Cybersecurity Intro — Cheatsheet

Fundamentals, frameworks, GDPR, IAM, PKI and network security — 2024–2025

CIA and Risk Management

Principle	Meaning	Typical control
Confidentiality	only authorized parties read data	encryption, access control
Integrity	data stays correct/complete	hashes, signatures, logging
Availability	service/data reachable in time	redundancy, backups, DoS protection

Additionally: authenticity, accountability and non-repudiation.

risk = likelihood × impact

Term	Definition
Asset	something with value
Threat	possible cause of harm
Vulnerability	weakness that can be exploited
Exploit	method/code that leverages a weakness
Control	measure that lowers risk
Residual risk	risk that remains after controls

Risk treatment: avoid, reduce, transfer or accept. Defense in depth combines preventive, detective and corrective controls.

Cryptography

Technique	Keys	Use
Symmetric	one shared key	fast data encryption
Asymmetric	public/private keypair	key exchange, signatures
Hash	no key	integrity fingerprint
HMAC	shared key + hash	integrity and authenticity
Digital signature	private signs, public verifies	integrity, authenticity

Encryption provides confidentiality; hashing alone does not. Store passwords with a slow password hash and a unique salt (e.g. Argon2/bcrypt/scrypt), not with a fast general-purpose hash.

Hybrid encryption

TLS uses asymmetric techniques for authentication/key agreement and symmetric session keys for bulk data. This combines a secure key setup with speed.

Encoding ≠ encryption

Base64 hides nothing and requires no key; anyone can reverse it.

Frameworks and Organizations

NIST Cybersecurity Framework 2.0

Govern → Identify → Protect → Detect → Respond → Recover

Profiles describe current and target posture.
Tiers describe the maturity/consistency of risk management.
The framework helps structure work; it is not a ready-made technical checklist.

ISO/IEC 27001

Standard for an Information Security Management System (ISMS): scope, risk analysis, controls, Statement of Applicability, internal audit and continuous improvement per PDCA.

MITRE ATT&CK

Knowledge base of adversary tactics, techniques and procedures. A tactic is the goal; a technique is how the attacker achieves that goal; procedures are concrete implementations. Use ATT&CK to map detection coverage and gaps.

Key actors: national CERTs/CSIRTs, ENISA, NIST, ISO, sectoral regulators and law enforcement.

lawfulness, fairness and transparency;
purpose limitation;
data minimization;
accuracy;
storage limitation;
integrity and confidentiality;
accountability.

Legal bases include consent, contract, legal obligation, vital interest, public task and legitimate interest. Consent is not automatically the best basis.

Role	Function
Data subject	the person the data relates to
Controller	determines purpose and means
Processor	processes on behalf of the controller
DPO	independent advice and oversight

Privacy by design/default, a DPIA when high risk is likely, processing agreements and appropriate technical/organizational measures are core obligations. Notification of a personal data breach to the supervisory authority is, in principle, required within 72 hours when the breach is likely to result in a risk.

OSINT

OSINT collects and verifies publicly available information. Work purposefully, document source/time, triangulate findings, and respect law, ethics and scope. A publicly findable piece of data is not automatically free to use for any purpose.

AAA and IAM

Authentication → who are you?
Authorization  → what are you allowed to do?
Accounting     → what did you do?

Factors: knowledge (password), possession (token), inherence (biometrics). MFA requires factors from different categories.

IAM lifecycle:

joiner → grant access
mover  → adjust permissions
leaver → revoke access in time

Apply least privilege, need-to-know, separation of duties, role-based access and periodic recertification. Don't use shared accounts; protect privileged accounts extra.

Protocols/techniques: RADIUS for network AAA, TACACS+ for device administration, Kerberos in AD, LDAP as a directory protocol, SAML/OIDC for federation/SSO.

PKI and Certificates

A certificate binds an identity to a public key and is signed by a CA.

Root CA → Intermediate CA → server/client certificate

A client checks hostname/SAN, validity period, chain to a trusted root, signature and possibly revocation via CRL/OCSP.

openssl x509 -in cert.pem -text -noout
openssl s_client -connect example.com:443 -servername example.com

Private keys must remain secret. A CSR contains the public key and identity details and is signed by the private key; the CA then issues the certificate.

Trust store

A technically valid self-signed certificate is not automatically trusted. Trust only arises once the correct root is explicitly present in the trust store.

Firewalls

Type	Property
Stateless packet filter	evaluates each packet in isolation
Stateful firewall	tracks connection state
Proxy/application firewall	understands the application protocol
WAF	specifically protects web applications/HTTP

Rules typically match source, destination, protocol, port, interface/direction and state. Work with default deny and explicit minimal allow rules.

Internet → edge firewall → DMZ → internal firewall → LAN

A firewall does not fix a vulnerable application and does not replace patching or endpoint security.

MITM and Local Network Attacks

A man-in-the-middle positions itself logically between parties to observe or modify traffic.

ARP spoofing

ARP has no built-in authentication. Forged ARP replies can make the victim and gateway cache the attacker's MAC address. Defense: Dynamic ARP Inspection with DHCP snooping, segmentation, static bindings where appropriate, and above all end-to-end TLS.

DHCP starvation and rogue DHCP

Starvation exhausts the lease pool with many fake clients; a rogue server hands out a malicious gateway/DNS configuration. Switch controls: DHCP snooping, trusted uplinks, rate limiting and port security/802.1X.

DNS manipulation

Malicious DNS responses redirect users to the wrong destination. Use trustworthy resolvers, DNSSEC validation where relevant, DoT/DoH according to policy, and TLS certificate validation.

TLS remains crucial

An attacker redirecting traffic cannot simply produce a valid certificate for the real hostname. Never ignore certificate warnings.

Phishing and Resilience

Check the sender domain, reply-to, link destination, unexpected urgency, requests for secrets/payment and unusual login pages. Don't open suspicious links/attachments in the production environment.

Technical measures:

SPF defines authorized sending sources;
DKIM signs mail with a domain key;
DMARC ties alignment to policy/reporting;
MFA, a secure mail gateway and browser/endpoint protection limit impact.

Incident response — compact

prepare → identify → contain → eradicate → recover → lessons learned

Preserve evidence, note timestamps, isolate proportionally and don't unnecessarily alter data before forensic preservation.