Cybersecurity Cheat Sheet

Confidentiality  only the right party can read it
Integrity        you can tell if it changed
Availability     it works when it is needed
A control usually trades one of these off.

Defense in depth
  more than one control, so one miss is not the breach
Zero Trust
  location is not trust; verify identity and device
  least privilege; assume a breach is possible

Kill chain   named stages from recon through objectives
ATT&CK       a catalog of tactics and techniques
Use them to place a detection.
A name is not permission, and not a procedure.

Social engineering
  phishing, spear phishing, vishing, smishing, pretexting
  defense: verify out of band; report; ignore the link
Malware categories
  virus, worm, ransomware, spyware, rootkit, remote-access tool
  question: what changed, and which log shows it?

Symmetric     one shared key; fast; bulk data
Asymmetric    public key encrypts or verifies
              private key decrypts or signs
Hash          one-way fingerprint; not encryption
Signature     private key signs; public key checks origin

TLS authenticates the name you asked for
and encrypts the session after the handshake.
HTTPS is HTTP inside TLS.
A certificate is a signed claim about a name.

Store a slow hash plus a unique salt.
Do not store the password.
A fast hash is the wrong tool here.
Identical passwords must not share a hash.

MFA     know + have, or know + are
RBAC    rights come from a role
ABAC    rights also depend on context
PAM     extra control on admin accounts
SSO     one login, many apps
Least privilege   only the access the job needs

OAuth 2.0   an app gets a token, not the password
OIDC        identity layered on OAuth
SAML        an identity provider asserts a login
Check on every token: issuer, audience, expiry.

A daily account is not an admin account.
Admin: MFA, short-lived, logged.
A shared password is not a control.
Joiner, mover, leaver: grant, change, remove.

timestamp
host
user
src_ip
dest_ip
action
object
result
auth_method

auth logs
firewall and proxy
DNS queries
endpoint
application
cloud audit: who called which API

normalise   one field name across sources
correlate   two events, one story
baseline    what usual looks like here
triage      real or not, and how bad
An alert with no fields is noise.

Same user, new source, success after many failures?
Privileged action outside the usual hours?
A host that stopped sending logs?
These are questions for logs you are allowed to hold.

link         local delivery
internet     addresses and routing
transport    TCP or UDP, and a port
application  DNS, HTTP, TLS
Say which layer a control actually sees.

DNS    a name resolves to an address
       the log shows who looked up what
HTTP   method, path, status
HTTPS  the body is hidden; the handshake is not
A cert binds a public key to a name.

Firewall   allow or deny by policy
           stateful means it remembers the flow
IDS        detect and alert
IPS        can block in line
Signature  a known pattern
Anomaly    unlike the baseline
Default deny is the secure start.

Users, servers, and admin paths are not one flat net.
A DMZ is what the internet is allowed to touch.
NAT hides inside addresses.
NAT is not an access-control policy.

Unique users. No shared root login.
Admin via sudo, and sudo is logged.
Mode bits: owner writes; others only if they must.
r read, w write, x execute — owner, group, others.
Services you do not need stay off.
Clocks agree, or the logs will not.

Prefer keys over passwords where you can.
No direct root login from the network.
Limit which accounts may log in.
Keep the service patched on a host you own.

Shared responsibility
  the provider secures the platform
  you secure identity, config, and data
Private by default. No standing admin for daily work.
Validate input on the server.
Parameterised data access. Encode output for its context.
Secrets in a store, not in the repo.

SAST                 read the code
DAST                 test a running app you may test
Dependency scanning  known-bad libraries
Secrets detection    keys that should not be committed
Image scanning       what a container actually ships
A gate can fail the build.

Vulnerability   a flaw that could be abused
CVE             a public id: CVE-YEAR-NUMBER
CVSS            a severity score, not the whole risk
Zero-day        no public patch yet
Patch           the fix, once it exists

Is it exposed, and is anything in front of it?
The score is an input, not the order by itself.
Record an exception and a review date.
Scanning belongs on systems you are allowed to scan.

Report to the owner or a published program.
Stay inside the scope they wrote down.
Practice on a lab you own, or a range that invited you.
Responsible disclosure is a process, not a workaround.

detect and triage
contain
preserve evidence
eradicate
recover
post-incident review
Prepare before you need the list.

Write down time, system, and who touched it.
Copy logs before they rotate.
Do not wipe a host you still need to timeline.
A lab timeline uses lab data only.

IOC   a concrete indicator: hash, domain, or address
IOA   a behaviour, a pattern of actions
TTP   a tactic, technique, and procedure, named in a catalog
A hunt starts from a hypothesis on logs you hold.

The career module maps roles from SOC analyst to CISO.
Topics it names:
  role map
  US salaries by role
  top hiring companies
  certifications, ranked
  breaking in
This page does not add salary figures.

Certifications the track names
  CompTIA Security+, CEH, OSCP, CISSP, CISM, AWS Security
Frameworks the track names
  NIST CSF, SOC 2 Type II, ISO 27001, PCI-DSS
  HIPAA, at a basic level
Rank and cost live in those lessons.

A home lab: virtualisation on machines you control.
Ranges that invite you: TryHackMe, HackTheBox.
A bug bounty only inside its written scope.
Interview topics named here: networking, crypto,
web security, test process, incident response,
compliance, and behaviour.