Cyber Security Last-Minute Revision

30 quick revision notes for Cyber Security

1. The CIA triad stands for confidentiality, integrity and availability, and every security control supports at least one of them.
2. Risk combines the likelihood that a threat exploits a vulnerability with the business impact if it happens.
3. Defence in depth layers independent controls so that a single failure does not lead to a breach.
4. Zero Trust verifies every request using identity, device health and context instead of trusting network location.
5. MITRE ATT&CK organises adversary behaviour into tactics, which are goals, and techniques, which are methods.
6. An IDS detects and alerts on suspicious traffic, while an IPS sits inline and can block it in real time.
7. TLS 1.3 removes static RSA key exchange, so every session uses ephemeral keys and has forward secrecy.
8. Passwords should be stored with slow salted algorithms such as Argon2id or bcrypt, never plain MD5 or SHA-256.
9. AES-GCM gives both confidentiality and integrity, but reusing a nonce with the same key breaks its security.
10. NIST published post-quantum standards in 2024: ML-KEM for key exchange and ML-DSA and SLH-DSA for signatures.
11. A SIEM collects and correlates logs to detect threats, while SOAR runs automated playbooks to speed up response.
12. Windows event 4624 is a successful logon, 4625 a failed logon, 4688 process creation and 1102 audit log cleared.
13. Logon type 3 in event 4624 means a network logon, and logon type 10 means a Remote Desktop logon.
14. The Pyramid of Pain shows that detecting attacker TTPs hurts them far more than blocking hashes or IPs.
15. Sigma is a vendor-neutral YAML format for detection rules that can be converted into many SIEM query languages.
16. NIST SP 800-61 incident response covers preparation, detection and analysis, containment, eradication, recovery and lessons learned.
17. CERT-In directions require reporting specified cyber incidents within six hours and keeping logs for 180 days in India.
18. Evidence should be collected in order of volatility, capturing memory before disk because RAM is lost at power off.
19. Chain of custody documents every person who handled evidence and is proven with hashes taken at acquisition.
20. Phishing-resistant MFA such as FIDO2 security keys and passkeys defeats MFA fatigue and real-time phishing proxies.
21. SAML uses signed XML assertions for enterprise SSO, while OpenID Connect adds an ID token on top of OAuth 2.0.
22. Kerberoasting requests service tickets for accounts with SPNs and cracks them offline, so service passwords must be long and random.
23. In the cloud shared responsibility model, the customer always secures identities, data and configurations.
24. AWS IMDSv2 requires a session token for metadata requests and blocks most SSRF attempts to steal instance credentials.
25. Workload identity federation with OIDC replaces long-lived cloud keys in CI/CD pipelines with short-lived credentials.
26. ISO 27001:2022 has 93 Annex A controls grouped into organisational, people, physical and technological themes.
27. NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover, with Govern newly added.
28. The DPDP Act 2023 requires consent or legitimate use, reasonable safeguards and breach notification, with penalties up to 250 crore rupees.
29. Annual loss expectancy equals single loss expectancy multiplied by the annual rate of occurrence.
30. RTO is the maximum acceptable downtime and RPO is the maximum acceptable data loss measured in time.

Night-before checklist

• Revise your saved questions on this page once, aloud.
• Read the quick notes and mark any you cannot explain in one line.
• Rehearse a two-minute self-introduction and two project stories.
• Keep CV, ID, laptop charger and interview link ready; sleep on time.