digital-forensics-labs/SecGen
1
0
Fork 0
mirror of https://github.com/cliffe/SecGen.git synced 2026-02-20 13:50:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

CyBOK

Browse Source
This commit is contained in:
Z. Cliffe Schreuders
2021-04-27 01:29:35 +01:00
parent 6a89b31db0
commit 878ebf9c92
5 changed files with 175 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files

86
README-CyBOK-Lecture-Videos.md
View File

@@ -24,8 +24,8 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authentication | user authentication |
| OSVS | Primitives for Isolation and Mediation | authentication and identification; Linux authentication; Types of user accounts |
| Authentication, Authorisation & Accountability (AAA) | Authentication | user authentication |
| (OSVS) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication; Types of user accounts |
@@ -41,8 +41,8 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) |
| OSVS | Primitives for Isolation and Mediation | authentication and identification; Linux authentication |
| Authentication, Authorisation & Accountability (AAA) | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) |
| (OSVS) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication |
@@ -58,8 +58,8 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) |
| OSVS | Primitives for Isolation and Mediation | authentication and identification; Linux authentication |
| Authentication, Authorisation & Accountability (AAA) | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) |
| (OSVS) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication |
@@ -75,8 +75,8 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) |
| OSVS | Primitives for Isolation and Mediation | authentication and identification; Linux authentication |
| Authentication, Authorisation & Accountability (AAA) | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) |
| (OSVS) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication |
@@ -92,8 +92,8 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authentication | identity management; user authentication; facets of authentication |
| OSVS | Primitives for Isolation and Mediation | authentication and identification; Linux authentication |
| Authentication, Authorisation & Accountability (AAA) | Authentication | identity management; user authentication; facets of authentication |
| (OSVS) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication |
@@ -109,7 +109,7 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authentication | identity management; user authentication; facets of authentication; AUTHENTICATION - BIOMETRICS |
| Authentication, Authorisation & Accountability (AAA) | Authentication | identity management; user authentication; facets of authentication; AUTHENTICATION - BIOMETRICS |
@@ -125,7 +125,7 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authentication | identity management; user authentication; facets of authentication; AUTHENTICATION - OTP (ONE-TIME PASSWORD); AUTHENTICATION - TOKENS |
| Authentication, Authorisation & Accountability (AAA) | Authentication | identity management; user authentication; facets of authentication; AUTHENTICATION - OTP (ONE-TIME PASSWORD); AUTHENTICATION - TOKENS |
@@ -141,9 +141,9 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authentication | identity management; authentication in distributed systems; user authentication; Network based-authentication with heterogeneous Linux and Windows networks |
| AAA | Authorisation | AUTHORIZATION - SSO (SINGLE SIGN-ON); AUTHORIZATION - LDAP (LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL); AUTHENTICATION - KERBEROS; ACTIVE DIRECTORY DOMAIN SERVICES (ADDS) |
| AAA | Access Control in Distributed Systems | core concepts; federated access control |
| Authentication, Authorisation & Accountability (AAA) | Authentication | identity management; authentication in distributed systems; user authentication; Network based-authentication with heterogeneous Linux and Windows networks |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | AUTHORIZATION - SSO (SINGLE SIGN-ON); AUTHORIZATION - LDAP (LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL); AUTHENTICATION - KERBEROS; ACTIVE DIRECTORY DOMAIN SERVICES (ADDS) |
| Authentication, Authorisation & Accountability (AAA) | Access Control in Distributed Systems | core concepts; federated access control |
@@ -159,8 +159,8 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authentication | identity management; authentication in distributed systems; user authentication |
| AAA | Authorisation | theory; Network based-authentication with heterogeneous Linux and Windows networks; AUTHORIZATION - LDAP (LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL) |
| Authentication, Authorisation & Accountability (AAA) | Authentication | identity management; authentication in distributed systems; user authentication |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | theory; Network based-authentication with heterogeneous Linux and Windows networks; AUTHORIZATION - LDAP (LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL) |
@@ -176,8 +176,8 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authentication | identity management; authentication in distributed systems; user authentication; Network based-authentication with heterogeneous Linux and Windows networks |
| AAA | Authorisation | AUTHENTICATION - KERBEROS |
| Authentication, Authorisation & Accountability (AAA) | Authentication | identity management; authentication in distributed systems; user authentication; Network based-authentication with heterogeneous Linux and Windows networks |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | AUTHENTICATION - KERBEROS |
@@ -193,9 +193,9 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authentication | identity management; authentication in distributed systems; user authentication; Network based-authentication with heterogeneous Linux and Windows networks |
| AAA | Authorisation | AUTHORIZATION - SSO (SINGLE SIGN-ON); AUTHORIZATION - LDAP (LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL); AUTHENTICATION - KERBEROS; ACTIVE DIRECTORY DOMAIN SERVICES (ADDS) |
| AAA | Access Control in Distributed Systems | core concepts; federated access control |
| Authentication, Authorisation & Accountability (AAA) | Authentication | identity management; authentication in distributed systems; user authentication; Network based-authentication with heterogeneous Linux and Windows networks |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | AUTHORIZATION - SSO (SINGLE SIGN-ON); AUTHORIZATION - LDAP (LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL); AUTHENTICATION - KERBEROS; ACTIVE DIRECTORY DOMAIN SERVICES (ADDS) |
| Authentication, Authorisation & Accountability (AAA) | Access Control in Distributed Systems | core concepts; federated access control |
@@ -211,9 +211,9 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authorisation | access control; enforcing access control; theory |
| OSVS | Primitives for Isolation and Mediation | Access controls and operating systems |
| OSVS | Role of Operating Systems | mediation; TRUSTED COMPUTING BASE (TCB); REFERENCE MONITOR |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; enforcing access control; theory |
| (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems |
| (OSVS) | Role of Operating Systems | mediation; TRUSTED COMPUTING BASE (TCB); REFERENCE MONITOR |
@@ -229,9 +229,9 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authorisation | access control; enforcing access control; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL) |
| OSVS | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; filesystems; inodes; and commands |
| OSVS | Role of Operating Systems | mediation |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; enforcing access control; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL) |
| (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; filesystems; inodes; and commands |
| (OSVS) | Role of Operating Systems | mediation |
@@ -247,8 +247,8 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authorisation | access control; theory; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL); ACCESS CONTROL - MAC (MANDATORY ACCESS CONTROL); ACCESS CONTROL - NDAC (NON-DISCRETIONARY ACCESS CONTROL); ACCESS CONTROL - ROLE-BASED |
| OSVS | OS Security Principles | security models |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; theory; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL); ACCESS CONTROL - MAC (MANDATORY ACCESS CONTROL); ACCESS CONTROL - NDAC (NON-DISCRETIONARY ACCESS CONTROL); ACCESS CONTROL - ROLE-BASED |
| (OSVS) | OS Security Principles | security models |
@@ -264,8 +264,8 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authorisation | access control; Elevated privileges; Real and effective identity; Vulnerabilities and attacks on access control misconfigurations |
| OSVS | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; setuid/setgid |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; Elevated privileges; Real and effective identity; Vulnerabilities and attacks on access control misconfigurations |
| (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; setuid/setgid |
@@ -281,8 +281,8 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authorisation | access control; ACCESS CONTROL - MATRIX; ACCESS CONTROL LIST (ACL); Vulnerabilities and attacks on access control misconfigurations |
| OSVS | Primitives for Isolation and Mediation | capabilities |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; ACCESS CONTROL - MATRIX; ACCESS CONTROL LIST (ACL); Vulnerabilities and attacks on access control misconfigurations |
| (OSVS) | Primitives for Isolation and Mediation | capabilities |
@@ -298,8 +298,8 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authorisation | access control; ACCESS CONTROL LIST (ACL); Vulnerabilities and attacks on access control misconfigurations |
| OSVS | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; ACCESS CONTROL LIST (ACL); Vulnerabilities and attacks on access control misconfigurations |
| (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) |
@@ -315,10 +315,10 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authorisation | SANDBOX; Application-based access controls: user-based access controls insufficiently limit privileges |
| OSVS | Primitives for Isolation and Mediation | capabilities; Container-based sandboxes: chroot; Docker; Rule-based controls: Course grained: Linux capabilities; System-level sandboxes (complete OS; Qubes); hardware-emulation and paravirtualisation; Copy on write sandboxes |
| OSVS | Role of Operating Systems | isolation; CONTAINERS |
| WMS | Fundamental Concepts and Approaches | sandboxing; permission dialog based access control |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | SANDBOX; Application-based access controls: user-based access controls insufficiently limit privileges |
| (OSVS) | Primitives for Isolation and Mediation | capabilities; Container-based sandboxes: chroot; Docker; Rule-based controls: Course grained: Linux capabilities; System-level sandboxes (complete OS; Qubes); hardware-emulation and paravirtualisation; Copy on write sandboxes |
| (OSVS) | Role of Operating Systems | isolation; CONTAINERS |
| (WMS) | Fundamental Concepts and Approaches | sandboxing; permission dialog based access control |
@@ -334,9 +334,9 @@ There are 19 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| AAA | Authorisation | ACCESS CONTROL - MAC (MANDATORY ACCESS CONTROL); ACCESS CONTROL - NDAC (NON-DISCRETIONARY ACCESS CONTROL); Application-based access controls: user-based access controls insufficiently limit privileges; Rule-based sandboxes; System call interposition; Integrity level access controls |
| OSVS | Primitives for Isolation and Mediation | Rule-based controls: Fine grained: AppArmor |
| SS | Mitigating Exploitation | limiting privileges |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | ACCESS CONTROL - MAC (MANDATORY ACCESS CONTROL); ACCESS CONTROL - NDAC (NON-DISCRETIONARY ACCESS CONTROL); Application-based access controls: user-based access controls insufficiently limit privileges; Rule-based sandboxes; System call interposition; Integrity level access controls |
| (OSVS) | Primitives for Isolation and Mediation | Rule-based controls: Fine grained: AppArmor |
| Software Security (SS) | Mitigating Exploitation | limiting privileges |

210
README-CyBOK-Scenarios-Indexed.md
View File

@@ -1,8 +1,8 @@
# SecGen Scenarios and CyBOK
# SecGen Lab Scenarios and CyBOK
The Cyber Security Body of Knowledge (CyBOK) is a body of knowledge that aims to encapsulate the various knowledge areas present within cyber security. Scenarios within SecGen now contain XML elements linking them to CyBOK knowledge areas and specific topics within those knowledge areas. Additionally, video content and readings for each scenario are tagged with their CyBOK associations.
This file is an autogenerated index and cross referencing of the 91 SecGen (mostly practical labs) scenarios that have CyBOK metadata.
This file is an autogenerated index and cross referencing of the 91 SecGen scenarios that have CyBOK metadata (mostly practical labs) .
You can browse the list below in terms of the [CyBOK Knowledge Areas, and Topics](#scenarios-indexed-by-cybok-knowledge-area-ka). The [list of scenarios](#scenario-cybok-keywords) in the second half of this document includes keywords (also known as "indicative topics" in CyBOK terminology).
@@ -14,7 +14,7 @@ You can browse the list below in terms of the [CyBOK Knowledge Areas, and Topics
## AAA
## Authentication, Authorisation & Accountability (AAA)
### AAA Scenarios
@@ -26,7 +26,7 @@ Authentication | [labs/authentication_and_access_controls/ads_1_authentication.x
Authorisation | [labs/authentication_and_access_controls/ads_3_access_controls.xml](#labsauthentication_and_access_controlsads_3_access_controlsxml)</br>[labs/authentication_and_access_controls/ads_4_suid.xml](#labsauthentication_and_access_controlsads_4_suidxml)</br>[labs/authentication_and_access_controls/ads_5_facls.xml](#labsauthentication_and_access_controlsads_5_faclsxml)</br>[labs/authentication_and_access_controls/ads_6_containers.xml](#labsauthentication_and_access_controlsads_6_containersxml)</br>[labs/authentication_and_access_controls/ads_7_apparmor.xml](#labsauthentication_and_access_controlsads_7_apparmorxml)</br>[labs/labtainers/acl-hackerbot-flags.xml](#labslabtainersacl-hackerbot-flagsxml)</br>[labs/labtainers/acl.xml](#labslabtainersaclxml)</br>[labs/labtainers/ldap.xml](#labslabtainersldapxml)</br>[labs/labtainers/nix-commands.xml](#labslabtainersnix-commandsxml)</br>[labs/labtainers/setuid-env.xml](#labslabtainerssetuid-envxml)</br>[labs/response_and_investigation/1_integrity_protection.xml](#labsresponse_and_investigation1_integrity_protectionxml)</br>
Accountability | [labs/response_and_investigation/7_live_analysis.xml](#labsresponse_and_investigation7_live_analysisxml)</br>[labs/response_and_investigation/8_dead_analysis.xml](#labsresponse_and_investigation8_dead_analysisxml)</br>
## OSVS
## (OSVS)
### OSVS Scenarios
@@ -38,7 +38,7 @@ Primitives for Isolation and Mediation | [labs/authentication_and_access_control
Role of Operating Systems | [labs/authentication_and_access_controls/ads_3_access_controls.xml](#labsauthentication_and_access_controlsads_3_access_controlsxml)</br>[labs/authentication_and_access_controls/ads_6_containers.xml](#labsauthentication_and_access_controlsads_6_containersxml)</br>[labs/labtainers/acl-hackerbot-flags.xml](#labslabtainersacl-hackerbot-flagsxml)</br>[labs/labtainers/acl.xml](#labslabtainersaclxml)</br>
OS Hardening | [labs/response_and_investigation/2_integrity_detection.xml](#labsresponse_and_investigation2_integrity_detectionxml)</br>[labs/response_and_investigation/7_live_analysis.xml](#labsresponse_and_investigation7_live_analysisxml)</br>
## WMS
## (WMS)
### WMS Scenarios
@@ -50,7 +50,7 @@ Fundamental Concepts and Approaches | [labs/authentication_and_access_controls/a
Server-Side Vulnerabilities and Mitigations | [labs/labtainers/sql-inject.xml](#labslabtainerssql-injectxml)</br>[labs/web_security/websec_lab.xml](#labsweb_securitywebsec_labxml)</br>
Client-Side Vulnerabilities and Mitigations | [labs/web_security/websec_lab.xml](#labsweb_securitywebsec_labxml)</br>
## SS
## Software Security (SS)
### SS Scenarios
@@ -64,7 +64,7 @@ Authentication | [labs/labtainers/pass-crack.xml](#labslabtainerspass-crackxml)<
Prevention of Vulnerabilities | [labs/labtainers/sql-inject.xml](#labslabtainerssql-injectxml)</br>[labs/software_security_exploitation/1_c_asm_iof.xml](#labssoftware_security_exploitation1_c_asm_iofxml)</br>[labs/software_security_exploitation/2_race_conditions_format_str.xml](#labssoftware_security_exploitation2_race_conditions_format_strxml)</br>[labs/web_security/websec_lab.xml](#labsweb_securitywebsec_labxml)</br>
Detection of Vulnerabilities | [labs/software_security_exploitation/3_bug_hunting_and_fuzzing.xml](#labssoftware_security_exploitation3_bug_hunting_and_fuzzingxml)</br>
## NS
## Network Security (NS)
### NS Scenarios
@@ -78,7 +78,7 @@ Network Defence Tools | [labs/labtainers/denyhost.xml](#labslabtainersdenyhostxm
Internet Architecture | [labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/iptables.xml](#labslabtainersiptablesxml)</br>[labs/labtainers/iptables2.xml](#labslabtainersiptables2xml)</br>[labs/labtainers/pubkey.xml](#labslabtainerspubkeyxml)</br>[labs/labtainers/radius.xml](#labslabtainersradiusxml)</br>[labs/labtainers/routing-basics.xml](#labslabtainersrouting-basicsxml)</br>[labs/labtainers/routing-basics2.xml](#labslabtainersrouting-basics2xml)</br>
OSI (OPEN SYSTEM INTERCONNECT) MODEL | [labs/labtainers/pcapanalysis.xml](#labslabtainerspcapanalysisxml)</br>
## SOIM
## Security Operations &amp; Incident Management (SOIM)
### SOIM Scenarios
@@ -93,7 +93,7 @@ INCIDENT RESPONSE | [labs/labtainers/backups.xml](#labslabtainersbackupsxml)</br
CM (CONFIGURATION MANAGEMENT) | [labs/labtainers/denyhost.xml](#labslabtainersdenyhostxml)</br>[labs/labtainers/nmap-ssh.xml](#labslabtainersnmap-sshxml)</br>
Analyse: Analysis Methods | [labs/labtainers/snort.xml](#labslabtainerssnortxml)</br>[labs/response_and_investigation/4_ids.xml](#labsresponse_and_investigation4_idsxml)</br>[labs/response_and_investigation/5_ids_rules.xml](#labsresponse_and_investigation5_ids_rulesxml)</br>[labs/response_and_investigation/6_exfiltration_detection.xml](#labsresponse_and_investigation6_exfiltration_detectionxml)</br>
## MAT
## Malware &amp; Attack Technology (MAT)
### MAT Scenarios
@@ -108,7 +108,7 @@ Malicious Activities by Malware | [labs/introducing_attacks/5_scanning.xml](#lab
MALCODE/MALWARE | [labs/labtainers/acl-hackerbot-flags.xml](#labslabtainersacl-hackerbot-flagsxml)</br>[labs/labtainers/acl.xml](#labslabtainersaclxml)</br>
Malware Detection | [labs/labtainers/snort.xml](#labslabtainerssnortxml)</br>[labs/response_and_investigation/4_ids.xml](#labsresponse_and_investigation4_idsxml)</br>[labs/response_and_investigation/5_ids_rules.xml](#labsresponse_and_investigation5_ids_rulesxml)</br>[labs/response_and_investigation/7_live_analysis.xml](#labsresponse_and_investigation7_live_analysisxml)</br>[labs/response_and_investigation/8_dead_analysis.xml](#labsresponse_and_investigation8_dead_analysisxml)</br>
## F
## Forensics (F)
### F Scenarios
@@ -120,7 +120,7 @@ Operating System Analysis | [labs/labtainers/file-deletion.xml](#labslabtainersf
Artifact Analysis | [labs/labtainers/macs-hash.xml](#labslabtainersmacs-hashxml)</br>[labs/labtainers/onewayhash.xml](#labslabtainersonewayhashxml)</br>[labs/labtainers/pass-crack.xml](#labslabtainerspass-crackxml)</br>[labs/response_and_investigation/2_integrity_detection.xml](#labsresponse_and_investigation2_integrity_detectionxml)</br>[labs/response_and_investigation/6_exfiltration_detection.xml](#labsresponse_and_investigation6_exfiltration_detectionxml)</br>
Main Memory Forensics | [labs/labtainers/packet-introspection.xml](#labslabtainerspacket-introspectionxml)</br>[labs/labtainers/pcapanalysis.xml](#labslabtainerspcapanalysisxml)</br>[labs/response_and_investigation/7_live_analysis.xml](#labsresponse_and_investigation7_live_analysisxml)</br>
## CPS
## Cyber-Physical Systems Security (CPS)
### CPS Scenarios
@@ -131,7 +131,7 @@ Main Memory Forensics | [labs/labtainers/packet-introspection.xml](#labslabtaine
Cyber-Physical Systems Domains | [labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/plc-app.xml](#labslabtainersplc-appxml)</br>[labs/labtainers/plc-forensics-adv.xml](#labslabtainersplc-forensics-advxml)</br>[labs/labtainers/plc-forensics.xml](#labslabtainersplc-forensicsxml)</br>[labs/labtainers/plc.xml](#labslabtainersplcxml)</br>[labs/labtainers/softplc.xml](#labslabtainerssoftplcxml)</br>[labs/labtainers/softplc2.xml](#labslabtainerssoftplc2xml)</br>[labs/labtainers/ssl.xml](#labslabtainerssslxml)</br>
Cyber-Physical Systems | [labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/plc-app.xml](#labslabtainersplc-appxml)</br>[labs/labtainers/plc-forensics-adv.xml](#labslabtainersplc-forensics-advxml)</br>[labs/labtainers/plc-forensics.xml](#labslabtainersplc-forensicsxml)</br>[labs/labtainers/plc.xml](#labslabtainersplcxml)</br>[labs/labtainers/softplc.xml](#labslabtainerssoftplcxml)</br>[labs/labtainers/softplc2.xml](#labslabtainerssoftplc2xml)</br>[labs/labtainers/ssl.xml](#labslabtainerssslxml)</br>
## WAM
## Web &amp; Mobile Security (WAM)
### WAM Scenarios
@@ -141,7 +141,7 @@ Cyber-Physical Systems | [labs/labtainers/iptables-ics.xml](#labslabtainersiptab
| --- | --- |
FIREWALLS | [labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/iptables.xml](#labslabtainersiptablesxml)</br>[labs/labtainers/iptables2.xml](#labslabtainersiptables2xml)</br>
## C
## Cryptography (C)
### C Scenarios
@@ -152,7 +152,7 @@ FIREWALLS | [labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</
Public-Key Cryptography | [labs/labtainers/macs-hash.xml](#labslabtainersmacs-hashxml)</br>[labs/labtainers/onewayhash.xml](#labslabtainersonewayhashxml)</br>[labs/labtainers/ssh-agent.xml](#labslabtainersssh-agentxml)</br>[labs/labtainers/sshlab.xml](#labslabtainerssshlabxml)</br>[labs/labtainers/ssl.xml](#labslabtainerssslxml)</br>
Schemes | [labs/labtainers/pubkey.xml](#labslabtainerspubkeyxml)</br>
## HF
## Human Factors (HF)
### HF Scenarios
@@ -183,7 +183,7 @@ Fitting the Task to the Human | [labs/labtainers/ssl.xml](#labslabtainerssslxml)
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| AAA | Authentication | identity management; user authentication; facets of authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) || OSVS | Primitives for Isolation and Mediation | authentication and identification; Linux authentication; Types of user accounts |
| Authentication, Authorisation &amp; Accountability (AAA) | Authentication | identity management; user authentication; facets of authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) || (OSVS) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication; Types of user accounts |
Command to start scenario:
@@ -211,7 +211,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| AAA | Authentication | identity management; user authentication; facets of authentication || OSVS | Primitives for Isolation and Mediation | authentication and identification; Linux authentication; Authentication frameworks (PAM) |
| Authentication, Authorisation &amp; Accountability (AAA) | Authentication | identity management; user authentication; facets of authentication || (OSVS) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication; Authentication frameworks (PAM) |
Command to start scenario:
@@ -239,7 +239,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| AAA | Authorisation | access control; enforcing access control; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL); Vulnerabilities and attacks on access control misconfigurations || OSVS | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; filesystems; inodes; and commands; umask || OSVS | Role of Operating Systems | mediation |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | access control; enforcing access control; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL); Vulnerabilities and attacks on access control misconfigurations || (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; filesystems; inodes; and commands; umask || (OSVS) | Role of Operating Systems | mediation |
Command to start scenario:
@@ -267,7 +267,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| AAA | Authorisation | access control; Elevated privileges; Real and effective identity; Vulnerabilities and attacks on access control misconfigurations || OSVS | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; setuid/setgid; Hardlink protections |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | access control; Elevated privileges; Real and effective identity; Vulnerabilities and attacks on access control misconfigurations || (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; setuid/setgid; Hardlink protections |
Command to start scenario:
@@ -295,7 +295,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| AAA | Authorisation | access control; ACCESS CONTROL LIST (ACL); Vulnerabilities and attacks on access control misconfigurations || OSVS | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | access control; ACCESS CONTROL LIST (ACL); Vulnerabilities and attacks on access control misconfigurations || (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) |
Command to start scenario:
@@ -323,7 +323,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| AAA | Authorisation | SANDBOX; Application-based access controls: user-based access controls insufficiently limit privileges || OSVS | Primitives for Isolation and Mediation | capabilities; Container-based sandboxes: chroot; Docker; Rule-based controls: Course grained: Linux capabilities; Vulnerabilities and attacks on sandboxing misconfigurations || OSVS | Role of Operating Systems | isolation; CONTAINERS || WMS | Fundamental Concepts and Approaches | sandboxing |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | SANDBOX; Application-based access controls: user-based access controls insufficiently limit privileges || (OSVS) | Primitives for Isolation and Mediation | capabilities; Container-based sandboxes: chroot; Docker; Rule-based controls: Course grained: Linux capabilities; Vulnerabilities and attacks on sandboxing misconfigurations || (OSVS) | Role of Operating Systems | isolation; CONTAINERS || (WMS) | Fundamental Concepts and Approaches | sandboxing |
Command to start scenario:
@@ -351,7 +351,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| AAA | Authorisation | ACCESS CONTROL - MAC (MANDATORY ACCESS CONTROL); ACCESS CONTROL - NDAC (NON-DISCRETIONARY ACCESS CONTROL); Application-based access controls: user-based access controls insufficiently limit privileges; Rule-based sandboxes || OSVS | Primitives for Isolation and Mediation | Rule-based controls: Fine grained: AppArmor; Vulnerabilities and attacks on sandboxing misconfigurations || SS | Mitigating Exploitation | limiting privileges |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | ACCESS CONTROL - MAC (MANDATORY ACCESS CONTROL); ACCESS CONTROL - NDAC (NON-DISCRETIONARY ACCESS CONTROL); Application-based access controls: user-based access controls insufficiently limit privileges; Rule-based sandboxes || (OSVS) | Primitives for Isolation and Mediation | Rule-based controls: Fine grained: AppArmor; Vulnerabilities and attacks on sandboxing misconfigurations || Software Security (SS) | Mitigating Exploitation | limiting privileges |
Command to start scenario:
@@ -379,7 +379,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| NS | Network Protocols and Vulnerability | common network attacks || SOIM | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS |
| Network Security (NS) | Network Protocols and Vulnerability | common network attacks || Security Operations &amp; Incident Management (SOIM) | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS |
Command to start scenario:
@@ -407,7 +407,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Malware Taxonomy | dimensions; kinds || MAT | Malware Analysis | anti-analysis and evasion techniques || MAT | Attacks and exploitation | EXPLOITATION FRAMEWORKS || SOIM | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION |
| Malware &amp; Attack Technology (MAT) | Malware Taxonomy | dimensions; kinds || Malware &amp; Attack Technology (MAT) | Malware Analysis | anti-analysis and evasion techniques || Malware &amp; Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION FRAMEWORKS || Security Operations &amp; Incident Management (SOIM) | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION |
Command to start scenario:
@@ -435,7 +435,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS || SOIM | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION |
| Malware &amp; Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS || Security Operations &amp; Incident Management (SOIM) | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION |
Command to start scenario:
@@ -463,7 +463,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| NS | PENETRATION TESTING | PENETRATION TESTING - DNS ZONE TRANSFER; EXPLOITATION FRAMEWORKS || SOIM | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - RECONNAISSANCE; PENETRATION TESTING - SOFTWARE TOOLS |
| Network Security (NS) | PENETRATION TESTING | PENETRATION TESTING - DNS ZONE TRANSFER; EXPLOITATION FRAMEWORKS || Security Operations &amp; Incident Management (SOIM) | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - RECONNAISSANCE; PENETRATION TESTING - SOFTWARE TOOLS |
Command to start scenario:
@@ -491,7 +491,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Malicious Activities by Malware | cyber kill chain || NS | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - FINGERPRINTING; PENETRATION TESTING - NETWORK MAPPING - NMAP; PENETRATION TESTING - NETWORK MAPPING - PING || SOIM | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - RECONNAISSANCE; PENETRATION TESTING - SOFTWARE TOOLS |
| Malware &amp; Attack Technology (MAT) | Malicious Activities by Malware | cyber kill chain || Network Security (NS) | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - FINGERPRINTING; PENETRATION TESTING - NETWORK MAPPING - NMAP; PENETRATION TESTING - NETWORK MAPPING - PING || Security Operations &amp; Incident Management (SOIM) | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - RECONNAISSANCE; PENETRATION TESTING - SOFTWARE TOOLS |
Command to start scenario:
@@ -519,7 +519,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Malicious Activities by Malware | cyber kill chain || SS | Categories of Vulnerabilities | CVEs and CWEs || MAT | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS || SOIM | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION |
| Malware &amp; Attack Technology (MAT) | Malicious Activities by Malware | cyber kill chain || Software Security (SS) | Categories of Vulnerabilities | CVEs and CWEs || Malware &amp; Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS || Security Operations &amp; Incident Management (SOIM) | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION |
Command to start scenario:
@@ -547,7 +547,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Malicious Activities by Malware | cyber kill chain; attack on confidentiality; integrity; availability || MAT | Attacks and exploitation | Post-exploitation: pivoting attacks; information gathering || SOIM | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION |
| Malware &amp; Attack Technology (MAT) | Malicious Activities by Malware | cyber kill chain; attack on confidentiality; integrity; availability || Malware &amp; Attack Technology (MAT) | Attacks and exploitation | Post-exploitation: pivoting attacks; information gathering || Security Operations &amp; Incident Management (SOIM) | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION |
Command to start scenario:
@@ -575,7 +575,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SOIM | PENETRATION TESTING | VULNERABILITY ANALYSIS / VULNERABILITY SCANNING; AUDIT APPROACH; PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION || MAT | Attacks and exploitation | EXPLOITATION |
| Security Operations &amp; Incident Management (SOIM) | PENETRATION TESTING | VULNERABILITY ANALYSIS / VULNERABILITY SCANNING; AUDIT APPROACH; PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION || Malware &amp; Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION |
Command to start scenario:
@@ -603,7 +603,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| AAA | Authorisation | access control; enforcing access control; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL); Vulnerabilities and attacks on access control misconfigurations || MAT | MALCODE/MALWARE | trojan; backdoor; TROJANS - BACKDOOR || OSVS | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; filesystems; inodes; and commands; umask || OSVS | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) || OSVS | Role of Operating Systems | mediation |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | access control; enforcing access control; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL); Vulnerabilities and attacks on access control misconfigurations || Malware &amp; Attack Technology (MAT) | MALCODE/MALWARE | trojan; backdoor; TROJANS - BACKDOOR || (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; filesystems; inodes; and commands; umask || (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) || (OSVS) | Role of Operating Systems | mediation |
Command to start scenario:
@@ -631,7 +631,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| AAA | Authorisation | access control; enforcing access control; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL); Vulnerabilities and attacks on access control misconfigurations || MAT | MALCODE/MALWARE | trojan; backdoor; TROJANS - BACKDOOR || OSVS | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; filesystems; inodes; and commands; umask || OSVS | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) || OSVS | Role of Operating Systems | mediation |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | access control; enforcing access control; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL); Vulnerabilities and attacks on access control misconfigurations || Malware &amp; Attack Technology (MAT) | MALCODE/MALWARE | trojan; backdoor; TROJANS - BACKDOOR || (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; filesystems; inodes; and commands; umask || (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) || (OSVS) | Role of Operating Systems | mediation |
Command to start scenario:
@@ -659,7 +659,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| NS | Network Protocols and Vulnerability | ADDRESS RESOLUTION PROTOCOL(ARP); ARP (ADDRESS RESOLUTION PROTOCOL); ARP SPOOFING; MITM (MAN-IN-THE-MIDDLE ATTACK); MAN-IN-THE-MIDDLE ATTACK (MITM); ATTACK(S) - ARP || SOIM | Monitor: Data Sources | network traffic |
| Network Security (NS) | Network Protocols and Vulnerability | ADDRESS RESOLUTION PROTOCOL(ARP); ARP (ADDRESS RESOLUTION PROTOCOL); ARP SPOOFING; MITM (MAN-IN-THE-MIDDLE ATTACK); MAN-IN-THE-MIDDLE ATTACK (MITM); ATTACK(S) - ARP || Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | network traffic |
Command to start scenario:
@@ -687,7 +687,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SOIM | Execute: Mitigation and Countermeasures | Recover data and services after an incident; BACKUP - DIFFERENTIAL; BACKUP - INFERENTIAL || SOIM | INCIDENT RESPONSE | RECOVERY - BACKUPS; RECOVERY; BACKUPS |
| Security Operations &amp; Incident Management (SOIM) | Execute: Mitigation and Countermeasures | Recover data and services after an incident; BACKUP - DIFFERENTIAL; BACKUP - INFERENTIAL || Security Operations &amp; Incident Management (SOIM) | INCIDENT RESPONSE | RECOVERY - BACKUPS; RECOVERY; BACKUPS |
Command to start scenario:
@@ -715,7 +715,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SOIM | Execute: Mitigation and Countermeasures | Recover data and services after an incident; BACKUP - DIFFERENTIAL; BACKUP - INFERENTIAL || SOIM | INCIDENT RESPONSE | RECOVERY - BACKUPS; RECOVERY; BACKUPS |
| Security Operations &amp; Incident Management (SOIM) | Execute: Mitigation and Countermeasures | Recover data and services after an incident; BACKUP - DIFFERENTIAL; BACKUP - INFERENTIAL || Security Operations &amp; Incident Management (SOIM) | INCIDENT RESPONSE | RECOVERY - BACKUPS; RECOVERY; BACKUPS |
Command to start scenario:
@@ -743,7 +743,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SS | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows || MAT | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development || SS | Mitigating Exploitation | ASLR (ADDRESS SPACE LAYOUT RANDOMIZATION); NON-EXECUTABLE MEMORY |
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows || Malware &amp; Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development || Software Security (SS) | Mitigating Exploitation | ASLR (ADDRESS SPACE LAYOUT RANDOMIZATION); NON-EXECUTABLE MEMORY |
Command to start scenario:
@@ -771,7 +771,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| OSVS | Primitives for Isolation and Mediation | capabilities; Rule-based controls: Course grained: Linux capabilities || SOIM | Monitor: Data Sources | network traffic |
| (OSVS) | Primitives for Isolation and Mediation | capabilities; Rule-based controls: Course grained: Linux capabilities || Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | network traffic |
Command to start scenario:
@@ -799,7 +799,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SOIM | Monitor: Data Sources | application logs: web server logs and files; system and kernel logs; Syslog |
| Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | application logs: web server logs and files; system and kernel logs; Syslog |
Command to start scenario:
@@ -827,7 +827,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SOIM | Monitor: Data Sources | application logs: web server logs and files; system and kernel logs; Syslog |
| Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | application logs: web server logs and files; system and kernel logs; Syslog |
Command to start scenario:
@@ -855,7 +855,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SOIM | Monitor: Data Sources | application logs: web server logs and files; system and kernel logs; Syslog |
| Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | application logs: web server logs and files; system and kernel logs; Syslog |
Command to start scenario:
@@ -883,7 +883,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| NS | Network Defence Tools | packet filters; intrusion detection systems; intrusion prevention systems || SOIM | Execute: Mitigation and Countermeasures | intrusion prevention systems || SOIM | CM (CONFIGURATION MANAGEMENT) | SSH (SECURE SHELL) |
| Network Security (NS) | Network Defence Tools | packet filters; intrusion detection systems; intrusion prevention systems || Security Operations &amp; Incident Management (SOIM) | Execute: Mitigation and Countermeasures | intrusion prevention systems || Security Operations &amp; Incident Management (SOIM) | CM (CONFIGURATION MANAGEMENT) | SSH (SECURE SHELL) |
Command to start scenario:
@@ -911,7 +911,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| NS | Network Defence Tools | DEMILITARISED ZONE (DMZ) |
| Network Security (NS) | Network Defence Tools | DEMILITARISED ZONE (DMZ) |
Command to start scenario:
@@ -939,7 +939,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| NS | Network Defence Tools | DEMILITARISED ZONE (DMZ) |
| Network Security (NS) | Network Defence Tools | DEMILITARISED ZONE (DMZ) |
Command to start scenario:
@@ -967,7 +967,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| F | Operating System Analysis | storage forensics; data recovery and file content carving |
| Forensics (F) | Operating System Analysis | storage forensics; data recovery and file content carving |
Command to start scenario:
@@ -995,7 +995,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| AAA | Authentication | access control; Protecting integrity || F | Operating System Analysis | cryptographic hashing; storage forensics; data recovery and file content carving || SOIM | Monitor: Data Sources | MONITORING - FILE INTEGRITY CHECKERS |
| Authentication, Authorisation &amp; Accountability (AAA) | Authentication | access control; Protecting integrity || Forensics (F) | Operating System Analysis | cryptographic hashing; storage forensics; data recovery and file content carving || Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | MONITORING - FILE INTEGRITY CHECKERS |
Command to start scenario:
@@ -1023,7 +1023,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Attacks and exploitation | EXPLOITATION; Exploit development; Mitigation bypass: ASLR || SS | Categories of Vulnerabilities | memory management vulnerabilities; Format string attacks |
| Malware &amp; Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; Exploit development; Mitigation bypass: ASLR || Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities; Format string attacks |
Command to start scenario:
@@ -1051,7 +1051,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Malware Analysis | analysis techniques; analysis environments; STATIC ANALYSIS |
| Malware &amp; Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments; STATIC ANALYSIS |
Command to start scenario:
@@ -1079,7 +1079,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Malware Analysis | analysis techniques; analysis environments; STATIC ANALYSIS |
| Malware &amp; Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments; STATIC ANALYSIS |
Command to start scenario:
@@ -1107,7 +1107,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| CPS | Cyber-Physical Systems Domains | industrial control systems || CPS | Cyber-Physical Systems | security and privacy concerns || NS | Network Defence Tools | FIREWALLS; IPTables || NS | Internet Architecture | network layer security || WAM | FIREWALLS | FIREWALLS |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems || Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | security and privacy concerns || Network Security (NS) | Network Defence Tools | FIREWALLS; IPTables || Network Security (NS) | Internet Architecture | network layer security || Web &amp; Mobile Security (WAM) | FIREWALLS | FIREWALLS |
Command to start scenario:
@@ -1135,7 +1135,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| NS | Network Defence Tools | FIREWALLS; IPTables || NS | Internet Architecture | network layer security || WAM | FIREWALLS | FIREWALLS |
| Network Security (NS) | Network Defence Tools | FIREWALLS; IPTables || Network Security (NS) | Internet Architecture | network layer security || Web &amp; Mobile Security (WAM) | FIREWALLS | FIREWALLS |
Command to start scenario:
@@ -1163,7 +1163,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| NS | Network Defence Tools | FIREWALLS; IPTables || NS | Internet Architecture | network layer security || WAM | FIREWALLS | FIREWALLS |
| Network Security (NS) | Network Defence Tools | FIREWALLS; IPTables || Network Security (NS) | Internet Architecture | network layer security || Web &amp; Mobile Security (WAM) | FIREWALLS | FIREWALLS |
Command to start scenario:
@@ -1191,7 +1191,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| AAA | Authentication | identity management; user authentication; facets of authentication; authentication in distributed systems || AAA | Authorisation | AUTHORIZATION - LDAP (LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL) || SOIM | Monitor: Data Sources | network traffic |
| Authentication, Authorisation &amp; Accountability (AAA) | Authentication | identity management; user authentication; facets of authentication; authentication in distributed systems || Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | AUTHORIZATION - LDAP (LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL) || Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | network traffic |
Command to start scenario:
@@ -1219,7 +1219,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| NS | Network Protocols and Vulnerability | ADDRESS RESOLUTION PROTOCOL(ARP); ARP (ADDRESS RESOLUTION PROTOCOL); ARP SPOOFING; DNS ATTACKS |
| Network Security (NS) | Network Protocols and Vulnerability | ADDRESS RESOLUTION PROTOCOL(ARP); ARP (ADDRESS RESOLUTION PROTOCOL); ARP SPOOFING; DNS ATTACKS |
Command to start scenario:
@@ -1247,7 +1247,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| AAA | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) || C | Public-Key Cryptography | symmetric encryption and authentication; MESSAGE AUTHENTICATION CODE (MAC); HASHED MESSAGE AUTHENTICATION CODE (HMAC) || F | Artifact Analysis | cryptographic hashing |
| Authentication, Authorisation &amp; Accountability (AAA) | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) || Cryptography (C) | Public-Key Cryptography | symmetric encryption and authentication; MESSAGE AUTHENTICATION CODE (MAC); HASHED MESSAGE AUTHENTICATION CODE (HMAC) || Forensics (F) | Artifact Analysis | cryptographic hashing |
Command to start scenario:
@@ -1275,7 +1275,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Malicious Activities by Malware | cyber kill chain || MAT | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS || SOIM | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION |
| Malware &amp; Attack Technology (MAT) | Malicious Activities by Malware | cyber kill chain || Malware &amp; Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS || Security Operations &amp; Incident Management (SOIM) | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION |
Command to start scenario:
@@ -1303,7 +1303,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| AAA | Authorisation | access control || NS | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - PING |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | access control || Network Security (NS) | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - PING |
Command to start scenario:
@@ -1331,7 +1331,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| NS | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - FINGERPRINTING; PENETRATION TESTING - NETWORK MAPPING - NMAP |
| Network Security (NS) | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - FINGERPRINTING; PENETRATION TESTING - NETWORK MAPPING - NMAP |
Command to start scenario:
@@ -1359,7 +1359,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| NS | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - FINGERPRINTING; PENETRATION TESTING - NETWORK MAPPING - NMAP || SOIM | CM (CONFIGURATION MANAGEMENT) | SSH (SECURE SHELL) |
| Network Security (NS) | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - FINGERPRINTING; PENETRATION TESTING - NETWORK MAPPING - NMAP || Security Operations &amp; Incident Management (SOIM) | CM (CONFIGURATION MANAGEMENT) | SSH (SECURE SHELL) |
Command to start scenario:
@@ -1387,7 +1387,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| AAA | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) || C | Public-Key Cryptography | symmetric encryption and authentication; MESSAGE AUTHENTICATION CODE (MAC) || F | Artifact Analysis | cryptographic hashing |
| Authentication, Authorisation &amp; Accountability (AAA) | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) || Cryptography (C) | Public-Key Cryptography | symmetric encryption and authentication; MESSAGE AUTHENTICATION CODE (MAC) || Forensics (F) | Artifact Analysis | cryptographic hashing |
Command to start scenario:
@@ -1415,7 +1415,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| F | Main Memory Forensics | network connections; data recovery and file content carving || SOIM | Monitor: Data Sources | network traffic |
| Forensics (F) | Main Memory Forensics | network connections; data recovery and file content carving || Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | network traffic |
Command to start scenario:
@@ -1443,7 +1443,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| F | Artifact Analysis | cryptographic hashing || SS | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) |
| Forensics (F) | Artifact Analysis | cryptographic hashing || Software Security (SS) | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) |
Command to start scenario:
@@ -1471,7 +1471,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| F | Main Memory Forensics | network connections || NS | OSI (OPEN SYSTEM INTERCONNECT) MODEL | APPLICATION LAYER; DATA LINK LAYER; NETWORK LAYER || SOIM | Monitor: Data Sources | network traffic |
| Forensics (F) | Main Memory Forensics | network connections || Network Security (NS) | OSI (OPEN SYSTEM INTERCONNECT) MODEL | APPLICATION LAYER; DATA LINK LAYER; NETWORK LAYER || Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | network traffic |
Command to start scenario:
@@ -1499,7 +1499,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| CPS | Cyber-Physical Systems | characteristics; security and privacy concerns || CPS | Cyber-Physical Systems Domains | industrial control systems |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; security and privacy concerns || Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems |
Command to start scenario:
@@ -1527,7 +1527,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| CPS | Cyber-Physical Systems | characteristics; security and privacy concerns || CPS | Cyber-Physical Systems Domains | industrial control systems |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; security and privacy concerns || Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems |
Command to start scenario:
@@ -1555,7 +1555,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| CPS | Cyber-Physical Systems | characteristics; security and privacy concerns || CPS | Cyber-Physical Systems Domains | industrial control systems |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; security and privacy concerns || Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems |
Command to start scenario:
@@ -1583,7 +1583,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| CPS | Cyber-Physical Systems | characteristics; security and privacy concerns || CPS | Cyber-Physical Systems Domains | industrial control systems |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; security and privacy concerns || Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems |
Command to start scenario:
@@ -1611,7 +1611,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| C | Schemes | TLS || NS | Internet Architecture | transport layer security |
| Cryptography (C) | Schemes | TLS || Network Security (NS) | Internet Architecture | transport layer security |
Command to start scenario:
@@ -1639,7 +1639,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| AAA | Authentication | identity management; user authentication; facets of authentication; authentication in distributed systems || NS | Internet Architecture | link layer security |
| Authentication, Authorisation &amp; Accountability (AAA) | Authentication | identity management; user authentication; facets of authentication; authentication in distributed systems || Network Security (NS) | Internet Architecture | link layer security |
Command to start scenario:
@@ -1667,7 +1667,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| NS | Network Protocols and Vulnerability | ADDRESS RESOLUTION PROTOCOL(ARP); ARP (ADDRESS RESOLUTION PROTOCOL); ARP SPOOFING; DNS ATTACKS |
| Network Security (NS) | Network Protocols and Vulnerability | ADDRESS RESOLUTION PROTOCOL(ARP); ARP (ADDRESS RESOLUTION PROTOCOL); ARP SPOOFING; DNS ATTACKS |
Command to start scenario:
@@ -1695,7 +1695,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SS | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows || SS | Mitigating Exploitation | NON-EXECUTABLE MEMORY || MAT | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development; Mitigation bypass: non-executable memory |
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows || Software Security (SS) | Mitigating Exploitation | NON-EXECUTABLE MEMORY || Malware &amp; Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development; Mitigation bypass: non-executable memory |
Command to start scenario:
@@ -1723,7 +1723,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| NS | Internet Architecture | network layer security |
| Network Security (NS) | Internet Architecture | network layer security |
Command to start scenario:
@@ -1751,7 +1751,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| NS | Internet Architecture | network layer security |
| Network Security (NS) | Internet Architecture | network layer security |
Command to start scenario:
@@ -1779,7 +1779,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| AAA | Authorisation | access control; Elevated privileges; Real and effective identity; Vulnerabilities and attacks on access control misconfigurations || OSVS | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; setuid/setgid |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | access control; Elevated privileges; Real and effective identity; Vulnerabilities and attacks on access control misconfigurations || (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; setuid/setgid |
Command to start scenario:
@@ -1807,7 +1807,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SOIM | Monitor: Data Sources | network traffic || SOIM | Analyse: Analysis Methods | misuse detection; anomaly detection || SOIM | Execute: Mitigation and Countermeasures | intrusion prevention systems || NS | Network Defence Tools | packet filters; intrusion detection systems; IDS rules creation || MAT | Malware Detection | attack detection |
| Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | network traffic || Security Operations &amp; Incident Management (SOIM) | Analyse: Analysis Methods | misuse detection; anomaly detection || Security Operations &amp; Incident Management (SOIM) | Execute: Mitigation and Countermeasures | intrusion prevention systems || Network Security (NS) | Network Defence Tools | packet filters; intrusion detection systems; IDS rules creation || Malware &amp; Attack Technology (MAT) | Malware Detection | attack detection |
Command to start scenario:
@@ -1835,7 +1835,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| CPS | Cyber-Physical Systems | characteristics; security and privacy concerns || CPS | Cyber-Physical Systems Domains | industrial control systems |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; security and privacy concerns || Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems |
Command to start scenario:
@@ -1863,7 +1863,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| CPS | Cyber-Physical Systems | characteristics; security and privacy concerns || CPS | Cyber-Physical Systems Domains | industrial control systems |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; security and privacy concerns || Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems |
Command to start scenario:
@@ -1891,7 +1891,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SS | Categories of Vulnerabilities | Web vulnerabilities / OWASP Top 10; API vulnerabilities || SS | Prevention of Vulnerabilities | coding practices; Protecting against session management attacks; XSS; SQLi; CSRF; API design || WMS | Server-Side Vulnerabilities and Mitigations | injection vulnerabilities; server-side misconfiguration and vulnerable components; SQL-INJECTION |
| Software Security (SS) | Categories of Vulnerabilities | Web vulnerabilities / OWASP Top 10; API vulnerabilities || Software Security (SS) | Prevention of Vulnerabilities | coding practices; Protecting against session management attacks; XSS; SQLi; CSRF; API design || (WMS) | Server-Side Vulnerabilities and Mitigations | injection vulnerabilities; server-side misconfiguration and vulnerable components; SQL-INJECTION |
Command to start scenario:
@@ -1919,7 +1919,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| C | Public-Key Cryptography | public-key encryption; public-key signatures |
| Cryptography (C) | Public-Key Cryptography | public-key encryption; public-key signatures |
Command to start scenario:
@@ -1947,7 +1947,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| C | Public-Key Cryptography | public-key encryption; public-key signatures |
| Cryptography (C) | Public-Key Cryptography | public-key encryption; public-key signatures |
Command to start scenario:
@@ -1975,7 +1975,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| C | Public-Key Cryptography | public-key encryption; public-key signatures || CPS | Cyber-Physical Systems | characteristics; security and privacy concerns || CPS | Cyber-Physical Systems Domains | industrial control systems || HF | Fitting the Task to the Human | device capabilities and limitations |
| Cryptography (C) | Public-Key Cryptography | public-key encryption; public-key signatures || Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; security and privacy concerns || Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems || Human Factors (HF) | Fitting the Task to the Human | device capabilities and limitations |
Command to start scenario:
@@ -2003,7 +2003,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| AAA | Authorisation | access control; Protecting integrity || OSVS | Primitives for Isolation and Mediation | Linux read only protections: ro mounts; file attributes |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | access control; Protecting integrity || (OSVS) | Primitives for Isolation and Mediation | Linux read only protections: ro mounts; file attributes |
Command to start scenario:
@@ -2031,7 +2031,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| F | Artifact Analysis | cryptographic hashing || SOIM | Monitor: Data Sources | MONITORING - FILE INTEGRITY CHECKERS || OSVS | OS Hardening | code and data integrity checks |
| Forensics (F) | Artifact Analysis | cryptographic hashing || Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | MONITORING - FILE INTEGRITY CHECKERS || (OSVS) | OS Hardening | code and data integrity checks |
Command to start scenario:
@@ -2059,7 +2059,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SOIM | Execute: Mitigation and Countermeasures | Recover data and services after an incident; BACKUP - DIFFERENTIAL; BACKUP - INFERENTIAL |
| Security Operations &amp; Incident Management (SOIM) | Execute: Mitigation and Countermeasures | Recover data and services after an incident; BACKUP - DIFFERENTIAL; BACKUP - INFERENTIAL |
Command to start scenario:
@@ -2087,7 +2087,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SOIM | Monitor: Data Sources | network traffic || SOIM | Analyse: Analysis Methods | misuse detection; anomaly detection || SOIM | Execute: Mitigation and Countermeasures | intrusion prevention systems || NS | Network Defence Tools | packet filters; intrusion detection systems || MAT | Malware Detection | attack detection |
| Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | network traffic || Security Operations &amp; Incident Management (SOIM) | Analyse: Analysis Methods | misuse detection; anomaly detection || Security Operations &amp; Incident Management (SOIM) | Execute: Mitigation and Countermeasures | intrusion prevention systems || Network Security (NS) | Network Defence Tools | packet filters; intrusion detection systems || Malware &amp; Attack Technology (MAT) | Malware Detection | attack detection |
Command to start scenario:
@@ -2115,7 +2115,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SOIM | Monitor: Data Sources | network traffic || SOIM | Analyse: Analysis Methods | misuse detection; anomaly detection || NS | Network Defence Tools | packet filters; intrusion detection systems; IDS rules creation || MAT | Malware Detection | attack detection |
| Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | network traffic || Security Operations &amp; Incident Management (SOIM) | Analyse: Analysis Methods | misuse detection; anomaly detection || Network Security (NS) | Network Defence Tools | packet filters; intrusion detection systems; IDS rules creation || Malware &amp; Attack Technology (MAT) | Malware Detection | attack detection |
Command to start scenario:
@@ -2143,7 +2143,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| F | Artifact Analysis | cryptographic hashing || SOIM | Monitor: Data Sources | network traffic || SOIM | Analyse: Analysis Methods | Exfiltation detection / data loss prevention || NS | Network Defence Tools | packet filters; intrusion detection systems; intrusion prevention systems; IDS rules creation |
| Forensics (F) | Artifact Analysis | cryptographic hashing || Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | network traffic || Security Operations &amp; Incident Management (SOIM) | Analyse: Analysis Methods | Exfiltation detection / data loss prevention || Network Security (NS) | Network Defence Tools | packet filters; intrusion detection systems; intrusion prevention systems; IDS rules creation |
Command to start scenario:
@@ -2171,7 +2171,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| F | Main Memory Forensics | process information; file information; network connections; artifacts and fragments; challenges of live forensics || OSVS | OS Hardening | anomaly detection || AAA | Accountability | The fallibility of digital evidence to tampering || MAT | Malware Detection | identifying the presence of malware |
| Forensics (F) | Main Memory Forensics | process information; file information; network connections; artifacts and fragments; challenges of live forensics || (OSVS) | OS Hardening | anomaly detection || Authentication, Authorisation &amp; Accountability (AAA) | Accountability | The fallibility of digital evidence to tampering || Malware &amp; Attack Technology (MAT) | Malware Detection | identifying the presence of malware |
Command to start scenario:
@@ -2199,7 +2199,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| F | Operating System Analysis | storage forensics; data recovery and file content carving; Timeline analysis || MAT | Malware Detection | identifying the presence of malware || AAA | Accountability | The fallibility of digital evidence to tampering |
| Forensics (F) | Operating System Analysis | storage forensics; data recovery and file content carving; Timeline analysis || Malware &amp; Attack Technology (MAT) | Malware Detection | identifying the presence of malware || Authentication, Authorisation &amp; Accountability (AAA) | Accountability | The fallibility of digital evidence to tampering |
Command to start scenario:
@@ -2227,7 +2227,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Malware Taxonomy | dimensions; kinds || MAT | Malware Analysis | analysis techniques; analysis environments |
| Malware &amp; Attack Technology (MAT) | Malware Taxonomy | dimensions; kinds || Malware &amp; Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments |
Command to start scenario:
@@ -2255,7 +2255,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Malware Analysis | analysis techniques; analysis environments |
| Malware &amp; Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments |
Command to start scenario:
@@ -2283,7 +2283,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Malware Analysis | analysis techniques; analysis environments; STATIC ANALYSIS |
| Malware &amp; Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments; STATIC ANALYSIS |
Command to start scenario:
@@ -2311,7 +2311,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Malware Analysis | analysis techniques; analysis environments; STATIC ANALYSIS |
| Malware &amp; Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments; STATIC ANALYSIS |
Command to start scenario:
@@ -2339,7 +2339,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Malware Analysis | analysis techniques; analysis environments; STATIC ANALYSIS |
| Malware &amp; Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments; STATIC ANALYSIS |
Command to start scenario:
@@ -2367,7 +2367,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Malware Analysis | analysis techniques; analysis environments |
| Malware &amp; Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments |
Command to start scenario:
@@ -2395,7 +2395,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Malware Analysis | analysis techniques; analysis environments; DYNAMIC ANALYSIS |
| Malware &amp; Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments; DYNAMIC ANALYSIS |
Command to start scenario:
@@ -2423,7 +2423,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Malware Analysis | analysis techniques; analysis environments; anti-analysis and evasion techniques |
| Malware &amp; Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments; anti-analysis and evasion techniques |
Command to start scenario:
@@ -2451,7 +2451,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| MAT | Malware Taxonomy | dimensions; kinds || MAT | Malware Analysis | analysis techniques; analysis environments |
| Malware &amp; Attack Technology (MAT) | Malware Taxonomy | dimensions; kinds || Malware &amp; Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments |
Command to start scenario:
@@ -2479,7 +2479,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SS | Categories of Vulnerabilities | Integer overflow || SS | Prevention of Vulnerabilities | language design and type systems |
| Software Security (SS) | Categories of Vulnerabilities | Integer overflow || Software Security (SS) | Prevention of Vulnerabilities | language design and type systems |
Command to start scenario:
@@ -2507,7 +2507,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SS | Categories of Vulnerabilities | race condition vulnerabilities; structured output generation vulnerabilities; Format string attacks || SS | Prevention of Vulnerabilities | race condition mitigations; structured output generations mitigations |
| Software Security (SS) | Categories of Vulnerabilities | race condition vulnerabilities; structured output generation vulnerabilities; Format string attacks || Software Security (SS) | Prevention of Vulnerabilities | race condition mitigations; structured output generations mitigations |
Command to start scenario:
@@ -2535,7 +2535,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SS | Detection of Vulnerabilities | dynamic detection |
| Software Security (SS) | Detection of Vulnerabilities | dynamic detection |
Command to start scenario:
@@ -2563,7 +2563,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SS | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows || MAT | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development |
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows || Malware &amp; Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development |
Command to start scenario:
@@ -2591,7 +2591,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SS | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows; Format string attacks || MAT | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development |
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows; Format string attacks || Malware &amp; Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development |
Command to start scenario:
@@ -2619,7 +2619,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SS | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows || MAT | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development |
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows || Malware &amp; Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development |
Command to start scenario:
@@ -2647,7 +2647,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SS | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows || SS | Mitigating Exploitation | NON-EXECUTABLE MEMORY || MAT | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development; Mitigation bypass: non-executable memory |
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows || Software Security (SS) | Mitigating Exploitation | NON-EXECUTABLE MEMORY || Malware &amp; Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development; Mitigation bypass: non-executable memory |
Command to start scenario:
@@ -2675,7 +2675,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| SS | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows || SS | Mitigating Exploitation | ASLR (ADDRESS SPACE LAYOUT RANDOMIZATION) || MAT | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development; Mitigation bypass: ASLR |
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows || Software Security (SS) | Mitigating Exploitation | ASLR (ADDRESS SPACE LAYOUT RANDOMIZATION) || Malware &amp; Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development; Mitigation bypass: ASLR |
Command to start scenario:
@@ -2703,7 +2703,7 @@ Command to start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| WMS | Fundamental Concepts and Approaches | web PKI and HTTPS; authentication; cookies; passwords and alternatives; JAVASCRIPT / HYPERTEXT MARKUP LANGUAGE (HTML) / CASCADING STYLE SHEETS (CSS) / HYPERTEXT TRANSFER PROTOCOL (HTTP)\n\t\tCOOKIES; HYPERTEXT TRANSFER PROTOCOL (HTTP) - PROXYING; Broken Access Control / Insecure Direct Object References; SESSION HIJACKING; REPRESENTATIONAL STATE TRANSFER (REST) || WMS | Client-Side Vulnerabilities and Mitigations | client-side storage; CLIENT-SIDE VALIDATION; clickjacking || WMS | Client-Side Vulnerabilities and Mitigations | client-side storage; CLIENT-SIDE VALIDATION; clickjacking || WMS | Server-Side Vulnerabilities and Mitigations | injection vulnerabilities; server-side misconfiguration and vulnerable components; CROSS-SITE SCRIPTING (XSS); SAME ORIGIN POLICY (SOP); COMMAND INJECTION; SQL-INJECTION; CROSS-SITE REQUEST FORGERY (CSRF); CONFUSED DEPUTY ATTACKS || SS | Categories of Vulnerabilities | Web vulnerabilities / OWASP Top 10; API vulnerabilities || SS | Prevention of Vulnerabilities | coding practices; Protecting against session management attacks; XSS; SQLi; CSRF; API design |
| (WMS) | Fundamental Concepts and Approaches | web PKI and HTTPS; authentication; cookies; passwords and alternatives; JAVASCRIPT / HYPERTEXT MARKUP LANGUAGE (HTML) / CASCADING STYLE SHEETS (CSS) / HYPERTEXT TRANSFER PROTOCOL (HTTP)\n\t\tCOOKIES; HYPERTEXT TRANSFER PROTOCOL (HTTP) - PROXYING; Broken Access Control / Insecure Direct Object References; SESSION HIJACKING; REPRESENTATIONAL STATE TRANSFER (REST) || (WMS) | Client-Side Vulnerabilities and Mitigations | client-side storage; CLIENT-SIDE VALIDATION; clickjacking || (WMS) | Client-Side Vulnerabilities and Mitigations | client-side storage; CLIENT-SIDE VALIDATION; clickjacking || (WMS) | Server-Side Vulnerabilities and Mitigations | injection vulnerabilities; server-side misconfiguration and vulnerable components; CROSS-SITE SCRIPTING (XSS); SAME ORIGIN POLICY (SOP); COMMAND INJECTION; SQL-INJECTION; CROSS-SITE REQUEST FORGERY (CSRF); CONFUSED DEPUTY ATTACKS || Software Security (SS) | Categories of Vulnerabilities | Web vulnerabilities / OWASP Top 10; API vulnerabilities || Software Security (SS) | Prevention of Vulnerabilities | coding practices; Protecting against session management attacks; XSS; SQLi; CSRF; API design |
Command to start scenario:

25
lib/CyBOK/generate_scenario_index.rb
View File

@@ -27,10 +27,33 @@ end
KA_TOPIC_SCENARIOS_HASH = Hash.new { |h, k| h[k] = h.dup.clear }
SCENARIOS_HASH = {}
SCENARIOS_FULL_HASH = {}
KA_TOPIC_VIDEO_HASH = Hash.new { |h, k| h[k] = h.dup.clear }
VIDEO_HASH = {}
CyBOK_ACRONYMS = {
"AAA" => "Authentication, Authorisation &amp; Accountability",
"AB" => "Adversarial Behaviours",
"C" => "Cryptography",
"CPS" => "Cyber-Physical Systems Security",
"DSS" => "Distributed Systems Security",
"F" => "Forensics",
"HF" => "Human Factors",
"HS" => "Hardware Security",
"LR" => "Law &amp; Regulation",
"MAT" => "Malware &amp; Attack Technology",
"NS" => "Network Security",
"OSV" => "Operating Systems &amp; Virtualisation",
"PLT" => "Physical Layer &amp; Telecommunications Security",
"POR" => "Privacy &amp; Online Rights",
"RMG" => "Risk Management &amp; Governance",
"SOIM" => "Security Operations &amp; Incident Management",
"SS" => "Software Security",
"SSL" => "Secure Software Lifecycle",
"WAM" => "Web &amp; Mobile Security",
}
parser = Nori.new()
scenarios.each { |scenario|
next if scenario.start_with?("examples")
Print.verbose "Reading #{scenario}"

4
lib/CyBOK/template_CyBOK_scenarios.md.erb
View File

@@ -16,7 +16,7 @@ You can browse the list below in terms of the [CyBOK Knowledge Areas, and Topics
KA_TOPIC_SCENARIOS_HASH.each{|ka,hash|
%>
## <%= ka %>
## <%= CyBOK_ACRONYMS[ka] %> (<%= ka %>)
### <%= ka %> Scenarios
@@ -59,7 +59,7 @@ systems = SCENARIOS_FULL_HASH[scenario][0].dig_deep(:system_name).to_s.gsub(/"|\
| KA | Topic | Keywords
| --- | --- | --- |
<%array.each{|arr| -%>
| <%= arr["@KA"] %> | <%= arr["@topic"] %> | <%= arr["keyword"].to_s.gsub(/"|\[|\]/, '').gsub(',',';') %> |<%
| <%= CyBOK_ACRONYMS[arr["@KA"]] %> (<%= arr["@KA"] %>) | <%= arr["@topic"] %> | <%= arr["keyword"].to_s.gsub(/"|\[|\]/, '').gsub(',',';') %> |<%
} %>

2
lib/CyBOK/template_CyBOK_videos.md.erb
View File

@@ -33,7 +33,7 @@ end
| KA | Topics | Keywords |
| --- | --- | --- |
<% arr['CyBOK'].each {|cybok| -%>
| <%= cybok["@KA"] %> | <%= cybok["@topic"] %> | <%= cybok["keyword"].to_s.gsub(/"|\[|\]/, '').gsub(',',';') %> |
| <%= CyBOK_ACRONYMS[cybok["@KA"]] %> (<%= cybok["@KA"] %>) | <%= cybok["@topic"] %> | <%= cybok["keyword"].to_s.gsub(/"|\[|\]/, '').gsub(',',';') %> |
<% } -%>
<% } %>