\documentclass[10pt,a4paper]{article}

% Packages
\usepackage{fancyhdr}           % For header and footer
\usepackage{multicol}           % Allows multicols in tables
\usepackage{tabularx}           % Intelligent column widths
\usepackage{tabulary}           % Used in header and footer
\usepackage{hhline}             % Border under tables
\usepackage{graphicx}           % For images
\usepackage{xcolor}             % For hex colours
%\usepackage[utf8x]{inputenc}    % For unicode character support
\usepackage[T1]{fontenc}        % Without this we get weird character replacements
\usepackage{colortbl}           % For coloured tables
\usepackage{setspace}           % For line height
\usepackage{lastpage}           % Needed for total page number
\usepackage{seqsplit}           % Splits long words.
%\usepackage{opensans}          % Can't make this work so far. Shame. Would be lovely.
\usepackage[normalem]{ulem}     % For underlining links
% Most of the following are not required for the majority
% of cheat sheets but are needed for some symbol support.
\usepackage{amsmath}            % Symbols
\usepackage{MnSymbol}           % Symbols
\usepackage{wasysym}            % Symbols
%\usepackage[english,german,french,spanish,italian]{babel}              % Languages

% Document Info
\author{Ilham (ilperdan0)}
\pdfinfo{
  /Title (cysa-cheat-sheet-vol-1.pdf)
  /Creator (Cheatography)
  /Author (Ilham (ilperdan0))
  /Subject (CySA+  Vol. 1 Cheat Sheet)
}

% Lengths and widths
\addtolength{\textwidth}{6cm}
\addtolength{\textheight}{-1cm}
\addtolength{\hoffset}{-3cm}
\addtolength{\voffset}{-2cm}
\setlength{\tabcolsep}{0.2cm} % Space between columns
\setlength{\headsep}{-12pt} % Reduce space between header and content
\setlength{\headheight}{85pt} % If less, LaTeX automatically increases it
\renewcommand{\footrulewidth}{0pt} % Remove footer line
\renewcommand{\headrulewidth}{0pt} % Remove header line
\renewcommand{\seqinsert}{\ifmmode\allowbreak\else\-\fi} % Hyphens in seqsplit
% This two commands together give roughly
% the right line height in the tables
\renewcommand{\arraystretch}{1.3}
\onehalfspacing

% Commands
\newcommand{\SetRowColor}[1]{\noalign{\gdef\RowColorName{#1}}\rowcolor{\RowColorName}} % Shortcut for row colour
\newcommand{\mymulticolumn}[3]{\multicolumn{#1}{>{\columncolor{\RowColorName}}#2}{#3}} % For coloured multi-cols
\newcolumntype{x}[1]{>{\raggedright}p{#1}} % New column types for ragged-right paragraph columns
\newcommand{\tn}{\tabularnewline} % Required as custom column type in use

% Font and Colours
\definecolor{HeadBackground}{HTML}{333333}
\definecolor{FootBackground}{HTML}{666666}
\definecolor{TextColor}{HTML}{333333}
\definecolor{DarkBackground}{HTML}{A3A3A3}
\definecolor{LightBackground}{HTML}{F3F3F3}
\renewcommand{\familydefault}{\sfdefault}
\color{TextColor}

% Header and Footer
\pagestyle{fancy}
\fancyhead{} % Set header to blank
\fancyfoot{} % Set footer to blank
\fancyhead[L]{
\noindent
\begin{multicols}{3}
\begin{tabulary}{5.8cm}{C}
    \SetRowColor{DarkBackground}
    \vspace{-7pt}
    {\parbox{\dimexpr\textwidth-2\fboxsep\relax}{\noindent
        \hspace*{-6pt}\includegraphics[width=5.8cm]{/web/www.cheatography.com/public/images/cheatography_logo.pdf}}
    }
\end{tabulary}
\columnbreak
\begin{tabulary}{11cm}{L}
    \vspace{-2pt}\large{\bf{\textcolor{DarkBackground}{\textrm{CySA+  Vol. 1 Cheat Sheet}}}} \\
    \normalsize{by \textcolor{DarkBackground}{Ilham (ilperdan0)} via \textcolor{DarkBackground}{\uline{cheatography.com/126607/cs/32364/}}}
\end{tabulary}
\end{multicols}}

\fancyfoot[L]{ \footnotesize
\noindent
\begin{multicols}{3}
\begin{tabulary}{5.8cm}{LL}
  \SetRowColor{FootBackground}
  \mymulticolumn{2}{p{5.377cm}}{\bf\textcolor{white}{Cheatographer}}  \\
  \vspace{-2pt}Ilham (ilperdan0) \\
  \uline{cheatography.com/ilperdan0} \\
        \uline{\seqsplit{www}.packetnotes.com}
  \end{tabulary}
\vfill
\columnbreak
\begin{tabulary}{5.8cm}{L}
  \SetRowColor{FootBackground}
  \mymulticolumn{1}{p{5.377cm}}{\bf\textcolor{white}{Cheat Sheet}}  \\
   \vspace{-2pt}Not Yet Published.\\
   Updated 11th June, 2022.\\
   Page {\thepage} of \pageref{LastPage}.
\end{tabulary}
\vfill
\columnbreak
\begin{tabulary}{5.8cm}{L}
  \SetRowColor{FootBackground}
  \mymulticolumn{1}{p{5.377cm}}{\bf\textcolor{white}{Sponsor}}  \\
  \SetRowColor{white}
  \vspace{-5pt}
  %\includegraphics[width=48px,height=48px]{dave.jpeg}
  Measure your website readability!\\
  www.readability-score.com
\end{tabulary}
\end{multicols}}




\begin{document}
\raggedright
\raggedcolumns

% Set font size to small. Switch to any value
% from this page to resize cheat sheet text:
% www.emerson.emory.edu/services/latex/latex_169.html
\footnotesize % Small font.

\begin{multicols*}{2}

\begin{tabularx}{8.4cm}{x{4 cm} x{4 cm} }
\SetRowColor{DarkBackground}
\mymulticolumn{2}{x{8.4cm}}{\bf\textcolor{white}{Domain 4. Incident Response}}  \tn
% Row 0
\SetRowColor{LightBackground}
Incident Response Phases & - Preparation\{\{nl\}\}- Detection \& Analysis\{\{nl\}\}- Containment\{\{nl\}\}- Eradication \& Recovery\{\{nl\}\}- Post Incident Activity \tn 
% Row Count 6 (+ 6)
% Row 1
\SetRowColor{white}
Communication plan & - Limiting communication to trusted parties\{\{nl\}\}- Disclosing based on \seqsplit{regulatory/legislative} requirements\{\{nl\}\}- Preventing inadvertent release of information\{\{nl\}\}- Using a secure method of communication\{\{nl\}\}- Reporting requirements \tn 
% Row Count 18 (+ 12)
% Row 2
\SetRowColor{LightBackground}
Reporting Requirements - Type of Breach & - Data exfiltration\{\{nl\}\}- Insider data exfiltration\{\{nl\}\}- Device theft/loss\{\{nl\}\}- Accidental data breach\{\{nl\}\}- \seqsplit{Integrity/availability} \tn 
% Row Count 25 (+ 7)
% Row 3
\SetRowColor{white}
Response coordination & - Legal\{\{nl\}\}- Human resources\{\{nl\}\}- Public relations\{\{nl\}\}- Internal and external\{\{nl\}\}- Law enforcement\{\{nl\}\}- Senior leadership\{\{nl\}\}- Regulatory bodies \tn 
% Row Count 33 (+ 8)
\end{tabularx}
\par\addvspace{1.3em}

\vfill
\columnbreak
\begin{tabularx}{8.4cm}{x{4 cm} x{4 cm} }
\SetRowColor{DarkBackground}
\mymulticolumn{2}{x{8.4cm}}{\bf\textcolor{white}{Domain 4. Incident Response (cont)}}  \tn
% Row 4
\SetRowColor{LightBackground}
Data Criticality and Prioritization & - Personally Identifiable Information (PII)\{\{nl\}\}- Sensitive Personal Information (SPI)\{\{nl\}\}- Personal Health Information (PHI)\{\{nl\}\}- Financial Information\{\{nl\}\}- Intellectual property (IP)\{\{nl\}\}- Corporate Information\{\{nl\}\}- high value asset (HVA) \tn 
% Row Count 13 (+ 13)
% Row 5
\SetRowColor{white}
Preparation Phase & - Training\{\{nl\}\}- Testing\{\{nl\}\}- Documentation of procedures \tn 
% Row Count 16 (+ 3)
% Row 6
\SetRowColor{LightBackground}
Documentation of Procedures & - Incident Response Plan\{\{nl\}\}- Call List/Escalation List\{\{nl\}\}- Incident Form \tn 
% Row Count 20 (+ 4)
% Row 7
\SetRowColor{white}
OODA loop & - Observe\{\{nl\}\}- Orient\{\{nl\}\}- Decide\{\{nl\}\}- Act \tn 
% Row Count 23 (+ 3)
% Row 8
\SetRowColor{LightBackground}
Defensive Capabilities & - Detect\{\{nl\}\}- Destroy\{\{nl\}\}- Degrade\{\{nl\}\}- Disrupt\{\{nl\}\}- Deny\{\{nl\}\}- Deceive \tn 
% Row Count 27 (+ 4)
% Row 9
\SetRowColor{white}
Immediate impact & direct costs incurred because of an incident \tn 
% Row Count 30 (+ 3)
\end{tabularx}
\par\addvspace{1.3em}

\vfill
\columnbreak
\begin{tabularx}{8.4cm}{x{4 cm} x{4 cm} }
\SetRowColor{DarkBackground}
\mymulticolumn{2}{x{8.4cm}}{\bf\textcolor{white}{Domain 4. Incident Response (cont)}}  \tn
% Row 10
\SetRowColor{LightBackground}
Total impact & costs that arise following the incident, including damage to the company's reputation \tn 
% Row Count 5 (+ 5)
% Row 11
\SetRowColor{white}
Incident Security Level Classification characteristics (Detection \& Analytics) & - Data integrity\{\{nl\}\}- System process criticality\{\{nl\}\}- Downtime\{\{nl\}\}- Economic\{\{nl\}\}- Data correlation\{\{nl\}\}- Reverse engineering\{\{nl\}\}- Recovery time\{\{nl\}\}- Detection time \tn 
% Row Count 14 (+ 9)
% Row 12
\SetRowColor{LightBackground}
Containment & - Isolation-Based Containment\{\{nl\}\}- Segmentation-based Containment \tn 
% Row Count 18 (+ 4)
% Row 13
\SetRowColor{white}
Containment principals & - Ensure the safety and security of all personnel.\{\{nl\}\}- Prevent ongoing intrusion or data breach.\{\{nl\}\}- Identify whether the intrusion is the primary attack or a secondary one (part of a more complex campaign).\{\{nl\}\}- Avoid alerting the attacker to the fact that the intrusion has been discovered.\{\{nl\}\}- Preserve forensic evidence of the intrusion. \tn 
% Row Count 36 (+ 18)
\end{tabularx}
\par\addvspace{1.3em}

\vfill
\columnbreak
\begin{tabularx}{8.4cm}{x{4 cm} x{4 cm} }
\SetRowColor{DarkBackground}
\mymulticolumn{2}{x{8.4cm}}{\bf\textcolor{white}{Domain 4. Incident Response (cont)}}  \tn
% Row 14
\SetRowColor{LightBackground}
Eradication & - Sanitization and Secure Disposal (cryptographic erase, zero-fill)\{\{nl\}\}- Reconstruction/Reimaging\{\{nl\}\}- Reconstitution of Resources \tn 
% Row Count 7 (+ 7)
% Row 15
\SetRowColor{white}
cryptographic erase & A method of sanitizing a self-encrypting drive by erasing the media encryption key \tn 
% Row Count 12 (+ 5)
% Row 16
\SetRowColor{LightBackground}
zero-fill & A method of sanitizing a drive by setting all bits to zero. \tn 
% Row Count 15 (+ 3)
% Row 17
\SetRowColor{white}
Secure disposal & physical destruction by mechanical shredding or incineration \tn 
% Row Count 18 (+ 3)
% Row 18
\SetRowColor{LightBackground}
Reimage & A method of restoring a system that has been sanitized using an image-based backup. \tn 
% Row Count 23 (+ 5)
% Row 19
\SetRowColor{white}
Reconstruction & A method of restoring a system that has been sanitized using scripted installation routines and templates. \tn 
% Row Count 29 (+ 6)
% Row 20
\SetRowColor{LightBackground}
Reconstitution & A method of restoring a system that cannot be sanitized using manual removal, reinstallation, and monitoring processes. \tn 
% Row Count 35 (+ 6)
\end{tabularx}
\par\addvspace{1.3em}

\vfill
\columnbreak
\begin{tabularx}{8.4cm}{x{4 cm} x{4 cm} }
\SetRowColor{DarkBackground}
\mymulticolumn{2}{x{8.4cm}}{\bf\textcolor{white}{Domain 4. Incident Response (cont)}}  \tn
% Row 21
\SetRowColor{LightBackground}
Recovery & - Patching\{\{nl\}\}- Restoration of Permissions\{\{nl\}\}- Verification of \seqsplit{Logging/Communication} to Security Monitoring\{\{nl\}\}- Vulnerability Mitigation and System Hardening \tn 
% Row Count 9 (+ 9)
% Row 22
\SetRowColor{white}
Post-Incident Activities & - Report Writing\{\{nl\}\}- Incident Summary Report\{\{nl\}\}- Evidence Retention \tn 
% Row Count 13 (+ 4)
\hhline{>{\arrayrulecolor{DarkBackground}}--}
\end{tabularx}
\par\addvspace{1.3em}

\begin{tabularx}{8.4cm}{x{4 cm} x{4 cm} }
\SetRowColor{DarkBackground}
\mymulticolumn{2}{x{8.4cm}}{\bf\textcolor{white}{Domain 3. Security Operations and Monitoring}}  \tn
% Row 0
\SetRowColor{LightBackground}
heuristic analysis & A method that uses feature comparisons and likenesses rather than specific signature matching to identify whether the target of observation is malicious. \tn 
% Row Count 8 (+ 8)
% Row 1
\SetRowColor{white}
Endpoint Data Collection and Analytics Tools & - Anti-virus (A-V)\{\{nl\}\}- Host-Based Intrusion \seqsplit{Detection/Prevention} (HIDS/HIPS)\{\{nl\}\}- Endpoint Protection Platform (EPP)\{\{nl\}\}- Endpoint Detection and Response (EDR)\{\{nl\}\}- User and Entity Behavior Analytics (UEBA) \tn 
% Row Count 19 (+ 11)
% Row 2
\SetRowColor{LightBackground}
Endpoint Protection Platform (EPP) & - a single agent performing multiple security tasks and features.\{\{nl\}\}- (malware/IDP), host firewall, web content filtering, (DLP) enforcement, and file/message encryption.  \{\{nl\}\}- In an enterprise solution, there will also be a single management dashboard for configuring and monitoring hosts.\{\{nl\}\}- mostly signature-based detection and prevention \tn 
% Row Count 37 (+ 18)
\end{tabularx}
\par\addvspace{1.3em}

\vfill
\columnbreak
\begin{tabularx}{8.4cm}{x{4 cm} x{4 cm} }
\SetRowColor{DarkBackground}
\mymulticolumn{2}{x{8.4cm}}{\bf\textcolor{white}{Domain 3. Security Operations and Monitoring (cont)}}  \tn
% Row 3
\SetRowColor{LightBackground}
Endpoint Detection and Response (EDR) & - focused on logging of endpoint observables and indicators combined with behavioral- and anomaly-based analysis.\{\{nl\}\}- to provide real-time and historical visibility, containment, and facilitate remediation of the host to its original state. \tn 
% Row Count 13 (+ 13)
% Row 4
\SetRowColor{white}
User and Entity Behavior Analytics (UEBA) & - analysis process supporting identification of malicious behaviors from comparison to a baseline\{\{nl\}\}- tracks user account behavior across different devices and cloud services \tn 
% Row Count 22 (+ 9)
% Row 5
\SetRowColor{LightBackground}
Sandboxing & technique that isolates untrusted data in a closed virtual environment to conduct tests and analyze the data for threats and vulnerabilities. \tn 
% Row Count 30 (+ 8)
\end{tabularx}
\par\addvspace{1.3em}

\vfill
\columnbreak
\begin{tabularx}{8.4cm}{x{4 cm} x{4 cm} }
\SetRowColor{DarkBackground}
\mymulticolumn{2}{x{8.4cm}}{\bf\textcolor{white}{Domain 3. Security Operations and Monitoring (cont)}}  \tn
% Row 6
\SetRowColor{LightBackground}
Disassemblers and Decompilers & software that translate low-level machine language code into higher level code \tn 
% Row Count 4 (+ 4)
% Row 7
\SetRowColor{white}
Malware Exploit Techniques & - Malware Exploit Techniques\{\{nl\}\}- Maintain access\{\{nl\}\}- Strengthen access\{\{nl\}\}- Actions on objectives\{\{nl\}\}- Concealment \tn 
% Row Count 11 (+ 7)
% Row 8
\SetRowColor{LightBackground}
Living off the land & subvert existing architecture, such as Windows PowerShell, to perform the malicious activity. \tn 
% Row Count 16 (+ 5)
% Row 9
\SetRowColor{white}
\mymulticolumn{2}{x{8.4cm}}{\{\{bt\}\}} \tn 
% Row Count 17 (+ 1)
\hhline{>{\arrayrulecolor{DarkBackground}}--}
\end{tabularx}
\par\addvspace{1.3em}


% That's all folks
\end{multicols*}

\end{document}