iwantcoding.com
🔥 Daily 👥 Rooms 🏆 Top Log in Sign up

Cheatsheet

By · Reviewed & last updated · Part of Ethical Hacking Tutorial

Defensive view: a one-page checklist a security engineer can keep open daily.

Daily defensive checklist

EXAMPLE
# Defensive cheatsheet - daily checklist

## Identity + access
- MFA everywhere; phishing-resistant where possible (FIDO2)
- OIDC federation from CI to cloud - no long-lived keys
- IAM Access Analyzer reviewed weekly
- Quarterly access reviews; deprovision on day-of-leave
- Service accounts: scoped, audited, rotated

## Network
- Default-deny egress in workloads
- VPC endpoints / Private Link for cloud services
- Segmented IoT VLAN
- TLS everywhere; mTLS where you can

## Endpoint
- EDR enrolled with HIPS rules tuned
- Disk encryption + secure boot
- USB autorun disabled
- Screen lock + short timeout enforced

## Cloud
- Block public S3 / storage at the org level
- SCPs deny risky regions + services
- CloudTrail org trail to a log archive account
- GuardDuty + AWS Config (or equivalents)

## CI/CD
- Pre-commit hooks + signed commits
- Dependency scanning + SBOM (trivy, scout, syft)
- Image signing (cosign, sigstore)
- OIDC to cloud, never static creds
- Secrets in a manager + rotated; never in env vars in plaintext

## Detection
- Sigma rules backed by a vendor-neutral SIEM
- MITRE ATT&CK coverage tracked
- Atomic Red Team in a lab regularly
- Tabletop exercises quarterly

## Incident response
- Out-of-band comms ready
- IR retainer + breach counsel pre-identified
- Runbooks for top scenarios (BEC, ransom, cloud cred, insider)
- Blameless post-mortems within 5 business days

## Vulnerability management
- Inventory + classification of every asset
- Patch SLA by severity (e.g. critical < 14d, high < 30d)
- Track time-to-remediation as a metric
- Pen test annually; bug bounty if ready

## Comms + culture
- Security@ inbox monitored
- security.txt published
- Phishing simulations + reporting incentives
- Engineers can talk to security without fear

## What to audit weekly
- New IAM users / access keys
- New OAuth grants
- New cross-account roles
- Recently disabled MFA

Why it matters

Print this. Half of security work is doing the basics with discipline. The checklist plus a tabletop quarterly plus a healthy reporting culture covers more risk than any single tool.

Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.

Example

Example
# Auth in writing | Scope | nmap | Burp / ZAP | sqlmap (in scope) | linpeas / winPEAS
# MITRE ATT&CK | OWASP ASVS | reports that prioritise remediation
Try it Yourself »

Discussion

Loading…