Chapters 1–5 exam cheat sheet

Definition (slide wording)

Cyber security is the protection of internet-connected systems, including hardware, software and data, from cyberattacks.

The four related terms 4

• Information security: protects information in any form, including paper and speech. The broadest term.
• Computer security: protects computer systems and their components.
• IT security: protects the IT infrastructure.
• Cyber security: protects internet-connected systems.

Ch1 Quiz essay (13 marks): compare all four.

Cybersecurity pillars 3

1. People: understand and follow security principles
2. Policies: a framework for attempted and successful attacks
3. Technologies: the tools that protect against attacks

The one-way rule (asked almost every time)

A breach of confidentiality always results in a breach of possession. A breach of possession does not always result in a breach of confidentiality.

Why: if someone reads your data, they now hold it. But if they steal an encrypted copy, they hold it without being able to read it.

Accuracy vs Integrity vs Authenticity

• Integrity: protected from unauthorised change (about who changed it).
• Accuracy: the value is correct and what the user expects (about the value).
• Authenticity: it is the original, not a copy or a fake (about origin).

Memorise the seven

Security goals

1. Confidentiality
2. Integrity
3. Availability

Information states

1. Storage: data at rest (DAR), in memory, tape or disk
2. Transmission: between systems, data in transit (DIT)
3. Processing: operations performed on the data

Security measures / controls

1. Policy and practices: administrative controls (plans, guidance)
2. Education: users know their roles and responsibilities
3. Technology: software and hardware solutions

Defence-in-depth diagram, outside in 6

1. Physical: guards, locks, tracking devices
2. Perimeter: firewalls, border routers, VPNs with quarantine procedures
3. Network: network segments, NIDS
4. Host / computer: OS hardening, authentication, security update management, antivirus updates, auditing
5. Application: application hardening
6. Data: strong passwords, ACLs, backup and restore strategy

Organisation's security layers 6

1. Physical security: physical items and objects
2. Personnel security: the individuals authorised to access the organisation
3. Operations security: the details of a particular operation or activity
4. Communications security: communications media and technology
5. Network security: network components and connections
6. Data security: CIA of information in storage, processing and transmission

Quiz 1's seven-layer version

Quiz 1 used the extended onion, which adds an outer human layer:

1. Policies and procedures (training, acceptable-use policy)
2. Physical
3. Perimeter
4. Internal network (segmentation, auditing between departments)
5. Host (OS patching, host antivirus)
6. Application (input validation, secure coding)
7. Data (encryption at rest, ACLs on records)

SDLC phases 5

A methodology for designing and implementing an IS. Most common approach: waterfall.

1. Planning: review and prioritise the project request, allocate resources, identify the team
2. Analysis: study the current system, determine user requirements, recommend a solution
3. Design: acquire hardware and software, develop the system details
4. Implementation: develop the program, install and test, train users
5. Support: identify errors and enhancements, monitor performance, update

SecSDLC phases 4

1. Planning and analysis: potential impact of a breach; preliminary risk assessment → initial description of the basic security
2. Design: risk assessments, security functional and assurance requirement analysis, security planning
3. Implementation: inspection and acceptance, system integration bounded by the chosen controls
4. Support: keep the security level when the environment changes, update, continuous monitoring

SDLC vs SecSDLC (the difference)

The SecSDLC follows the exact same phases as the SDLC. In addition it identifies specific threats and creates specific controls to counter them, in every phase.

Three entities to protect 3

1. Endpoint devices (computers, smart devices, routers)
2. Networks
3. The cloud and data centers

Common protection technology 5

• Next-generation firewalls
• DNS filtering
• Malware protection
• Antivirus software
• Email security solutions

Vulnerability, threat, attack, control, risk

• Vulnerability: a weakness in procedures, design or implementation that might be exploited.
• Threat: a set of circumstances with the potential to cause loss or harm; a potential violation of security.
• Attack: what a human commits when they exploit a vulnerability.
• Control: an action, device, procedure or technique that removes or reduces a vulnerability.
• Risk: exists when a threat meets a vulnerability in the system or in a control.

Threat damage: the four types 4

• Interruption: asset unusable or unavailable → attacks Availability
• Interception: unauthorised party gains access → attacks Confidentiality
• Modification: unauthorised party changes the asset → attacks Integrity
• Fabrication: unauthorised party creates counterfeit assets → attacks Authenticity

Modern threat landscape 5

1. Supply chain and third party: compromised vendors, insecure SaaS, malicious updates. External human threats with indirect access.
2. AI-enabled: AI phishing, deepfake voice/video. More scale, speed and realism.
3. Cloud and API: misconfiguration, insecure APIs, token theft
4. Insider (intentional vs unintentional): malicious insider or negligent insider
5. Hybrid: cyber + physical, or cyber + psychological (cyber attack + fake social media campaign)

Threat vectors and techniques 9

• Malware: malicious software
• Ransomware: encrypts files, demands ransom
• Social engineering: tricks users into revealing information
• Supply chain attacks: hit trusted vendors to reach many organisations
• APTs: long-term, targeted, often state-sponsored, for espionage or data theft
• Zero-day exploits: unknown or unpatched vulnerabilities
• AI-powered attacks: automate attacks, bypass defences, deepfakes
• IoT and OT attacks: connected devices, industrial systems
• Cloud and API attacks: misconfigurations, insecure APIs

AI-driven threat vectors 5

• AI-generated malware: adapts to avoid detection, creates polymorphic variants
• AI-enhanced social engineering: personalised phishing using the target's style
• AI-driven reconnaissance: automated scanning, prioritises high-value targets
• AI deepfakes and impersonation: fake voice, video or text
• AI-optimized exploit kits: selects the most effective attack per target

Definition and types

Malware is any file or program used to harm a computer user.

• Virus: attaches to a host file, needs it to run
• Worm: spreads across networks by itself, no user action
• Trojan horse: disguised as legitimate software
• Spyware: secretly monitors activity
• Keylogger: records keystrokes (beaten by an on-screen keyboard)
• Backdoor: hidden unauthorised access
• Ransomware: encrypts or locks, demands payment
• Adware: unwanted advertising

Malware symptoms 9

1. Increased CPU usage
2. Slow computer or web browser
3. Problems connecting to networks
4. Freezing or crashing
5. Modified or deleted files
6. Strange files, programs or desktop icons appear
7. Programs running, turning off or reconfiguring themselves
8. Strange computer behaviour
9. Emails/messages sent automatically without the user's knowledge

Malware countermeasures 5

1. Install quality antivirus software
2. Keep virus definitions regularly updated
3. Never open an attachment from an untrusted source
4. Take caution when surfing and downloading
5. Back up data

Ransomware family (slide list)

WannaCry, Petya/NotPetya, Locky, Cerber, Jigsaw, Bad Rabbit, Ryuk, Dharma (CrySIS). The slide calls ransomware socially engineered malware.

Phishing vs pharming

Phishing is persuasive: the victim clicks a malicious link. Pharming is technical: DNS or the host is poisoned, so even the correct URL lands on the fake site. No click is needed.

Pretexting vs reverse social engineering

Pretexting: the attacker approaches with a made-up story. Reverse SE: the attacker causes or predicts a problem and the victim approaches the attacker for help. That is why the victim trusts them completely.

Social engineering countermeasures

• Password policies: periodic change, no guessable passwords, account blocking after failed attempts, length and complexity, secrecy
• Physical security policies: employee ID cards, area restrictions, shredding useless documents, security check before employment
• Effective training programme
• Operational guidelines
• Classification of information: top secret, proprietary, for internal use only, for public use
• Access privileges: administrator, user and guest accounts
• Two-factor authentication

Confidentiality: "keeping secrets secret"

Measures that protect the secrecy of data, objects or resources. Controls: encryption, access control, steganography.

Attacks:

• Stealing password files (public Wi-Fi, injected keylogger)
• Port scanning: messages sent to learn which network services (well-known ports) are running
• Shoulder surfing
• Eavesdropping: intercepting communications not meant for you (man in the middle)
• Sniffing: capturing network packets with a sniffer
• Privilege escalation: programming errors or design flaws grant elevated access
• Human errors (unintentional), intentional damage

Methods to ensure confidentiality

• Data encryption: the common method
• User IDs and passwords; two-factor is becoming the norm
• Biometric verification: fingerprints, hand and earlobe geometry, retina/iris, voice, DNA, signatures
• Security token: small hardware device carried to authorise network access
• Soft token: software token that generates a single-use login PIN
• Key fob: small programmable hardware device for access to a physical object needing 2FA/MFA
• Extra measures for extremely sensitive documents: air-gapped computers (no external connection) and disconnected storage devices

Integrity: reliable and accurate

Attacks: viruses, logic bombs, unauthorised access, errors in coding, system back doors.

Methods:

• File permissions and user access controls
• Version control: stops erroneous changes or accidental deletion by authorised users
• Checksums / hashing. Hash value = checksum. A cryptographic checksum is assigned to a file and used later to test that it has not been maliciously changed.

Restoring affected data: backups or redundancies. A checksum only detects a change.

Availability: accessible to authorised users at all times

Threats: device failure, software error, environmental issues (heat, flooding, power loss), DoS attacks, network intrusions.

To prevent data loss:

• Backup copy in a geographically isolated location, perhaps a fireproof, waterproof safe
• Firewalls and proxy servers against downtime
• Web application firewall (Cloudflare)

Availability calculation (Quiz 1)

Availability = MTTF ÷ (MTTF + MTTR) × 100. MTTR is the downtime, MTTF the uptime. Use one consistent window.

Downtime per weekly test = 45 + 80 + 15 = 140 min
One week = 7 × 24 × 60     = 10,080 min
MTTF = 10,080 − 140        = 9,940
A = 9,940 ÷ 10,080 × 100   = 98.6%

Layering / defence in depth

Multiple controls in a series. Configurations: serial/parallel, mall, bank, airport.

Abstraction

Used for efficiency: similar elements put into groups, classes or roles that get controls or permissions as a collective.

Data hiding

Intentionally positioning data so it is not viewable or accessible to an unauthorised subject.

Encryption

The art and science of hiding the meaning or intent of a communication from unintended recipients.

Definition: a structured security process 4 steps

1. Identify potential threats
2. Analyze how those threats could exploit vulnerabilities
3. Determine the impact on valuable assets
4. Define appropriate security controls

It prevents security issues before they become real attacks.

The older papers used three key steps: Visualize → Identify threats → Validate. "Execute" is not a step. (Final B Q5)

The dictionary 7

• Asset: any element with value to the organisation that must be protected
• Threat: any potential event causing an unwanted impact
• Attack: any actual event causing an unwanted impact
• Vulnerability: the absence of a safeguard or a weakness a threat might use
• Threat agent: the entity (person or process) that initiates the threat
• Exploit: the vulnerability is found by a threat agent and the threat is initiated
• Control / countermeasure / safeguard: any step that prevents the exploit, or minimises its damage

Risk 4 elements

Risk is the possibility or likelihood that a threat will exploit a vulnerability, resulting in a loss such as harm to an asset.

Risk management reduces or eliminates vulnerabilities, or reduces the impact of threats, by implementing controls.

1. Threat
2. Vulnerability
3. Asset
4. Damage

Three key approaches 3

• Focused on assets: uses asset valuation. "What is valuable?"
• Focused on attackers: identifies potential attackers and their goals. "Who would harm us and why?"
• Focused on software: threats against software the organisation develops. "Where are the weaknesses?"

Other modern approaches 5

1. System / architecture-focused: components, interactions, trust boundaries (exposed internal APIs, lateral movement)
2. Data-focused: how sensitive data is stored, sent, processed (breaches are the most common impact)
3. Supply chain / third-party: vendors, libraries, APIs
4. Environment / deployment-focused: cloud, on-prem, containers; misconfigurations are a top vector
5. Emerging technology: agentic AI, IoT/OT

Three primary steps to identify threats 3

1. Identify all of the technologies involved
2. Identify attacks against each element of the diagram: logical/technical, physical and social
3. Prevention measures

Threat models named on the slide

STRIDE, PASTA, LINDDUN, CVSS, Attack Trees, Persona non Grata, OCTAVE.

PASTA (Process for Attack Simulation and Threat Analysis) is risk-centric: countermeasures chosen against the value of the assets. (Final B Q2)

Definitions

A supply chain is the network between a company and its suppliers to produce and distribute a product to the final buyer. Most systems are not built by a single entity.

A secure supply chain: every vendor or link is reliable, trustworthy and reputable, and discloses its practices and security requirements to partners.

Goal of a secure supply chain

• The finished product is of sufficient quality, meets performance and operational goals, and provides the stated security mechanisms
• At no point was any element counterfeited or subjected to unauthorised or malicious manipulation or sabotage

How the security team inspects vendors 4

1. On-site assessment: visit, interview, observe habits
2. Document exchange and review: how data and documents are exchanged and reviewed
3. Process/policy review: copies of policies, procedures, incident records
4. Third-party audit: an independent auditor

Definition

An information asset is any information that has value to an organisation, regardless of its form: student or customer records, financial data, intellectual property, research data.

Primary assets are the information itself. Supporting assets are the software, hardware, network, people and physical things that hold or process it (servers, LMS, routers, admins, data centers).

Why protect them

• Information is a core business resource
• Loss of confidentiality → privacy violations, legal penalties
• Loss of integrity → wrong decisions, operational failures
• Loss of availability → disrupted services and continuity
• Breaches damage reputation and trust

So it is a strategic, legal and governance requirement, not only a technical one.

Information asset security domain

Collecting, handling and protecting information throughout its lifecycle. A primary step is classifying information by its value.

How: secure systems and environments, hardware and software controls, encryption and access control, monitoring and auditing.

Security governance

The collection of practices for supporting, defining and directing the security efforts of an organisation. It ensures clear accountability, consistent practices, compliance and oversight, enforced through policies, standards, procedures and audits.

Corporate governance: "doing the right things for the organisation and doing things the right way, independent of personal interests."

Security is a business operations issue, not an IT-only issue. Usually run by a governance committee or the board. Frameworks: NIST 800-53, 800-100 (government/military focus, usable by others).

Third party and cloud (ASP)

An Application Service Provider hosts and maintains software on its own servers and delivers it over the internet.

• The organisation remains accountable for data protection
• Due diligence before engagement
• Contracts and SLAs define security responsibilities

Government / military 4

1. Top Secret: "exceptionally grave damage" to national security
2. Secret: "serious damage"
3. Confidential: "damage"
4. Unclassified: can go to the public with no threat to national interest

Commercial (organisational) 4

1. Restricted (sensitive / critical)
2. Confidential
3. Internal (private)
4. Public (unclassified)

No standard: each company chooses its own and it is usually simpler than the government scheme. The more regulated the company, the more complex its scheme.

Social engineering countermeasure (Ch2) 4

1. Top secret
2. Proprietary
3. For internal use only
4. For public use

Classification criteria 4

• Business value
• Legal and regulatory impact (PDPL, GDPR)
• Reputational damage
• Operational impact

Guiding question: what is the worst possible impact if this is disclosed, altered or destroyed? Higher impact → higher level → stronger controls.

Restricted data examples

• PII: identifies an individual (name, SSN, date and place of birth, mother's maiden name, biometrics)
• PHI: health information tied to a person
• Proprietary data: keeps a competitive edge (source code, product plans, internal processes), protected by copyrights, patents and trade secret law

Class exercise: sort into 4 categories

The slide leaves this as an exercise. A suggested sort, using the worst-impact question:

• Cat 4 highly sensitive: credit card numbers (PCI), PHI, SSNs, financial account numbers, trade secrets, intellectual property
• Cat 3 sensitive internal: student education records, customer personal data, employee records, employee pay cheques, supplier and vendor contracts
• Cat 2 internal: internal emails, employee directory, IT service management information
• Cat 1 public: public website content, marketing materials, newsletters, press releases, social media feeds

Marking (labelling)

So users can easily identify the classification of any data.

• Physical labels on media and systems
• Electronic labels: header/footer or watermark. Benefit: they also appear on printouts.

Asset classifications should match data classifications. A data breach is any event where an unauthorised entity can view or access classified data.

Protecting each state

• At rest (drives, databases, backup tapes, USBs): encryption (AES-256), access controls, secure facilities, environmental controls (HVAC, fire suppression)
• In transit: encrypted channels, secure protocols, network monitoring
• In use: access control, endpoint security, memory protection

Retention

Keep information for as long as it is needed for business operations, legal and regulatory compliance, and audit. Periods come from policy, industry standards or law (3 years, 7 years, indefinitely). When the period expires, securely destroy it.

Two things destruction prevents

• Data recovery: retrieving lost, deleted, corrupted or inaccessible data when normal access is no longer possible
• Data remanence: the data that remains on media after it was supposedly erased

Paper: cross-shredding is recommended. Digital: the method depends on the media type.

Sanitization ladder, weakest to strongest

1. Erasing: a plain delete. Everything is still recoverable.
2. Formatting: delete plus a new file structure. Still recoverable in most cases.
3. Clearing (overwriting): prepares media for reuse; not recoverable with traditional tools.
4. Purging (multiple overwrites / degaussing): stronger clearing, for reuse in less secure environments.
5. Destruction: end of the media's life. The most secure method.

Declassification: any process that purges media so it can be reused in an unclassified environment.

Degaussing

A degausser generates a heavy magnetic field that realigns the magnetic domains of hard drives, tape and floppy disks, removing data remanence.

Final 221 A Q19: to reuse an HDD with no recoverable bit, use degaussing, because the field destroys the stored magnetic pattern itself.

Data owner responsibilities (NIST SP 800-18)

• Establishes rules for appropriate use and protection
• Gives input to system owners on security requirements and controls
• Decides who has access and with what privileges
• Helps identify and assess common security controls

System (asset) owner responsibilities (NIST SP 800-18)

• Develops the system security plan with information owners, admin and users
• Maintains the plan and runs the system to its requirements
• Ensures users and support staff get security training
• Updates the plan after any significant change
• Helps identify, implement and assess common controls

Business / mission owner and best practices

NIST calls the business/mission owner a program manager or information system owner; they ensure systems provide value. The role can overlap with the system owner.

Best practices: classify correctly, least privilege, strong authentication, encrypt sensitive data, monitor and log access, DLP, regular audits and awareness training.

Terms

• Plaintext: original message. Ciphertext: coded message.
• Cipher: the algorithm. Key: info known only to sender and receiver.
• Encipher / encrypt: plaintext → ciphertext. Decipher / decrypt: ciphertext → plaintext.
• Cryptography: making and using codes ("secret writing").
• Cryptanalysis (codebreaking): deciphering without knowing the key.
• Cryptology: the field of both.

Notation: E_K(P) = C, D_K(C) = P, and D_K(E_K(P)) = P. Plaintext and ciphertext are typically the same length.

Two facts they love

• Cryptography can protect confidentiality and integrity, but not availability.
• Kerckhoffs's principle: the algorithm is public; security depends only on the secrecy of the key. Assume Eve knows the algorithm.
• Symmetric encryption is about 30,000 times faster than public-key encryption.

Classify a cryptosystem 3 dimensions

1. Number of keys: same key = symmetric (conventional); different keys = asymmetric (public key)
2. Type of operation: substitution (each element mapped to another) or transposition/permutation (rearranged)
3. Plaintext processing: block (a block at a time) or stream (an element at a time)

Cipher tree: Symmetric (classical: substitution, transposition; modern: block, stream), Asymmetric, Hash.

Attacking substitution: frequency analysis

Letters in natural language are not uniformly distributed, so letter (and pair, triple) frequencies break substitution ciphers. There are 26! (over 4 × 10²⁶) substitution alphabets, but frequency analysis makes the key space irrelevant.

Why Playfair and Hill are stronger

Playfair (Wheatstone 1854, named after Baron Playfair) encrypts digrams: 26 × 26 = 676, so a 676-entry frequency table and much more ciphertext are needed. Used in WW1, but breakable with a few hundred letters.

Hill completely hides single-letter frequencies, so it resists ciphertext-only attacks.

Monoalphabetic vs polyalphabetic

Monoalphabetic (Caesar, keyword): one fixed substitution alphabet. Polyalphabetic (Vigenère): the alphabet changes with each key letter. Final A Q5 calls Vigenère "an advanced version of Caesar based on a keyword".

Block cipher basics

Encrypts an n-bit block with a k-bit key. Plaintext is split into fixed-length blocks.

Padding: the plaintext length must be a multiple of the block size. Padding must be unambiguous (not just zeros), and the last block is always padded. Slide example, b = 64 bits (8 bytes): "Roberto" (7 bytes) → "Roberto9", where 9 denotes a number, not the character. The padding is a value the receiver can read and strip, which is why plain zeros are not allowed.

Triple DES order

Encrypt: C = E_KC( D_KB( E_KA(P) ) )
Decrypt: P = D_KA( E_KB( D_KC(C) ) )

Decryption undoes the last step first: decrypt with K3, encrypt with K2, decrypt with K1.

Nominal key length 168 bits. (In practice meet-in-the-middle gives about 112 bits, but answer 168 if the slide wording is asked.)

Objective and approaches

The objective is to recover the key, not just one message, so every past and future ciphertext is compromised. Two approaches: cryptanalysis and brute force. The algorithm is assumed known in every attack.

Cryptanalysis by what the attacker has 4

1. Ciphertext only: only ciphertexts of several messages
2. Known plaintext: some plaintext–ciphertext pairs, not chosen
3. Chosen plaintext: can choose plaintexts to encrypt (has the encryption box)
4. Chosen ciphertext: can choose ciphertexts to be decrypted (has the decryption box); goal is the key

Brute force table

Hashing vs encryption (Final 221 B, Q17)

• A hash gives a fixed-size output whatever the input; ciphertext grows with the plaintext.
• Hashing is one-way and irreversible (no key recovers the input); encryption is designed to be reversed with the key.

Hash algorithm facts

• SHA-3: 256 and 512 bits (course wording), built on Keccak, structured differently from the rest of the SHA family (Final B Q3)
• SHA-1 digest is 160 bits
• MD4 is faster and less secure than MD5; MD5 was designed to fix MD4 (Final B Q4)