Show Menu
Cheatography
  1. Home >
  2. Education >

CySA+ Cheat Sheet Vol. 1 Cheat Sheet (DRAFT) by

CySA+ Cheat Sheet for CySA+ CS-002 Exam

This is a draft cheat sheet. It is a work in progress and is not finished yet.

Domain 4. Incident Response

Incident Response Phases
- Preparation
- Detection & Analysis
- Containment
- Eradic­ation & Recovery
- Post Incident Activity
Commun­ication plan
- Limiting commun­ication to trusted parties
- Disclosing based on regula­tor­y/l­egi­slative requirements
- Preventing inadve­rtent release of information
- Using a secure method of communication
- Reporting requir­ements
Reporting Requir­ements - Type of Breach
- Data exfiltration
- Insider data exfiltration
- Device theft/loss
- Accidental data breach
- Integr­ity­/av­ail­ability
Response coordi­nation
- Legal
- Human resources
- Public relations
- Internal and external
- Law enforcement
- Senior leadership
- Regulatory bodies
Data Critic­ality and Priori­tiz­ation
- Personally Identi­fiable Inform­ation (PII)
- Sensitive Personal Inform­ation (SPI)
- Personal Health Inform­ation (PHI)
- Financial Information
- Intell­ectual property (IP)
- Corporate Information
- high value asset (HVA)
Prepar­ation Phase
- Training
- Testing
- Docume­ntation of procedures
Docume­ntation of Procedures
- Incident Response Plan
- Call List/E­sca­lation List
- Incident Form
OODA loop
- Observe
- Orient
- Decide
- Act
Defensive Capabi­lities
- Detect
- Destroy
- Degrade
- Disrupt
- Deny
- Deceive
Immediate impact
direct costs incurred because of an incident
Total impact
costs that arise following the incident, including damage to the company's reputation
Incident Security Level Classi­fic­ation charac­ter­istics (Detection & Analytics)
- Data integrity
- System process criticality
- Downtime
- Economic
- Data correlation
- Reverse engineering
- Recovery time
- Detection time
Contai­nment
- Isolat­ion­-Based Containment
- Segmen­tat­ion­-based Contai­nment
Contai­nment principals
- Ensure the safety and security of all personnel.
- Prevent ongoing intrusion or data breach.
- Identify whether the intrusion is the primary attack or a secondary one (part of a more complex campaign).
- Avoid alerting the attacker to the fact that the intrusion has been discovered.
- Preserve forensic evidence of the intrusion.
Eradic­ation
- Saniti­zation and Secure Disposal (crypt­ogr­aphic erase, zero-fill)
- Reconstruction/Reimaging
- Recons­tit­ution of Resources
crypto­graphic erase
A method of sanitizing a self-e­ncr­ypting drive by erasing the media encryption key
zero-fill
A method of sanitizing a drive by setting all bits to zero.
Secure disposal
physical destru­ction by mechanical shredding or incine­ration
Reimage
A method of restoring a system that has been sanitized using an image-­based backup.
Recons­tru­ction
A method of restoring a system that has been sanitized using scripted instal­lation routines and templates.
Recons­tit­ution
A method of restoring a system that cannot be sanitized using manual removal, reinst­all­ation, and monitoring processes.
Recovery
- Patching
- Restor­ation of Permissions
- Verifi­cation of Loggin­g/C­omm­uni­cation to Security Monitoring
- Vulner­ability Mitigation and System Hardening
Post-I­ncident Activities
- Report Writing
- Incident Summary Report
- Evidence Retention

Domain 3. Security Operations and Monitoring

heuristic analysis
A method that uses feature compar­isons and likenesses rather than specific signature matching to identify whether the target of observ­ation is malicious.
Endpoint Data Collection and Analytics Tools
- Anti-virus (A-V)
- Host-Based Intrusion Detect­ion­/Pr­eve­ntion (HIDS/HIPS)
- Endpoint Protection Platform (EPP)
- Endpoint Detection and Response (EDR)
- User and Entity Behavior Analytics (UEBA)
Endpoint Protection Platform (EPP)
- a single agent performing multiple security tasks and features.
- (malwa­re/­IDP), host firewall, web content filtering, (DLP) enforc­ement, and file/m­essage encryp­tion.
- In an enterprise solution, there will also be a single management dashboard for config­uring and monitoring hosts.
- mostly signat­ure­-based detection and prevention
Endpoint Detection and Response (EDR)
- focused on logging of endpoint observ­ables and indicators combined with behavi­oral- and anomal­y-based analysis.
- to provide real-time and historical visibi­lity, contai­nment, and facilitate remedi­ation of the host to its original state.
User and Entity Behavior Analytics (UEBA)
- analysis process supporting identi­fic­ation of malicious behaviors from comparison to a baseline
- tracks user account behavior across different devices and cloud services
Sandboxing
technique that isolates untrusted data in a closed virtual enviro­nment to conduct tests and analyze the data for threats and vulner­abi­lities.
Disass­emblers and Decomp­ilers
software that translate low-level machine language code into higher level code
Malware Exploit Techniques
- Malware Exploit Techniques
- Maintain access
- Strengthen access
- Actions on objectives
- Concea­lment
Living off the land
subvert existing archit­ecture, such as Windows PowerS­hell, to perform the malicious activity.