Cybersecurity Cheat Sheet

Cybersecurity Cheat Sheet: Threats, Encryption, Network Security & Best Practices

Cybersecurity is the practice of protecting computers, networks, applications, accounts, and data from unauthorized access, attacks, damage, and disruption.

Individuals use cybersecurity to protect their personal information and online accounts. Organizations use it to safeguard customer data, financial systems, business operations, and digital infrastructure.

This cheat sheet explains essential cybersecurity concepts, common threats, security controls, authentication methods, encryption, and practical safety measures for beginners and professionals.

1. What Is Cybersecurity?

Cybersecurity combines technologies, processes, policies, and human practices to protect digital systems and information.

Common Cybersecurity Objectives

The three foundational objectives are known as the CIA triad.

Other important security objectives include authenticity, accountability, privacy, and non-repudiation.

Why Cybersecurity Matters

• Protects sensitive information.

• Reduces the risk of financial fraud.

• Helps maintain business continuity.

• Protects digital identities.

• Reduces unauthorized access.

• Supports regulatory and contractual obligations.

• Builds customer and stakeholder trust.

2. Common Cybersecurity Threats

A cybersecurity threat is a potential cause of harm to a system, account, network, or data.

Threats can involve technology, human behavior, weak processes, or a combination of these factors.

3. Phishing and Social Engineering

Phishing attempts to deceive people into disclosing sensitive information, approving unauthorized actions, or opening harmful files or links.

Common Forms

• Email phishing: Fraudulent emails designed to appear legitimate.

• Spear phishing: Messages tailored to a specific person or organization.

• Smishing: Phishing through text messages.

• Vishing: Voice-based phishing, often through calls.

• Business email compromise: Impersonation or compromise of business email accounts to manipulate payments or information.

• QR-code phishing: Malicious QR codes that direct users to deceptive websites.

Warning Signs

• Unexpected urgency.

• Requests for passwords or verification codes.

• Unusual payment instructions.

• Suspicious links or attachments.

• Unexpected requests to change bank details.

• Messages that imitate trusted organizations.

• Sender addresses that do not match the claimed identity.

How to Stay Safe

1. Verify the sender independently.

2. Inspect links before opening them.

3. Avoid entering credentials after following unexpected links.

4. Never share one-time verification codes with an unverified requester.

5. Confirm payment or account changes through a trusted channel.

6. Report suspicious messages using your organization's approved process.

7. Use multifactor authentication where available.

A message can be well-written and still be fraudulent. Do not rely on spelling mistakes alone to identify phishing.

4. Malware Types

Malware is software intended to perform harmful or unauthorized actions.

Malware Prevention

• Install software from trusted sources.

• Apply operating system and application updates.

• Use appropriate endpoint protection.

• Avoid unexpected attachments and downloads.

• Restrict administrative privileges.

• Maintain offline or otherwise protected backups.

• Review unusual system behavior.

• Avoid disabling security controls without authorization.

No single security product prevents every type of malware. Layered controls are more effective than relying on one tool.

5. Authentication and Authorization

Authentication verifies an identity. Authorization determines what that identity is allowed to do.

Authentication Factors

Multifactor authentication (MFA) combines factors from different categories.

Two passwords do not constitute two different authentication factors because both belong to the knowledge category.

Common Authentication Methods

• Passwords.

• Authenticator applications.

• Hardware security keys.

• Passkeys.

• One-time codes.

• Biometrics.

• Certificates.

Best Practices

• Use unique passwords for different accounts.

• Prefer a reputable password manager.

• Enable MFA, especially for email, financial, and administrator accounts.

• Use phishing-resistant authentication when practical.

• Avoid sharing credentials.

• Remove access that is no longer required.

• Protect account recovery methods.

Authentication vs. Authorization

Authentication: “Who are you?”

Authorization: “What are you allowed to access or do?”

For example, an employee may successfully sign in but still be prohibited from accessing payroll records.

6. Password Security

Passwords remain an important part of many authentication systems.

Strong Password Practices

• Use long, unique passwords or passphrases.

• Avoid predictable patterns and personal information.

• Never reuse a password across important accounts.

• Store passwords in a reputable password manager.

• Change credentials promptly when compromise is suspected.

• Enable MFA where available.

Password Hashing

Secure systems should not store ordinary passwords as readable text.

Instead, they generally store password hashes produced using password-hashing algorithms designed to resist guessing attacks, such as Argon2id, scrypt, or appropriately configured bcrypt.

Password storage should use unique salts and appropriate parameters. A general-purpose fast hash such as plain SHA-256 is not a suitable standalone password-storage method.

Least Privilege

Users and applications should receive only the permissions required for their tasks.

This limits the potential impact of compromised accounts.

7. Encryption Fundamentals

Encryption transforms readable information into a protected form using a cryptographic process and key.

Symmetric Encryption

Uses the same secret key for encryption and decryption.

Example algorithm: AES.

Common use cases include protecting stored files and encrypting data within secure systems.

Asymmetric Encryption

Uses a mathematically related public and private key pair.

Common uses include digital signatures and establishing secure communication.

Examples of relevant cryptographic algorithms include RSA and elliptic-curve cryptography.

Hashing vs. Encryption

A hash is not encryption. It should not be described as a reversible way to hide data.

Data at Rest and in Transit

Data at rest: Information stored on disks, devices, or storage systems.

Data in transit: Information moving across a network.

Sensitive information may need protection in both states.

Encryption does not eliminate every risk. Access controls, key management, endpoint security, and secure application design remain important.

8. Network Security Fundamentals

Network security protects communication systems and connected devices against unauthorized access, disruption, and misuse.

Firewall

A firewall applies rules to network traffic.

Rules may consider source and destination addresses, ports, protocols, connection state, and other attributes.

Virtual Private Network (VPN)

A VPN creates a protected network connection between endpoints or networks.

VPNs are commonly used for remote access or connecting separate networks. They do not automatically make every online activity anonymous or protect against every form of malware and phishing.

Intrusion Detection and Prevention

• IDS: Intrusion Detection System; identifies suspicious activity and generates alerts.

• IPS: Intrusion Prevention System; detects and can block certain suspicious activity.

Network Segmentation

Divides a network into separate zones to restrict unnecessary communication and reduce the spread of compromise.

Secure Protocols

Avoid sending sensitive information through unencrypted protocols when a secure alternative is available.

9. Common Ports and Protocols

Ports identify application-level services associated with network endpoints.

These are common defaults, not guarantees. Services can be configured to use different ports, and modern protocols may use other transports.

Port Security Best Practices

• Expose only required services.

• Restrict administrative access.

• Avoid exposing database ports publicly without a justified, secure design.

• Use network rules and access controls.

• Monitor unusual traffic.

• Disable unnecessary services.

• Keep exposed services updated.

10. Web Application Security

Web applications can be vulnerable when they handle input, sessions, access permissions, or sensitive information incorrectly.

Common Vulnerabilities

SQL injection: Untrusted input changes the meaning of a database query.

Cross-site scripting (XSS): Untrusted content executes as script in another user's browser.

Cross-site request forgery (CSRF): A user's authenticated browser is tricked into making an unwanted request against a vulnerable application.

Broken access control: Users can perform actions or access information beyond their permissions.

Security misconfiguration: Unsafe settings expose systems or sensitive information.

Insecure authentication: Weak login, session, or recovery mechanisms allow account compromise.

Prevention Principles

• Use parameterized database queries.

• Validate and appropriately encode untrusted input.

• Enforce authorization on the server side.

• Protect session cookies and authentication tokens.

• Use secure transport.

• Apply appropriate security headers.

• Keep dependencies updated.

• Test applications before deployment.

• Avoid exposing internal error details to users.

• Follow a secure development lifecycle.

Input validation is useful, but it is not a substitute for context-appropriate output encoding, parameterized queries, and proper authorization.

11. Vulnerabilities, Threats, and Risks

These terms are related but have different meanings.

Threat: Something that could cause harm.

Vulnerability: A weakness that could be exploited or otherwise lead to harm.

Exploit: A method or action that takes advantage of a vulnerability.

Risk: The potential impact and likelihood of an adverse event in a particular context.

Patch: An update that fixes or improves software.

Example

• Threat: An attacker seeking access to a business system.

• Vulnerability: An unpatched software flaw.

• Exploit: A technique that abuses the flaw.

• Risk: Potential loss of customer data or interruption of business operations.

• Mitigation: Apply the security patch, restrict exposure, and monitor for suspicious activity.

Not every vulnerability will be exploited, and not every security incident depends on a software vulnerability.

12. Security Updates and Patch Management

Security patches correct vulnerabilities and may improve system reliability.

Patch Management Checklist

1. Maintain an inventory of systems and applications.

2. Identify relevant security advisories.

3. Assess severity and exposure.

4. Prioritize critical and actively exploited vulnerabilities.

5. Test updates where appropriate.

6. Deploy patches using a controlled process.

7. Verify installation.

8. Monitor for unexpected effects.

9. Track exceptions and unresolved issues.

Unsupported software presents additional risks because security fixes may no longer be available.

Where immediate patching is not possible, use documented compensating controls and a defined remediation plan.

13. Cloud Security Basics

Cloud security protects cloud-hosted infrastructure, applications, identities, and data.

Shared Responsibility Model

Cloud providers and customers have different responsibilities depending on the service.

For example, a provider may secure physical data centers and underlying infrastructure, while a customer remains responsible for account permissions, application configuration, and data access policies.

The exact split differs between infrastructure, platform, and software services.

Cloud Security Checklist

• Enable multifactor authentication.

• Apply least-privilege access.

• Avoid public exposure of sensitive storage.

• Protect API keys and credentials.

• Use encryption where appropriate.

• Review network access rules.

• Enable relevant audit logs.

• Back up important data.

• Monitor unexpected access and spending.

• Review access permissions periodically.

Misconfiguration is a major source of cloud security exposure, so secure defaults and regular configuration reviews are important.

14. Backup and Ransomware Protection

Ransomware can prevent access to data and disrupt operations. Some attacks also involve data theft or extortion.

Backup Best Practices

• Maintain multiple copies of critical data.

• Keep at least one copy isolated or otherwise protected against compromise of production systems.

• Restrict backup deletion permissions.

• Encrypt backups when appropriate.

• Monitor backup jobs.

• Test restoration regularly.

• Document recovery procedures.

• Establish recovery time and recovery point objectives.

Recovery Steps After a Suspected Ransomware Incident

1. Follow the organization's incident response process.

2. Isolate affected systems when safe and appropriate.

3. Notify the designated security or IT team.

4. Preserve relevant evidence.

5. Avoid connecting clean backup systems to compromised environments without assessment.

6. Identify the scope of the incident.

7. Restore from trusted backups after the environment is secured.

8. Reset compromised credentials and address the initial entry point.

9. Follow applicable reporting and legal requirements.

Do not assume that paying a ransom will restore data or prevent further exposure.

15. Security Monitoring and Incident Response

Security monitoring helps identify suspicious activity. Incident response provides a structured way to manage confirmed or suspected security incidents.

Common Security Monitoring Sources

• Authentication logs.

• Endpoint alerts.

• Firewall logs.

• Network traffic information.

• Cloud audit logs.

• Application logs.

• Data access records.

• Email security alerts.

Incident Response Lifecycle

1. Preparation: Establish procedures, responsibilities, tools, and training.

2. Detection and analysis: Identify suspicious activity and assess its significance.

3. Containment: Limit further damage.

4. Eradication: Remove the cause and malicious components.

5. Recovery: Restore systems safely.

6. Lessons learned: Improve controls and processes.

Specific frameworks organize these activities differently, but preparation, detection, containment, recovery, and improvement are common elements.

16. Cybersecurity Best Practices for Individuals

• Use unique passwords for important accounts.

• Enable MFA.

• Keep devices and applications updated.

• Download software from trusted sources.

• Verify unexpected requests for money or credentials.

• Avoid sensitive transactions over untrusted networks without appropriate protection.

• Lock devices when unattended.

• Review account activity.

• Back up important files.

• Secure home Wi-Fi with modern encryption and strong administrative credentials.

• Remove unused applications and accounts.

• Learn how to report suspected fraud or compromise.

Be cautious about unexpected technical support calls, urgent payment requests, and messages requesting remote access to your device.

17. Cybersecurity Best Practices for Organizations

• Maintain an inventory of devices, applications, and data.

• Classify sensitive information.

• Enforce access control and MFA.

• Apply security patches promptly.

• Segment critical networks.

• Maintain tested backups.

• Train employees to recognize social engineering.

• Establish incident response procedures.

• Monitor important systems.

• Assess supplier and third-party risks.

• Test security controls.

• Review permissions and logs.

• Maintain documented policies and recovery plans.

Security is an ongoing operational responsibility, not a one-time software installation.

18. Essential Cybersecurity Acronyms

19. Cybersecurity Interview Questions

What is cybersecurity?

The practice of protecting systems, networks, applications, and information from digital threats.

What is the CIA triad?

Confidentiality, Integrity, and Availability.

What is the difference between a threat and a vulnerability?

A threat could cause harm, while a vulnerability is a weakness that could be exploited or lead to harm.

What is phishing?

A deceptive attempt to obtain information or cause an unsafe action by impersonating a trusted source.

What is the difference between authentication and authorization?

Authentication verifies identity; authorization determines permitted actions.

What is encryption?

A cryptographic process that protects confidentiality by transforming readable information into a protected form.

What is hashing?

A process that produces a digest from input data, commonly used for integrity checks and secure password storage when an appropriate password-hashing scheme is used.

What is a firewall?

A security control that filters network traffic according to defined rules.

What is ransomware?

Malware that denies access to data or systems, commonly through encryption, often for extortion.

What is multifactor authentication?

Authentication that combines factors from at least two different categories.

What is the principle of least privilege?

Giving users and systems only the permissions necessary for their tasks.

What is incident response?

The structured process of detecting, managing, containing, and recovering from security incidents.

20. Cybersecurity Quick Reference

21. Cybersecurity Learning Checklist

Fundamentals

• Explain the CIA triad.

• Distinguish threats, vulnerabilities, exploits, and risks.

• Recognize common malware and phishing techniques.

• Understand authentication and authorization.

Technical Concepts

• Understand encryption and hashing.

• Learn common network protocols and ports.

• Understand firewalls, VPNs, and network segmentation.

• Recognize common web application vulnerabilities.

• Understand patching and access controls.

Security Operations

• Explain incident response stages.

• Understand backup and recovery practices.

• Recognize common security monitoring sources.

• Understand the cloud shared responsibility model.

• Apply secure password and MFA practices.

Professional Development

• Practice identifying suspicious messages.

• Learn basic networking and operating system concepts.

• Understand vulnerability management.

• Study security frameworks and responsible security practices.

• Practice only in authorized environments.

Conclusion

Cybersecurity protects the systems and information that individuals and organizations depend on every day. Understanding common threats, authentication, encryption, network security, patch management, monitoring, and incident response provides a strong foundation for developing safer digital habits and pursuing cybersecurity roles.

Start with account security, networking fundamentals, and secure system configuration. Then explore vulnerability management, security monitoring, and incident response through authorized training environments. Effective cybersecurity combines appropriate technology, sound processes, and informed human decisions.