CISSP Cram Sheet
Print me. Everything examinable and forgettable, one page.
Formulas
- SLE = AV × EF · ALE = SLE × ARO
- Control value = ALE(before) − ALE(after) − annual control cost
- RTO + WRT ≤ MTD/MAO
Models
- Bell-LaPadula (confidentiality): no read UP / no write DOWN
- Biba (integrity): no read DOWN / no write UP
- Clark-Wilson: TP + CDI + UDI + IVP (commercial integrity)
- Brewer-Nash: Chinese Wall (conflict of interest)
Crypto
- AES-128/192/256 symmetric; RSA/DH/ECC asymmetric; SHA-2/3 hashing; HMAC keyed hash
- Signature = sender's PRIVATE key; confidentiality = receiver's PUBLIC key
- WEP dead → TKIP dead → CCMP (WPA2) → SAE (WPA3)
- ECB never; GCM default (auth'd); IPsec ESP encrypts, AH authenticates
Ports
- 20/21 FTP · 22 SSH · 23 Telnet · 25 SMTP · 53 DNS · 67/68 DHCP · 69 TFTP
- 80 HTTP · 88 Kerberos · 110/143 POP/IMAP · 161/162 SNMP · 389/636 LDAP(S)
- 443 HTTPS · 445 SMB · 514 syslog · 993/995 IMAPS/POP3S · 3389 RDP
Biometrics & IAM
- FRR = Type I (real user rejected) · FAR = Type II (impostor accepted) · CER = crossover
- Kerberos: KDC(AS+TGS) → TGT → ST, port 88, time-sensitive, KDC = SPOF
- SAML SSO · OAuth2 authorisation · OIDC authn · FIDO2 phishing-resistant
- MAC labels · DAC owner · RBAC roles · ABAC attributes
Operations
- IR: Preparation → Detection → Containment → Eradication → Recovery → Lessons
- Volatility: registers → RAM → disk → remote logs → archives
- Differential = since last FULL; incremental = since last backup; 3-2-1 rule
- SOC2 Type II = period + effectiveness · pen test starts with AUTHORISATION
Software
- SQLi → prepared statements · XSS → output encoding+CSP · CSRF → tokens+SameSite
- ACID = atomicity, consistency, isolation, durability
- Spiral = risk-driven · Agile = sprints · DevSecOps = shift left