the nearest PoP; backhauling to a data center increases latency and concentrates risk.

Decrypt-or-bypass policy must be explicit per category (for example, financial and health sites) to balance privacy, compliance, and inspection coverage.

Detection pipeline stages: collection, normalization, correlation, alerting, triage, and response. A gap in any stage breaks the chain regardless of tool quality.

MTTD measures time from event to detection; MTTR measures time from detection to resolution. Track them separately; averaging them hides the real bottleneck.

Alert fidelity: false positive rate drives analyst fatigue. Tune by suppression, allow-listing, and threshold adjustment; measure precision, not just volume.

MITRE ATT&CK maps observed behavior to tactics and techniques; use it to find coverage gaps rather than as a checkbox list.

Playbooks encode repeatable response: containment, eradication, recovery, and lessons learned. Automate only steps with deterministic inputs.

Chain of custody requires documented, hash-verified handling of evidence from collection through retention.

Log retention must satisfy both detection windows and legal hold; short retention silently destroys the ability to investigate slow dwell-time intrusions.

Threat intelligence is only useful when operationalized: indicator matching, enrichment, and confidence scoring tied to a specific decision.

Shared responsibility: the provider secures the cloud (physical, hypervisor, managed service internals); the customer secures in the cloud (identity, configuration, data, and access policy).

IAM least privilege: avoid wildcard actions and resources, scope by resource ARN or path, require conditions such as MFA and source network where supported.

Public storage exposure remains a top finding: block public access at the account or organization level, then audit bucket or container policies for exceptions.

Misconfiguration is the dominant cloud risk: enforce guardrails with policy-as-code and organization-level controls rather than relying on periodic review.

Workload identity: prefer short-lived role assumption over long-lived access keys; rotate and monitor any static credentials that remain.

Logging baseline: enable control-plane audit logs, flow logs, and object-level access logs in every region; centralize to an account the workload teams cannot modify.

Encryption at rest is table stakes; key management, rotation, and separation of duties over keys are the actual control.

Serverless and container workloads shift risk to supply chain and runtime: pin image digests, scan artifacts, and restrict egress.

Three pillars: metrics (aggregated numeric time series), logs (discrete events), traces (request path across services). Correlation across them is what shortens diagnosis.

SLOs define a reliability target; the error budget is 1 minus the SLO. Burn-rate alerting fires on budget consumption rate rather than raw thresholds.

High cardinality in metrics (user ID, request ID) explodes cost and query time; put those dimensions in logs or traces instead.

Remediation loop: detect, diagnose, contain, fix, verify, and record. Verification without a measurable success signal is not remediation.

Automated remediation needs guardrails: idempotent actions, blast-radius limits, dry-run mode, and an audit trail of who or what acted.

Runbooks should map symptom to diagnosis to action; a runbook that starts with a fix skips the diagnosis step and misleads responders.

Post-incident review focuses on contributing factors and control gaps, not individual blame; output should be tracked action items with owners.

Telemetry pipelines need their own monitoring: dropped logs or a stalled collector produce silent blind spots that look like calm.

Authentication proves identity; authorization decides access. Confusing the two produces systems that verify users and then grant everything.

MFA strength varies: SMS is vulnerable to interception and SIM swap; phishing-resistant factors (FIDO2, passkeys) resist real-time relay attacks.

OAuth 2.0 scopes bound delegated access; over-broad scopes and long-lived refresh tokens are common privilege-escalation paths.

Conditional access evaluates signals (user, device compliance, location, risk) at request time; policy evaluated once at login misses later risk changes.

Privileged access management: just-in-time elevation, session recording, and short credential lifetimes reduce standing administrative risk.

Identity is the primary attack surface in cloud and SaaS: audit for dormant accounts, unused credentials, and roles with no owner.

Least privilege for machine identities: service accounts and API keys need owners, scopes, rotation, and decommissioning tied to the workload lifecycle.

Directory hygiene: stale accounts, orphaned groups, and nested group inheritance silently expand effective permissions beyond what reviews show.