Resolve merge conflicts

src/data/roadmaps/cyber-security/content/101-operating-systems/learn-for-each/index.md

@@ -1 +0,0 @@
-# Learn for each

src/data/roadmaps/cyber-security/content/102-networking-knowledge/106-ip-terminology/index.md

@@ -1,43 +0,0 @@
-# IP Terminology
-
-Understanding IP Terminology is essential in grasping the fundamentals of networking and cybersecurity. In this section, we'll cover essential terms in the world of IP networks.
-
-## Internet Protocol (IP)
-
-IP is a protocol that enables data exchange between computers over a network. Each device in the network has a unique IP address, enabling data packets to be sent correctly.
-
-## IPv4 and IPv6
-
-_IPv4_: It's the fourth version of IP, using 32-bit addresses and allowing a total of about 4.3 billion unique addresses.
-
-_IPv6_: To overcome the exhaustion of IPv4 addresses, IPv6 was introduced. It expands the number of unique addresses by using 128-bit addresses, providing a virtually limitless pool of addresses.
-
-## IP Address
-
-An IP address is a unique identifier for devices on the internet or a local network. It helps in routing the data packets between different devices in the network.
-
-## Subnets
-
-A subnet is a smaller, designated portion of a network. Subnet masks help to define and isolate each subnet to manage traffic.
-
-## DHCP (Dynamic Host Configuration Protocol)
-
-DHCP is a protocol that assigns IP addresses dynamically to devices when they connect to a network, as opposed to static IP addresses.
-
-## DNS (Domain Name System)
-
-DNS is the system responsible for translating human-readable domain names like www.example.com into IP addresses so that data can be routed correctly.
-
-## Ports
-
-A port is a communication endpoint within a networking device. It allows the device to differentiate multiple connections and applications. Protocols, such as HTTP and FTP, have assigned default ports (80 and 21, respectively).
-
-## NAT (Network Address Translation)
-
-NAT allows multiple devices in a private network to share a single public IP address when connecting to the internet. This conserves the number of IP addresses and adds an additional layer of privacy.
-
-## Firewall
-
-A firewall is a security measure that filters, monitors, and controls incoming and outgoing traffic in a network. It helps to protect devices and data from unauthorized access or malicious activities.
-
-By understanding these IP terminologies, you'll be better equipped to handle networking and cybersecurity tasks.

src/data/roadmaps/cyber-security/content/102-networking-knowledge/107-network-topologies/index.md

@@ -1,78 +0,0 @@
-# Network Topologies
-
-Network topologies describe the arrangement of various devices in a network, their connections, and the flow of data between them. Understanding common network topologies can help you identify potential vulnerabilities and enhance your overall cybersecurity posture. Here, we'll briefly discuss the different types of network topologies and their advantages and disadvantages.
-
-## Bus Topology
-
-In a bus topology, all devices in the network are connected to a single communication medium (usually a coaxial cable) called a "bus." Data is transmitted in a single direction along the bus, and devices look for their address in the data to know if it's meant for them.
-
-**Advantages:**
-
-- Easy to set up and extend
-- Requires less cabling than other topologies
-
-**Disadvantages:**
-
-- If the main cable fails, the entire network fails
-- Performance degrades as more devices are added
-- Limited cable length and number of devices
-
-## Star Topology
-
-A star topology connects all devices to a central point or hub (typically a switch or a router). The central point is responsible for transmitting data between devices in the network.
-
-**Advantages:**
-
-- Easy to add or remove devices without affecting the rest of the network
-- If one device fails, it doesn't affect the entire network
-- Centralized management
-
-**Disadvantages:**
-
-- Requires more cabling than bus topology
-- If the central hub fails, the entire network fails
-
-## Ring Topology
-
-In a ring topology, devices are connected in a circular pattern, with each device having exactly two neighbors. Data is transmitted in one direction around the ring, passing through each device before reaching its destination.
-
-**Advantages:**
-
-- Equal access to resources for all devices
-- Can handle high-traffic loads
-
-**Disadvantages:**
-
-- Adding or removing devices can disrupt the network
-- If one device fails, it can affect the entire network
-- Data transmission can be slow due to the loop structure
-
-## Mesh Topology
-
-A mesh topology connects all devices directly to every other device in the network. It can be a full mesh (where every device is connected to every other device) or a partial mesh (where some devices are connected to all others, while others maintain only a few connections).
-
-**Advantages:**
-
-- High fault-tolerance and redundancy, making it more resilient
-- Eliminates the need for a central hub
-
-**Disadvantages:**
-
-- Requires a large number of cables, making it expensive and difficult to manage
-- Can be challenging to set up and maintain
-
-## Hybrid Topology
-
-A hybrid topology combines two or more different topologies, such as a star and ring topology, in a single network. It can be customized to fit specific network requirements and performance needs.
-
-**Advantages:**
-
-- Can be tailored to meet specific needs
-- Optimizes the strengths of various topologies
-
-**Disadvantages:**
-
-- Can be complex and difficult to manage
-- More expensive than other topologies
-
-Understanding these different network topologies can help you design a more secure and efficient network or improve the existing network structure in your organization. It's essential to consider factors such as scalability, reliability, and cost when selecting the best topology for your needs.

src/data/roadmaps/cyber-security/content/102-networking-knowledge/109-virtualization-technologies/index.md

@@ -1,38 +0,0 @@
-# Common Virtualization Technologies
-
-Virtualization technologies play a critical role in improving the efficiency, flexibility, and resilience of IT infrastructure. These technologies allow multiple operating systems and applications to run simultaneously on a single physical machine, enhancing the utilization of hardware resources and reducing costs. In the context of cybersecurity, virtualization tools provide additional layers of security and isolation, making it more difficult for attackers to compromise the entire system.
-
-In this section, we will discuss the following aspects of virtualization technologies:
-
-## What is Virtualization?
-
-Virtualization is the process of creating virtual instances of physical resources, such as hardware platforms, storage devices, or network resources. It enables operating systems, applications, and data to run on a shared pool of resources, which can be dynamically allocated and managed according to the needs of the system.
-
-## Types of Virtualization
-
-There are various types of virtualization, such as:
-
-- **Server virtualization**: The creation of multiple virtual servers on a single physical server to optimize resource utilization and facilitate fault isolation.
-- **Desktop virtualization**: The separation of a user's computer environment from the physical device, enabling centralized management, improved security, and simplified maintenance.
-- **Network virtualization**: The process of combining multiple physical networks into a single virtual network, offering better performance, security, and ease of management.
-- **Storage virtualization**: The pooling of physical storage resources from multiple storage devices into a single, virtualized storage environment, allowing for simplified management, improved efficiency, and enhanced scalability.
-
-## Benefits of Virtualization
-
-Some of the key benefits of virtualization technologies include:
-
-- **Improved resource utilization**: By virtualizing resources, organizations can make better use of their hardware and IT infrastructure, ultimately reducing costs and environmental impact.
-- **Increased agility**: Virtualization allows IT teams to provision resources quickly, enabling them to respond rapidly to changing business needs.
-- **Enhanced security**: By isolating virtual environments, organizations can prevent the spread of malware and minimize the impact of security breaches.
-- **Disaster recovery and business continuity**: Virtualization simplifies backup, replication, and recovery processes, ensuring that businesses can resume operations quickly after a disaster.
-
-## Popular Virtualization Software and Solutions
-
-There are several virtualization software and solutions available in the market, such as:
-
-- **VMware**: A leader in virtualization technology, offering solutions for server, desktop, storage, and network virtualization.
-- **Microsoft Hyper-V**: A built-in virtualization solution for Windows Server, allowing for server, desktop, and storage virtualization.
-- **Citrix XenServer**: An open-source virtualization platform that supports server, desktop, and network virtualization.
-- **Oracle VM VirtualBox**: A free and open-source virtualization solution that supports server, desktop, and storage virtualization.
-
-To protect your organization's information assets and ensure the security of your virtualized environments, it's essential to understand virtualization technologies and implement best practices. In the sections that follow, we will discuss essential security measures and techniques to improve the overall cybersecurity posture of your virtualized infrastructure.

src/data/roadmaps/cyber-security/content/102-networking-knowledge/110-virutalization-basics/index.md

@@ -1,37 +0,0 @@
-# Understand basics of Virtualization
-
-**Virtualization** is a key concept in the world of cybersecurity and IT infrastructure. It involves the creation of virtual (rather than physical) instances of resources, such as operating systems, servers, storage devices, and network components. By leveraging virtualization, multiple virtual instances can run on the same hardware simultaneously, resulting in more efficient use of resources, improved scalability, and reduced costs.
-
-Let's take a brief look at some virtualization basics:
-
-## Types of Virtualization
-
-- **Server Virtualization**: Server virtualization is the process of partitioning a physical server into multiple virtual servers. This allows several virtual machines (VMs) to run on a single server, each using a different operating system and each isolated from the others.
-
-- **Storage Virtualization**: Storage virtualization involves the pooling of multiple storage devices into a single, virtualized storage unit. It simplifies storage management and allows for better resource utilization.
-
-- **Network Virtualization**: Network virtualization is the process of combining hardware and software network resources and functionality into a single, virtualized network. It facilitates management and provisioning of resources, as well as improves network automation and flexibility.
-
-- **Application Virtualization**: Application virtualization involves the separation of an application from its underlying operating system, allowing applications to run on various platforms without having to be installed on each device. This streamlines deployment, management, and updates of applications.
-
-## Advantages of Virtualization
-
-- **Cost Savings**: Virtualization reduces the need for physical hardware, resulting in reduced power consumption, cooling, and physical space requirements.
-
-- **Scalability**: Virtual instances can be easily created, decommissioned, or scaled up or down depending on the needs of the organization. This allows for better utilization of resources, on-demand capacity, and rapid deployment of new applications or services.
-
-- **Improved Security**: Virtualized environments can provide security benefits through isolation between VMs, reducing the potential impact of a security breach.
-
-- **Disaster Recovery**: Virtualization enables easier backup and replication of VMs, which simplifies disaster recovery planning and reduces downtime in the event of hardware failure or data loss.
-
-## Popular Virtualization Solutions
-
-- **VMware**: VMware is a widely used virtualization platform that provides various solutions, such as vSphere, for server virtualization, NSX for network virtualization, and vSAN for storage virtualization.
-
-- **Microsoft Hyper-V**: Hyper-V is a Windows Server-based virtualization platform, allowing you to create and manage VMs on Windows or Linux operating systems.
-
-- **Citrix XenServer**: XenServer is another popular virtualization solution that provides a scalable, high-performance server virtualization platform.
-
-- **Oracle VirtualBox**: VirtualBox is a free, open-source virtualization solution that supports various operating systems, making it a popular choice for developers and researchers.
-
-Understanding the basics of virtualization can help you better maintain, secure, and optimize your IT infrastructure. As you continue your journey through cybersecurity, consider diving deeper into the various aspects of virtualization and explore how it can benefit your organization.

src/data/roadmaps/cyber-security/content/102-networking-knowledge/111-troubleshooting-tools/index.md

@@ -1,41 +0,0 @@
-# Troubleshooting Tools
-
-In this section, we will discuss various troubleshooting tools that you can use to diagnose and resolve network-related issues. Possessing a strong understanding of these tools is crucial for maintaining a secure and efficient network.
-
-## Ping
-
-`Ping` is a basic command-line tool used to test the reachability of a network host. It sends ICMP Echo Request packets to the target host and waits for an ICMP Echo Reply. If the target host is reachable, you will receive the packets back with round-trip time statistics.
-
-Usage: `ping [target host/IP]`
-
-## Traceroute/tracert
-
-`traceroute` (Linux) and `tracert` (Windows) are command-line tools used to display the path taken by packets across a network. They can help to identify routing problems, latency, and packet loss.
-
-Usage: `traceroute [target host/IP]` or `tracert [target host/IP]`
-
-## Nslookup
-
-`nslookup` is a network administration command-line tool used to query Domain Name System (DNS) servers for host information or IP address resolution.
-
-Usage: `nslookup [hostname]`
-
-## Netstat
-
-The `netstat` command is a versatile command-line tool that displays network connections, routing tables, and network interface statistics. It can help identify critical connections, open ports, and listening services.
-
-Usage: `netstat [-options]`
-
-## Nmap
-
-`Nmap` (Network Mapper) is an open-source tool for network discovery and security auditing. It can scan for open ports, running services, and identify network vulnerabilities.
-
-Usage: `nmap [-options] [target host/IP]`
-
-## Wireshark
-
-`Wireshark` is a widely-used network protocol analyzer that allows you to capture and analyze network traffic in real-time. It provides detailed information about packets, protocols, and network behavior that aids in troubleshooting and security analysis.
-
-Download link: [https://www.wireshark.org/download.html](https://www.wireshark.org/download.html)
-
-Understanding these troubleshooting tools and their applications will help you resolve network issues more effectively and maintain a secure IT infrastructure. Remember to balance security and functionality when managing your network. Practicing good cyber hygiene, staying updated with the latest threats, and continuously assessing your network security will help you stay one step ahead of potential attackers.

src/data/roadmaps/cyber-security/content/102-networking-knowledge/112-auth-methodologies/index.md

@@ -1,29 +0,0 @@
-# Authentication Methodologies
-
-Authentication methodologies are techniques and processes employed in order to verify the identity of a user, device, or system attempting to access restricted data or resources within a network. This is a crucial backbone of cyber security as it ensures that only verified and authorized users can interact with sensitive data and services. In this section, we will explore various authentication methodologies that you can implement to enhance the security of your network.
-
-## Password-based Authentication
-
-One of the most widely adopted authentication methods is the use of passwords. A user provides a username and a secret password, which are then compared to stored credentials. If the provided credentials match the stored ones, access is granted. This method can be strengthened by enforcing strong password policies, such as requiring a combination of upper and lowercase letters, numbers, and special characters.
-
-## Multi-factor Authentication (MFA)
-
-MFA involves the use of two or more independent factors to verify a user's identity. These factors usually fall into three categories:
-
-- **Knowledge**: Something the user knows (e.g., password, PIN).
-- **Possession**: Something the user has (e.g., hardware token, mobile phone).
-- **Inherence**: Something the user is (e.g., biometrics, such as fingerprints or facial recognition).
-
-By requiring multiple factors, an attacker would need to bypass more than just a single barrier to gain unauthorized access, significantly increasing the security of the system.
-
-## Certificate-based Authentication
-
-This methodology involves the use of digital certificates to authenticate a user or device. Digital certificates are electronic documents containing cryptographic keys and details about the subject they represent. The certificate is issued by a trusted Certificate Authority (CA), ensuring that the public key within the certificate belongs to the user, device or server. This method allows for secure transactions and interactions, as it assures entities involved that the data is coming from a verified and trusted source.
-
-## Single Sign-on (SSO)
-
-SSO is an authentication process that enables users to access multiple related, but independent, software systems using a single set of credentials. By centralizing the authentication process, SSO simplifies user management and reduces the risk of password-related security breaches (e.g., reuse, weak passwords). Popular SSO solutions include OAuth, SAML, and OpenID Connect.
-
----
-
-To maintain a strong cyber security posture, implementing effective authentication methodologies is essential. Each method has its own strengths and weaknesses, and the best approach depends on your organization's individual needs and resources. By choosing the right mix of authentication methods, you can ensure that only authorized users have access to your sensitive systems and data, significantly reducing the risk of cyber threats.

src/data/roadmaps/cyber-security/content/102-networking-knowledge/functions-of-each/100-dhcp.md

@@ -1,21 +0,0 @@
-# DHCP
-
-DHCP, or Dynamic Host Configuration Protocol, is a network management protocol that simplifies IP address assignment, as well as other network configuration details, to devices in a network. It accomplishes this by automatically assigning IP addresses to devices based on their MAC addresses when they connect to the network. This dynamic approach to IP address allocation eliminates manual tracking and configuration, making it easier for network administrators to manage their networks.
-
-## Key Features
-
-- **Automated IP address allocation**: DHCP uses a range of IP addresses, known as a "pool" or "scope," to automatically assign IP addresses to devices on the network. This helps avoid IP address conflicts and ensures efficient use of available IP addresses.
-
-- **Lease management**: DHCP allows for temporary assignment of IP addresses, called "leases." Leases have expiration periods, after which the IP addresses are returned to the pool, so they can be reassigned to other devices.
-
-- **Centralized configuration**: DHCP also provides a mechanism for central management of network settings, such as DNS servers, default gateways, and subnet masks. This helps maintain a consistent network configuration and reduces the potential for errors.
-
-## Benefits
-
-- **Reduced administration effort**: DHCP reduces the time and effort required to manage IP address assignments in a network, as it automatically assigns and reclaims IP addresses based on lease management.
-
-- **Scalability**: DHCP is helpful for both small and large networks. It allows the easy integration and removal of new devices, without manual IP address assignments.
-
-- **Consistency**: DHCP enables consistent management of network settings, which helps reduce errors and ensures that devices in the network can access the necessary resources.
-
-In summary, DHCP simplifies IP address management and network configuration for network administrators, ensuring efficient use of IP addresses and streamlining network administration. This is particularly valuable in large networks with numerous devices or when devices frequently need to connect or disconnect from the network.

src/data/roadmaps/cyber-security/content/102-networking-knowledge/functions-of-each/101-dns.md

@@ -1,23 +0,0 @@
-# DNS
-
-The Domain Name System, or DNS, is a core component of the internet infrastructure. It is often described as the phonebook of the internet, as it translates human-readable domain names (such as www.example.com) into IP addresses (such as 192.0.2.1) that computers use to identify each other on the network.
-
-Here are the key concepts and functions of DNS:
-
-- **Domain Name Resolution**: DNS servers, also known as name servers, are responsible for resolving domain names into IP addresses. When you enter a URL in your browser or click on a link, a DNS query is sent to a DNS resolver, which contacts a series of DNS servers to get the correct IP address for the requested domain. Once the IP address is obtained, your browser can then establish a connection with the web server hosting the domain.
-
-- **Hierarchical Structure**: DNS follows a hierarchical structure, with the Root DNS servers at the top. Below the root servers are Top-Level Domain (TLD) servers, which are responsible for managing domain names with specific TLDs (such as .com, .org, .net). After that, there are Second-Level Domain (SLD) servers that manage domain names under specific TLDs (for example, example.com).
-
-- **Caching**: To speed up the domain name resolution process and reduce the load on DNS servers, resolvers and servers often store the results of previous DNS queries in a cache. Cached results have a Time to Live (TTL) value determined by the domain's owner, and once that TTL expires, the resolver will re-query the DNS servers to obtain the updated information.
-
-- **DNS Records**: Domain owners configure various types of DNS records to provide specific information about their domains. Some common DNS record types include:
-
-  - A Record: Address record that maps a domain name to an IPv4 address
-  - AAAA Record: Address record for mapping a domain name to an IPv6 address
-  - CNAME Record: Canonical name record that maps one domain name (alias) to another domain name (canonical)
-  - MX Record: Mail exchange record that specifies the mail server responsible for handling email for the domain
-  - TXT Record: Text records providing additional information about the domain, often used for verification or security purposes
-
-- **DNS Security**: Cyber threats such as DNS hijacking, cache poisoning, and Distributed Denial of Service (DDoS) attacks have highlighted the importance of DNS security. Several security measures and protocols, including DNSSEC (Domain Name System Security Extensions), help protect DNS servers and their records from these threats.
-
-In summary, DNS is a critical component of the internet, enabling users to connect to websites and online services using easily memorable domain names instead of numerical IP addresses. DNS servers, hierarchically organized and employing caching mechanisms, efficiently manage and resolve domain name queries while implementing security measures to maintain the integrity and safety of the internet infrastructure.

src/data/roadmaps/cyber-security/content/102-networking-knowledge/functions-of-each/index.md

@@ -1 +0,0 @@
-# Functions of each

src/data/roadmaps/cyber-security/content/102-networking-knowledge/understand-the-terminology/index.md

@@ -1 +0,0 @@
-# Understand the terminology

src/data/roadmaps/cyber-security/content/102-networking-knowledge/understand-these/index.md

@@ -1 +0,0 @@
-# Understand these

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/100-cryptography/index.md

@@ -1,37 +0,0 @@
-# Basics of Cryptography
-
-Cryptography is a critical aspect of cyber security, essential for ensuring the confidentiality, integrity, and authenticity of data exchanged across digital networks. It involves the use of mathematical algorithms and techniques to encrypt and decrypt data, making it almost impossible for unauthorized users to access or modify the information.
-
-## Types of Cryptography
-
-There are three main types of cryptography in the context of cyber security:
-
-- **Symmetric cryptography**: In this method, the same key, known as a secret key, is used to encrypt and decrypt the data. Examples of symmetric encryption algorithms include AES, DES, and Blowfish.
-
-- **Asymmetric cryptography**: This approach uses two keys, known as a public key and a private key, for encryption and decryption. Data encrypted with one key can only be decrypted with the other key. Examples of asymmetric encryption algorithms include RSA, ECC, and ElGamal.
-
-- **Hash functions**: These are cryptographic algorithms that produce a fixed-size output (usually called a hash or digest) from an input of any size, ensuring the integrity of data. A small change in the input data leads to a significant change in the output hash. Examples of widely used hash functions include SHA-256, MD5, and RIPEMD-160.
-
-## Cryptographic Protocols
-
-Various cryptographic protocols define how cryptographic algorithms are applied to data and how the data is securely exchanged between different parties. Some of the most common protocols include:
-
-- **Secure Sockets Layer (SSL) and Transport Layer Security (TLS)**: These protocols are used to provide encrypted communication over the internet. TLS, the successor to SSL, is widely used for secure web browsing, email, and other data exchanges.
-
-- **Secure Shell (SSH)**: SSH is a protocol that allows secure login to remote machines and the encrypted transfer of data between systems.
-
-- **Pretty Good Privacy (PGP)**: PGP is a protocol used for encrypting and digitally signing messages, providing confidentiality and authenticity in digital communication.
-
-## Key Management
-
-Proper key management is crucial to maintain the security of encrypted data. Key management involves the creation, distribution, storage, and disposal of cryptographic keys. It is essential to ensure that keys are securely distributed, regularly updated, and stored in secure locations to prevent unauthorized access.
-
-## Cryptanalysis
-
-Cryptanalysis is the process of attempting to break cryptographic systems, often by exploiting weaknesses in the algorithms, protocols, or key management processes. The strength of a cryptographic system lies in its resistance to cryptanalysis. As a cyber security professional, understanding cryptanalysis techniques can help you identify and protect against potential vulnerabilities in your organization's cryptographic infrastructure.
-
-In conclusion, cryptography is a fundamental aspect of cyber security, offering a layer of protection for sensitive data in digital networks. To effectively implement cryptography in your organization, you should be familiar with the various types of cryptography, cryptographic protocols, and key management best practices, and understand the potential threats posed by cryptanalysis.
-
-- [@article@Cryptography for Dummies (TryHackMe)](https://tryhackme.com/room/cryptographyfordummies)
-- [@article@How to Protect Data in Transit using HMAC and Diffie-Hellman in Node.js](https://www.freecodecamp.org/news/hmac-diffie-hellman-in-node/)
-- [@feed@Explore top posts about Cryptography](https://app.daily.dev/tags/cryptography?ref=roadmapsh)

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/101-incident-response-process/index.md

@@ -1,55 +0,0 @@
-# Understand the Incident Response Process
-
-The incident response process is a set of procedures and guidelines that an organization follows to effectively identify, investigate, and remediate incidents affecting its information systems and sensitive data. The primary objective of the incident response process is to minimize the impact of security incidents, reduce downtime, and prevent future attacks.
-
-A well-defined incident response process typically involves the following key stages:
-
-## Preparation
-
-This stage helps organizations establish a proactive approach to incident response by developing comprehensive plans, policies, and procedures. Key steps include:
-
-- Assembling an incident response team (IRT) with clearly defined roles and responsibilities
-- Conducting periodic security awareness and training programs
-- Ensuring readiness through scenario planning, tabletop exercises, and breach simulations
-
-## Identification
-
-The identification stage is crucial to detect security incidents early on and gather relevant information for later analysis. Some identification techniques include:
-
-- Monitoring system logs, network traffic, and user activities
-- Setting up intrusion detection systems and security information and event management (SIEM) tools
-- Receiving and investigating potential incident reports from internal and external sources
-
-## Containment
-
-Once an incident is identified, it is crucial to contain its impact by isolating affected systems, networks, and devices. Some containment strategies include:
-
-- Blocking malicious IP addresses and restricting access to compromised accounts
-- Disabling networking features on affected hosts
-- Implementing compensating controls to restrict further damage
-
-## Eradication
-
-In this stage, the root cause of the incident is investigated and eliminated from the environment to prevent future occurrences. This may involve:
-
-- Identifying malicious processes, files, or unauthorized users and removing them from the system
-- Updating security configurations and patching software vulnerabilities
-- Developing solutions to address system or process weaknesses
-
-## Recovery
-
-Recovery involves restoring affected systems and services to normal operations. Some recovery steps include:
-
-- Checking system integrity and validating data for accuracy and completeness
-- Re-deploying affected systems using clean backups or restoring to known-good configurations
-- Gradually reintegrating systems into the production environment after ensuring security
-
-## Lessons Learned
-
-The final stage of the incident response process aims to learn from the incident and improve the organization's security posture. Key steps include:
-
-- Conducting a thorough post-incident review to identify areas for improvement
-- Updating the incident response plan based on lessons learned
-- Sharing findings with relevant stakeholders and incorporating feedback for continuous improvement
-
-An effective incident response process can significantly reduce the impact of security incidents and help organizations recover more quickly. Regular review and practice of the process will ensure that the right skills and knowledge are in place to handle any potential threats.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/102-threat-classification/index.md

@@ -1,50 +0,0 @@
-# Understand Threat Classification
-
-Threat classification is an important aspect of cyber security, as it helps organizations identify, analyze, and prioritize potential cyber threats. In this section, we will discuss various types of threats, their characteristics, and the best practices to handle them.
-
-## Types of Threats
-
-There are several types of cyber threats that organizations should be aware of. Here, we will classify them into four main categories:
-
-## Malware
-
-Malware is the term used for malicious software designed to damage, exploit, or gain unauthorized access to a device, computer, or network. Common types of malware include:
-
-- **Virus**: A self-replicating program that spreads by infecting files or disk drives and can cause various system disruptions.
-- **Worm**: A self-replicating program which spreads through the network without user interaction.
-- **Trojan**: A deceptive program that appears legitimate but contains malicious code or functions.
-- **Ransomware**: A type of malware that encrypts user files and demands payment for their decryption.
-
-## Phishing and Social Engineering
-
-Phishing and social engineering threats involve manipulation or deception of individuals to reveal sensitive information or perform actions which benefit the attacker. Common types include:
-
-- **Phishing**: The practice of sending fraudulent emails or messages pretending to be from a trusted source, with the intent of obtaining sensitive information or installing malware.
-- **Spear-phishing**: A targeted phishing attack aimed at specific individuals or organizations.
-- **Whaling**: A form of phishing targeted at high-level executives or decision-makers.
-- **Social engineering**: The use of psychological manipulation to trick victims into providing sensitive information or access to their systems.
-
-## Unauthorized Access
-
-This threat category covers various methods of unauthorized access to computer systems, networks, or data, including:
-
-- **Hacking**: Gaining unauthorized access to a computer system or network by exploiting security vulnerabilities.
-- **Brute force**: Using trial-and-error methods to guess or crack passwords or encryption keys.
-- **Privilege escalation**: Gaining additional privileges or permissions, typically by exploiting vulnerabilities or misconfigurations.
-
-## Distributed Denial of Service (DDoS) Attacks
-
-DDoS attacks are attempts to render a computer system, network, or website unavailable by overwhelming it with a flood of malicious traffic. These attacks can be executed through various methods including:
-
-- **Volume-based attacks**: Overloading the target with overwhelming amounts of traffic, such as UDP floods or ICMP floods.
-- **Protocol-based attacks**: Exploiting weaknesses in network protocols, such as SYN floods or Ping of Death attacks.
-- **Application-layer attacks**: Targeting specific applications, such as HTTP or DNS attacks.
-
-## Best Practices for Handling Threats
-
-- **Awareness**: Familiarize yourself and your team with common types of threats and their characteristics.
-- **Prevention**: Implement measures to mitigate threats, such as regular software updates, strong passwords, and endpoint protection.
-- **Detection**: Implement monitoring and detection tools to identify threats or suspicious activity.
-- **Response**: Develop a response plan for handling incidents, including containment, remediation, and communication.
-
-By understanding the various types of cyber threats and their characteristics, organizations can better protect themselves and their assets from potential attack. Regularly updating your threat classification knowledge and revising your security practices will ensure that your organization stays one step ahead of cyber criminals.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/103-hardening-concepts/index.md

@@ -1,37 +0,0 @@
-# Understand Hardening Concepts
-
-Hardening refers to the process of securing a given system, network, or application by reducing its attack surface, strengthening its security measures, and minimizing potential vulnerabilities. The primary goal of hardening is to reduce the risk associated with cyber threats and protect the system from unauthorized access or attacks. In this section, we will discuss various hardening concepts that you should be familiar with.
-
-## Least Privilege Principle
-
-The Least Privilege Principle entails granting users and applications only the necessary permissions to perform their roles or tasks, and nothing more. By limiting the access and actions a user or application can perform, we reduce the risk of unauthorized activities, infiltration, or exploitation of the system.
-
-## Defense in Depth
-
-Employ multiple layers of security measures to prevent a single point of failure in the system. Defense in Depth involves using multiple security solutions, such as firewalls, intrusion detection systems (IDS), anti-malware software, and security policies to provide a holistic security approach.
-
-## Patch Management
-
-Regularly updating and patching systems is crucial in maintaining security. Patch management involves keeping all software, operating systems, and applications up-to-date with the latest security patches and updates. This ensures that potential vulnerabilities are fixed, reducing the risk of exploitation by cybercriminals.
-
-## Secure Configuration
-
-Implement secure configurations to harden your system. This involves disabling unnecessary services, removing unused software, and ensuring proper authorization controls are in place. Additionally, always use strong authentication mechanisms, change default passwords, and maintain password complexity policies.
-
-## Network Segmentation
-
-Divide the network into smaller, isolated segments to reduce potential attack surface and contain attacks when they occur. Network segmentation limits the damage an attacker can cause, as they cannot access every part of the network once they have infiltrated a segment.
-
-## Encryption
-
-Encrypt any sensitive data, both when it is stored and when it is transmitted. Encryption safeguards data, ensuring that even if it falls into the wrong hands, it remains unreadable and unusable.
-
-## Regular Auditing
-
-Perform regular audits on the security of your systems, networks, and applications to identify potential gaps in your security posture. Auditing can include system logs, intrusion detection, and vulnerability assessments. It is essential to review and remediate any findings to maintain a strong security posture continually.
-
-## User Awareness Training
-
-Ensure that all users are educated and aware of security threats and practices, including phishing, password security, and safe browsing habits. Regularly train and refresh employees on security best practices to maintain a security-conscious environment.
-
-By implementing these hardening concepts, you can significantly enhance the security of your systems, networks, and applications, reducing the risk of cyber threats and unauthorized access.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/106-false-true-negative-positive.md

@@ -1,30 +0,0 @@
-# False Negative / False Positive
-
-In cybersecurity, one important aspect is the accuracy of security tools and systems in detecting threats and attacks. To capture this concept, we refer to four terms: _true positive, true negative, false positive, and false negative_.
-
-## True Positive (TP)
-
-A true positive is an instance when security tools correctly detect and identify a threat, such as a malware or intrusion attempt. A high number of true positives indicates that a security tool is working effectively and catching potential threats as required.
-
-## True Negative (TN)
-
-A true negative occurs when the security tool correctly identifies that there is no threat or attack in a given situation. In other words, the system does not raise an alarm when there is no attack happening. A high number of true negatives show that the security tool is not overly sensitive, generating unnecessary alerts.
-
-## False Positive (FP)
-
-A false positive happens when the security tool mistakenly identifies a non-threat as a threat. For example, it might raise an alarm for a legitimate user's activity, indicating a potential attack when there isn't any. A high number of false positives can cause unnecessary diverting of resources and time, investigating false alarms. Additionally, it could lead to user frustration if legitimate activities are being blocked.
-
-## False Negative (FN)
-
-A false negative occurs when the security tool fails to detect an actual threat or attack. This could result in a real attack going unnoticed, causing damage to the system, data breaches, or other negative consequences. A high number of false negatives indicate that the security system needs to be improved to capture real threats effectively.
-
-To have an effective cybersecurity system, security professionals aim to maximize true positives and true negatives, while minimizing false positives and false negatives. Balancing these aspects ensures that the security tools maintain their effectiveness without causing undue disruptions to a user's experience.
-
-## Key Points
-
-- **True Positive (TP)**: Correctly identifying a threat
-- **True Negative (TN)**: Correctly identifying there is no threat
-- **False Positive (FP)**: Mistakenly identifying a non-threat as a threat
-- **False Negative (FN)**: Failing to detect a real threat
-
-In summary, understanding false true negative positive concepts is crucial in developing and maintaining an effective cyber security system. By considering these metrics, security professionals can optimize their tools and processes to provide the best protection against cyber threats.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/108-authentication-vs-authorization.md

@@ -1,27 +0,0 @@
-# Authentication vs Authorization
-
-To ensure cybersecurity, it's essential to understand the differences between two key concepts: **Authentication** and **Authorization**. Though the terms might sound similar, they have distinct functions in ensuring the security of your systems and applications.
-
-## Authentication
-
-**Authentication** is the process of validating the identity of a user, device, or system. It confirms that the entity attempting to access the resource is who or what they claim to be. The most common form of authentication is the use of usernames and passwords. In simple terms, authentication answers the question, _"Who are you?"_
-
-## Authorization
-
-**Authorization** comes into play after the authentication process is complete. It involves granting or denying access to a resource, based on the authenticated user's privileges. Authorization determines what actions the authenticated user or entity is allowed to perform within a system or application.
-
-For example, a basic user may be authorized to view and edit their personal data, while an administrator would have the authority to access and manage all user accounts within the same application. In a nutshell, authorization answers the question, _"What are you allowed to do?"_
-
-## Conclusion
-
-Authentication and authorization are critical components of a secure system. By understanding their distinct roles in the security process, you can better manage access to resources and protect sensitive data. Remember, authentication verifies the identity of a user, while authorization determines and enforces the actions and resources the user is permitted to access within a system or application.
-
-Learn more from the following resources:
-
-- [@article@Two-factor authentication (2FA)](https://authy.com/what-is-2fa/)
-- [@article@Biometrics (fingerprint, facial recognition, etc.)](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5428991/)
-- [@article@Security tokens or certificates](https://www.comodo.com/e-commerce/ssl-certificates/certificate.php)
-- [@article@Role-based access control (RBAC)](https://en.wikipedia.org/wiki/Role-based_access_control)
-- [@article@Access Control Lists (ACLs)](https://en.wikipedia.org/wiki/Access-control_list)
-- [@article@Attribute-based access control (ABAC)](https://en.wikipedia.org/wiki/Attribute-based_access_control)
-- [@feed@Explore top posts about Authentication](https://app.daily.dev/tags/authentication?ref=roadmapsh)

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/attack-types/100-phishing-vishing-whaling-smishing.md

@@ -1,53 +0,0 @@
-# Phishing vs Vishing vs Whaling vs Smishing
-
-In this section of our Cyber Security Guide, we'll discuss various types of cyber-attacks that you should be aware of. Understanding these attack types can help you recognize and defend against them.
-
-## Phishing
-
-Phishing is an attempt to obtain sensitive information, such as login credentials or credit card details, by masquerading as a trustworthy entity. This usually occurs via email. The attacker often creates an email that appears to be from a reputable source, such as a bank, social media platform, or even a known contact. The email may contain a link that directs the victim to a fake website, where they are asked to enter their credentials or other sensitive information.
-
-**How to protect yourself:**
-
-- Be cautious when opening emails from unknown senders
-- Look for suspicious signs in the email, such as poor grammar or inconsistencies in branding
-- Always hover over links in emails to check the actual URL before clicking
-- Enable two-factor authentication (2FA) on your online accounts
-
-## Vishing
-
-Vishing, or voice phishing, involves attackers using phone calls or voice messages to persuade victims into revealing sensitive information, such as banking details or passwords. Vishing attacks often rely on social engineering tactics, tricking the target into believing they're speaking with a legitimate company representative or authority figure.
-
-**How to protect yourself:**
-
-- Be cautious when receiving unexpected phone calls, especially from unknown numbers
-- Verify the caller's identity by asking for details only the legitimate party would know
-- Avoid providing personal information over the phone, unless you initiated the call and trust the recipient
-- If in doubt, hang up and call the known, verified number for the company or institution the caller claimed to represent
-
-## Whaling
-
-Whaling is a specific type of phishing attack that targets high-profile individuals, such as executives, celebrities, or politicians. These attacks tend to be more targeted and sophisticated, as the attacker has likely conducted extensive research on the victim.
-
-**How to protect yourself:**
-
-- Be aware of the potential risks associated with a high-profile position
-- Utilize strong, unique passwords for each of your accounts
-- Train employees on phishing and whaling techniques to minimize the likelihood of a successful attack
-- Regularly conduct security audits to ensure your organization's security measures are up-to-date
-
-## Smishing
-
-Smishing, or SMS phishing, is the act of using text messages to deceive victims into revealing sensitive information or downloading malicious software. The attacker may include a shortened URL or a phone number, attempting to trick the victim into following the link or calling the number.
-
-**How to protect yourself:**
-
-- Be cautious when receiving unsolicited text messages, especially from unknown senders
-- Check the sender's phone number to ensure it's legitimate or corresponds to the alleged source
-- Never click on suspicious links included in text messages
-- Install mobile security software to protect your device from potential threats
-
-By staying informed about these various attack types, you can better protect yourself and your organization from falling victim to cyber threats. Remain vigilant and ensure you have proper security measures in place to minimize the risk of these attacks.
-
-- [@official@What is Phishing?](https://www.phishing.org/what-is-phishing)
-- [@official@Phishing Examples](https://www.phishing.org/phishing-examples)
-- [@feed@Explore top posts about Phishing](https://app.daily.dev/tags/phishing?ref=roadmapsh)

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/attack-types/101-spam-vs-spim.md

@@ -1,43 +0,0 @@
-# Spam vs Spim
-
-When discussing cyber security, it's essential to be aware of the various attack types that one might face in the digital world. In this section, we'll compare two common attacks: **spam** and **spim**. By understanding the differences between these two methods, you can better protect yourself from these types of attacks.
-
-## Spam
-
-Spam refers to any unwanted, unsolicited, or irrelevant messaging sent over the internet, usually to a large number of users, for the purposes of advertising, phishing, or spreading malware. These messages are typically sent via email, which is why they are often called "spam emails." Spam may contain malicious attachments or links that, when clicked, download malware or lead users to compromised websites.
-
-Spammers often use automated systems to send these messages to a large number of recipients. Some common characteristics of spam emails include:
-
-- Suspicious sender addresses
-- Generic greeting
-- Unusual or unexpected attachments or links
-- Urgent or threatening language
-- Requests for personal information
-
-To protect yourself from spam, you should:
-
-- Set up effective email filters
-- Never share your email address publicly
-- Avoid clicking on suspicious links or attachments
-- Report spam to your email provider
-
-## Spim
-
-Spim, or "spam over instant messaging," is similar to spam but occurs over instant messaging (IM) services, such as Facebook Messenger, WhatsApp, and others. The main difference between spam and spim is the medium through which the unwanted messages are sent. Just like spam, spim can be used for advertising, spreading malware, or conducting phishing attacks.
-
-Some common characteristics of spim messages include:
-
-- Unknown or suspicious sender accounts
-- Messages containing links or attachments
-- Unsolicited promotions or offers
-- Requests for personal information
-- Unexpected urgency or threats
-
-To protect yourself from spim, you should:
-
-- Set your IM service's privacy settings to limit who can message you
-- Be cautious when clicking on links or attachments from unknown or suspicious accounts
-- Block or report spim accounts
-- Keep your IM client software updated
-
-In conclusion, **spam** and **spim** are two distinct types of unwanted messages, with the primary difference being the medium through which they are delivered. Both can pose significant risks to your digital security, so it's crucial to be vigilant, maintain proper security measures, and educate yourself about the various attack types you may encounter.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/attack-types/102-shoulder-surfing.md

@@ -1,22 +0,0 @@
-# Shoulder Surfing
-
-Shoulder surfing is a type of social engineering attack where an attacker observes someone's screen, keyboard, or any other device to gain unauthorized access to sensitive information. It is typically performed by secretly watching the victim during data entry, either directly or indirectly through reflections, smartphones, or other recording equipment.
-
-## How Shoulder Surfing Occurs
-
-- **Direct observation**: An attacker stands close to the target and observes their activities, such as typing passwords, entering credit card details, or accessing confidential data.
-- **Using cameras**: An attacker may use a hidden camera or a smartphone to secretly record keystrokes, which can be analyzed later to extract sensitive information.
-- **Seeing reflections**: Attackers may view reflections on nearby surfaces such as windows, shiny objects, or even the victim's glasses to monitor their activities.
-
-## Preventing Shoulder Surfing
-
-To protect yourself from shoulder surfing, follow these guidelines:
-
-- Be aware of your surroundings, especially in public places where the risk of shoulder surfing is higher.
-- Use privacy screens or screen guards to reduce the visibility of your device from different angles.
-- If using a smartphone or tablet, tilt the screen towards you and away from potential observers.
-- When entering sensitive information such as PIN codes or passwords, shield your keyboard or keypad with your body or hand.
-- Change passwords regularly and avoid using easy-to-guess or common passwords.
-- Educate employees about the risks of shoulder surfing and the importance of maintaining confidentiality in the workplace.
-
-By staying cautious and adopting these security measures, you can greatly reduce the risk of shoulder surfing and protect your sensitive data from unauthorized access.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/attack-types/103-dumpster-diving.md

@@ -1,16 +0,0 @@
-# Dumpster Diving
-
-**Dumpster diving** is a low-tech but potentially effective method used by attackers to gather sensitive and valuable information by physically searching through an organization's trash. Dumpster divers often target discarded documents such as old memos, printouts, and reports that may still contain sensitive information like usernames, passwords, credit card numbers, and other confidential details.
-
-## How it works
-
-Attackers search public and private trash receptacles to find information that may be helpful in their attack strategy. By piecing together various details from discarded documents, attackers may piece together a complete understanding of the organization's internal workings and gain access to protected systems.
-
-## Countermeasures
-
-- **Implement a 'shred-all' policy**: Ensure that all sensitive documents are shredded before being discarded. Make it a standard company policy, and ensure that all employees are trained in this practice.
-- **Raise awareness**: Train employees to recognize the potential risks of improper disposal and encourage them to be diligent in disposing of sensitive documents.
-- **Secure disposal**: Use lockable bins and trash bags or dispose of sensitive documents in a designated, secured place where they will be safely destroyed.
-- **Periodic audits**: Conduct regular audits of your physical security measures, including trash receptacles and disposal methods.
-
-By implementing these countermeasures, your organization can significantly reduce its risk of exposing sensitive information through dumpster diving.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/attack-types/104-tailgating.md

@@ -1,20 +0,0 @@
-# Tailgating
-
-Tailgating, also known as "piggybacking", is a social engineering technique used by attackers to gain unauthorized access to secure facilities or systems by following closely behind a legitimate user. This attack exploits the human tendency to trust others and help them out in various situations.
-
-## How it works
-
-- **Target identification:** The attacker chooses a target building, office, or data center which requires secure access.
-- **Observation:** The attacker watches for patterns, studying employees' routines and behaviors, identifying an ideal opportunity to slip in unnoticed.
-- **Entry:** The attacker waits for a situation where an employee is entering the secure area using their access card, and pretends to have forgotten their card, phone or being preoccupied. The attacker follows the employee entering the area or even asks the employee to hold the door open.
-- **Securing Access:** Once inside, the attacker may even steal a physical access card or exploit other vulnerabilities to secure long-term access.
-
-## Prevention Measures
-
-- **Awareness training:** Ensure that employees are aware of tailgating as a threat and the importance of adhering to security policies.
-- **Physical security:** Implement security measures like turnstiles, mantraps, or security guards to monitor and control access.
-- **Access control:** Ensure that access cards are unique to each employee and cannot be easily duplicated.
-- **Strict policies:** Enforce strict policies regarding holding doors open for others or allowing individuals into secure areas without proper credentials.
-- **Security culture:** Build a strong security culture where employees feel responsible for the organization's security and report any suspicious behavior.
-
-It is essential to keep in mind that tailgating relies heavily on human behavior and trust. While physical and technical security measures are crucial, fostering a culture of vigilance and employee awareness can be just as effective in preventing such attacks.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/attack-types/105-zero-day.md

@@ -1,32 +0,0 @@
-# Zero Day
-
-A **zero day attack** is an exploit that takes advantage of an unknown software vulnerability that has not been discovered, disclosed or patched by the software's developer. This type of attack, also known as an _exploit_, is particularly dangerous because it exploits a security gap that the vendor is not aware of, meaning there is no existing fix or protection against it.
-
-## Characteristics
-
-There are certain characteristics that make zero day attacks particularly dangerous, such as:
-
-- **Undetected vulnerability**: Attackers target vulnerabilities in software that developers or manufacturers are not aware of, making it difficult for defenders to protect against the attack.
-- **Speed**: Zero day attacks are quickly executed, often before any security measures can be implemented, resulting in a higher success rate for attackers.
-- **Stealth**: Attackers usually exploit these vulnerabilities quietly, making their intrusion hard to detect, and can maintain undetected access to a network or system.
-
-## Consequences
-
-Zero day attacks can have serious consequences, including:
-
-- Data theft or loss
-- Damaged systems or infrastructure
-- Financial losses
-- Reputation damage
-
-Organizations should invest in proactive security measures to protect against such attacks, as reactive measures alone may not be enough.
-
-## Mitigation Strategies
-
-- **Keep software up-to-date**: Regularly update software and apps, as developers often release patches and fixes for known vulnerabilities.
-- **Implement multi-layered security**: Employ a combination of robust security solutions, including firewalls, intrusion detection and prevention systems, anti-malware software, and more.
-- **Monitor network and device activity**: Regularly monitor and analyze network and device activities to spot any unusual behavior, potentially indicating an exploit.
-- **Encrypt sensitive data**: By encrypting sensitive data, it becomes harder for hackers to steal and misuse it.
-- **Segment networks**: Segment your networks to limit access to sensitive information and systems, minimizing the damage in case of a breach.
-- **Educate employees**: Provide training for employees about the threat landscape, good security practices, and how to avoid falling victim to phishing or social engineering attacks.
-- **Regular backups and disaster recovery planning**: Routinely and securely back up data and develop a disaster recovery plan to mitigate damages from security breaches or attacks.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/attack-types/106-social-engineering.md

@@ -1,33 +0,0 @@
-# Social Engineering
-
-Social engineering is a subtle yet highly effective method of manipulation that plays on human emotions and behavior to gain unauthorized access to sensitive information. It relies on psychological tactics, rather than technical ones, to deceive people into providing confidential data, allowing unauthorized access, or performing actions that compromise cybersecurity.
-
-## Types of Social Engineering
-
-There are various forms of social engineering, including:
-
-- **Phishing**: A widespread technique where attackers create fake emails and websites, imitating legitimate organizations, to deceive victims into sharing sensitive data such as login credentials or financial information.
-
-- **Pretexting**: This method involves the attacker fabricating a believable scenario or pretext to establish trust with the target and trick them into divulging sensitive information.
-
-- **Baiting**: Tempting the victim with free or irresistible offers such as software, downloads, or attractive discounts, with the intention of installing malware or gaining unauthorized access.
-
-- **Quid pro quo**: Offering a service, information, or assistance in exchange for the victim's sensitive information or system access.
-
-- **Tailgating/piggybacking**: Attacker gains unauthorized physical access to restricted areas by closely following an authorized individual or posing as an employee or contractor.
-
-## Preventive Measures
-
-To protect yourself and your organization against social engineering attacks, keep the following tips in mind:
-
-- Educate employees about the various social engineering methods, signs of potential attacks, and best practices to avoid falling victim.
-
-- Implement robust security protocols, including multi-factor authentication, password policies, and restricted access to valuable data.
-
-- Encourage a culture of verification and validation to ensure the authenticity of requests, emails, and communication.
-
-- Keep software and security solutions up-to-date to minimize vulnerabilities that can be exploited by attackers.
-
-- Regularly back up data and have an incident response plan in place to mitigate the impact of successful attacks.
-
-Remember, social engineering preys on human psychology and behavior. Therefore, awareness, vigilance, and adherence to best practices are crucial to defend against such threats.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/attack-types/107-reconnaissance.md

@@ -1,24 +0,0 @@
-# Reconnaissance
-
-Reconnaissance is a crucial stage in any cyber attack and refers to the process of gathering information about potential targets, their systems, networks, and vulnerabilities. This information is used by attackers to select which tactics, techniques, or tools will be most effective when attempting to compromise a target system or organization. Reconnaissance can be divided into two primary methods: active and passive.
-
-## Active Reconnaissance
-
-In active reconnaissance, attackers directly engage with their target to gather information. This may include scanning networks for open ports or services, attempting to query servers or probing for vulnerabilities. Since the attacker is actively interacting with target systems, it has higher chances of being detected by intrusion detection systems, firewalls or security teams.
-
-Common active reconnaissance tools include:
-
-- Nmap: A network scanner that can discover hosts, services, and open ports.
-- Nessus: A vulnerability assessment tool that allows attackers to scan for known vulnerabilities in target systems.
-
-## Passive Reconnaissance
-
-In passive reconnaissance, the attacker seeks to gather information about the target without making any contact or directly engaging with target systems. Passive reconnaissance is often harder to detect and involves activities such as social engineering, open-source intelligence (OSINT) gathering, or analyzing leaked data.
-
-Common passive reconnaissance techniques include:
-
-- Searching public forums, social media profiles, or websites for information about an organization or its employees.
-- Using search engines to find exposed or inadvertently leaked data.
-- Sifting through DNS records and WHOIS information to discover sub-domains and email addresses that might be used in further attacks.
-
-Defensive measures against reconnaissance include monitoring network traffic for unusual patterns or repeated probing attempts, regularly updating and patching systems, providing employee training on social engineering awareness, and implementing network segmentation to limit access to sensitive information.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/attack-types/108-impersonation.md

@@ -1,28 +0,0 @@
-# Impersonation
-
-Impersonation is a type of cyber attack where an attacker pretends to be a legitimate user, system, or device to gain unauthorized access or manipulate their target. This kind of attack can happen through various channels like email, phone calls, social media, or instant messaging platforms. Impersonation attacks mainly aim to deceive the target into providing sensitive information, executing malicious actions, or gaining unauthorized access to secure systems.
-
-## Types of Impersonation Attacks
-
-- **Phishing:** Attackers send emails appearing to be from legitimate sources, tricking the target into revealing sensitive information or downloading malware.
-
-- **Spear phishing:** A more targeted form of phishing, where the attacker possesses specific information about their target and creates a personalized email.
-
-- **Whaling:** This attack targets high-ranking individuals like CEOs or CFOs, using a combination of personalized spear-phishing and social engineering to extract valuable information or conduct fraudulent transactions.
-
-- **Caller ID spoofing:** Attackers manipulate phone numbers to appear as if they're coming from a legitimate source, often impersonating customer support agents or bank representatives to deceive targets into providing sensitive information.
-
-- **Man-in-the-middle (MITM) attacks:** Attackers insert themselves between the target user and a website or service, impersonating both ends of the communication to intercept sensitive data.
-
-- **Social media impersonation:** Attackers create fake profiles that resemble trusted individuals or organizations in order to deceive their targets, gain information, or spread misinformation.
-
-## Ways to Prevent Impersonation Attacks
-
-- **Enable multi-factor authentication (MFA):** By requiring two or more forms of identity verification, you can reduce the risk of unauthorized access.
-- **Educate users:** Teach users about the risks of impersonation attacks and how to recognize potential red flags.
-- **Implement strong password policies:** Encourage users to create unique, complex passwords and change them regularly.
-- **Keep software up-to-date:** Regularly update and patch all software, including operating systems and applications, to protect against known vulnerabilities.
-- **Use encryption:** Protect sensitive data by using encryption both in transit and at rest.
-- **Monitor and analyze network traffic:** Regularly review network logs and use tools to detect and analyze anomalies or signs of potential impersonation attacks.
-
-By understanding the various types of impersonation attacks and implementing these security best practices, you can better defend your organization against these ever-evolving cyber threats.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/attack-types/109-watering-hole-attack.md

@@ -1,22 +0,0 @@
-# Watering Hole Attack
-
-A **watering hole attack** is a targeted cyber attack in which an attacker observes the websites frequently visited by a specific group or organization and seeks to compromise those sites in order to infect their desired targets. These attacks are named after the natural predator-prey relationship; much like how predators wait near a watering hole to hunt their prey.
-
-In this type of attack, the attacker does not directly target the victims; instead, they focus on the websites that the targeted users commonly visit. Here's a step-by-step breakdown of a typical watering hole attack:
-
-- **Identify Target**: The attacker identifies a specific organization or group they want to target, like a government agency or a corporation.
-- **Study Behavior**: The attacker studies the internet browsing behavior of the target users, observing which websites they frequently visit.
-- **Compromise Website**: The attacker exploits vulnerabilities in one or more of the target websites and injects malicious code into them. This could be through a vulnerable plugin, weak passwords, or even by gaining access to the site's hosting platform.
-- **Infect Victims**: When the target users visit the compromised websites, they unknowingly download the malicious code onto their machines, allowing the attacker to further exploit the infected devices.
-
-## Detection and Prevention
-
-To protect against watering hole attacks, it is important to adopt best practices, including:
-
-- Regularly updating software on both servers and user devices.
-- Installing robust security plugins for websites.
-- Adopting a strong password policy and using multi-factor authentication.
-- Conducting cybersecurity awareness training to educate your employees.
-- Implementing network and endpoint security solutions to detect and prevent intrusions.
-
-In conclusion, a watering hole attack is a subtle yet dangerous vector for cybercriminals to infiltrate their targets' systems. Organizations should prioritize cybersecurity hygiene and user education to minimize the risks posed by these attacks.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/attack-types/110-drive-by-attack.md

@@ -1,29 +0,0 @@
-# Drive by Attack
-
-A **Drive-by Attack** is a common cyber security threat where an attacker aims to infect a user's computer or device by exploiting vulnerabilities in their web browser or its plugins. Typically, users unknowingly fall victim to drive-by attacks when they visit a malicious or compromised website, which in turn automatically executes the malicious code.
-
-## How Drive-By Attacks Work
-
-- **Exploiting web vulnerabilities**: Attackers often target popular websites with security flaws or vulnerabilities, which can be exploited to inject malicious code.
-
-- **Malvertisements**: Another common method for drive-by attacks is through online advertising. Cybercriminals use advertising networks to circulate infected ads that, once clicked, execute the malicious code on the user's device.
-
-- **Social Engineering**: Attackers use social engineering tactics to trick users into visiting compromised websites that exploit browser vulnerabilities.
-
-## Preventing Drive-By Attacks
-
-To safeguard against drive-by attacks, consider the following measures:
-
-- **Keep your software up-to-date**: Regularly update your web browser, plugins, and operating system to defend against known vulnerabilities.
-
-- **Use a reputable antivirus software**: Employ a trusted antivirus solution with real-time scanning and frequent signature updates to detect and remove malware.
-
-- **Enable click-to-play for plugins**: Adjust your browser settings to require manual activation of plugins, like Adobe Flash, which can be exploited by attackers.
-
-- **Practice good browsing habits**: Avoid visiting suspicious websites, opening unknown email attachments, and clicking on unverified links from sources you do not trust.
-
-- **Disable JavaScript and browser plugins when not needed**: Disabling browser features, like JavaScript and browser plugins, can reduce the chances of a drive-by attack.
-
-- **Implement web filtering**: Utilize content filtering or secure web gateways to block access to malicious websites.
-
-By understanding the methods and tactics used in drive-by attacks and following these preventative measures, you can better protect yourself and maintain a secure online presence.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/attack-types/111-typo-squatting.md

@@ -1,27 +0,0 @@
-# Typo Squatting
-
-**Typo Squatting**, also known as **URL hijacking** or **domain squatting**, is a malicious cyber-attack technique that targets internet users who mistakenly enter an incorrect website address into their web browsers. When this occurs, the users are directed to a fake website that closely resembles a legitimate one. The attackers create these fake websites by registering domain names similar to the target website, but with common typographical errors. The goal of typo squatting is often to spread malware, steal personal information or financial details, sell counterfeit products, or promote phishing scams.
-
-## How Typo Squatting Works
-
-- **Domain Registration**: Attackers register domain names that are similar to popular websites, but with slight typos, such as missing or swapped characters. For example, if the intended website is `example.com`, the attacker may register `exapmle.com` or `exampl.com`.
-
-- **Creating Fake Websites**: Attackers create a website that visually resembles the targeted website. This can include using the same logos, images, and layout, making it difficult for users to distinguish the fake site from the real one.
-
-- **Luring Victims**: Unsuspecting users who make typographical errors while typing the URL are redirected to the fake website, where they may unknowingly provide their personal or financial information, download malware, or fall victim to phishing scams.
-
-- **Exploitation**: Attackers may use the gathered information for identity theft, financial fraud, or sell the data on the dark web. They may also use the malware-infected devices to create botnets or perform further attacks on other targets.
-
-## Prevention and Mitigation
-
-- **Double-check URLs**: Always double-check the URL you type into your browser to ensure you are accessing the intended website.
-
-- **Use Bookmarks**: Bookmark frequently visited websites to avoid typing the URL manually every time.
-
-- **Search Engines**: If unsure about the correct URL, use search engines to locate the desired website.
-
-- **Use Security Software**: Install and maintain up-to-date security software on your devices, such as anti-virus, anti-phishing, and anti-malware tools, to protect against potential threats from typo squatting.
-
-- **Enable Browser Protection**: Many web browsers offer built-in security features that help identify and block malicious websites. Ensure these features are enabled and configured correctly.
-
-In conclusion, while typo squatting presents a significant risk to internet users, awareness and vigilance can significantly reduce the chances of becoming a victim. Always verify that you're visiting the correct website before entering any personal or sensitive information.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/attack-types/112-brute-force-vs-password-spray.md

@@ -1,33 +0,0 @@
-# Brute Force vs Password Spray
-
-In this section, we will discuss two common techniques employed by cybercriminals to gain unauthorized access to a victim's system or account: **Brute Force** and **Password Spray** attacks. By understanding these attack types, you will be better equipped to protect your systems and recognize potential threats.
-
-## Brute Force Attacks
-
-**Brute Force attacks** are a trial-and-error method used by attackers to discover the correct credential combinations (username and password) to gain unauthorized access to an account or system. This is done by systematically trying as many possibilities as possible until the correct combination is found.
-
-In a Brute Force attack, the attacker usually utilizes automated tools to generate and test numerous password combinations. This strategy can be time-consuming, resource-intensive, and potentially detectable due to the massive number of login attempts made in a short period.
-
-## Protecting Against Brute Force Attacks
-
-To mitigate the risks of a Brute Force attack, implement the following best practices:
-
-- **Strong password policies:** Encourage users to create complex and unique passwords, combining upper and lower case letters, numbers, and special characters.
-- **Account lockout policies:** Lock user accounts temporarily after a set number of unsuccessful login attempts.
-- **Multi-factor authentication (MFA):** Implement MFA to make it more difficult for attackers to gain access, even if they obtain the correct credentials.
-
-## Password Spray Attacks
-
-**Password Spray attacks** take a more sophisticated approach to compromise accounts. Instead of attempting various passwords against one account, as in Brute Force attacks, attackers try a single (often commonly used) password against multiple accounts. This method minimizes the risk of detection by spreading the attempts over many accounts and making them appear as ordinary user login attempts.
-
-In a Password Spray attack, the attacker typically uses a list of known usernames and tries a small set of commonly used passwords against each username. As many individuals still use weak and common passwords, this attack type can be surprisingly effective.
-
-## Protecting Against Password Spray Attacks
-
-To defend against Password Spray attacks, follow these best practices:
-
-- **Educate users on password choice:** Teach users about the importance of choosing strong, unique passwords that are not easily guessed or found in password dictionaries.
-- **Monitor for unusual login patterns:** Use monitoring tools to detect unusual login patterns, such as numerous successful logins with specific (common) passwords.
-- **Implement multi-factor authentication (MFA):** Require users to provide an additional layer of authentication when logging in.
-
-In conclusion, understanding the differences between Brute Force and Password Spray attacks, as well as adopting strong security measures, can help protect your systems and accounts from unauthorized access. Encourage the use of strong, unique passwords and implement multi-factor authentication to improve overall cybersecurity.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/attack-types/index.md

@@ -1 +0,0 @@
-# Attack types

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/common-distros-for-hacking/100-parrot-os.md

@@ -1,21 +0,0 @@
-# ParrotOS
-
-Parrot OS, also known as Parrot Security OS, is a powerful Linux-based distribution designed for penetration testing, digital forensics, and ethical hacking. Developed by Frozenbox, this Debian-based operating system comes with a wide range of tools for cyber security enthusiasts, making it one of the most popular choices among hackers and security professionals.
-
-## Key Features
-
-- **MATE Desktop Environment**: Parrot OS uses the customizable, lightweight MATE desktop environment, providing a seamless and user-friendly interface.
-- **Wide Range of Hacking Tools**: Parrot OS comes preloaded with a variety of hacking tools, such as Metasploit, Wireshark, Aircrack-ng, Armitage, and more. This ensures users have access to the necessary tools for pentesting and security assessments without needing to install them separately.
-- **Regular Updates**: The distribution receives frequent updates, ensuring its tools and features stay current with the latest developments in the cyber security field.
-- **Anonymity and Privacy**: Parrot OS comes with built-in tools like Anonsurf and TOR to enhance user privacy and anonymity, which are commonly used by cyber criminals as well as ethical hackers.
-- **Resource Efficient**: Parrot OS is designed to be lightweight, consuming fewer system resources compared to other hacking-oriented distros, making it suitable for low-spec devices or hardware.
-
-## Use Cases
-
-- **Penetration Testing**: Parrot OS is equipped with numerous tools for network scanning, vulnerability assessment, and exploitation that facilitate comprehensive security testing in various environments.
-- **Digital Forensics**: With a range of digital forensics tools, Parrot OS enables performing detailed analysis of computers and networks for potential evidence of cybercrime.
-- **Reverse Engineering**: The OS also includes tools for reverse engineering, assisting security professionals in examining and analyzing software or malware designs.
-
-Overall, Parrot OS is a reliable, versatile, and user-friendly cyber security distribution, ideal for both beginners and advanced users engaged in ethical hacking, penetration testing, and digital forensics.
-
-- [@article@Link to Download Parrot OS ](https://www.parrotsec.org/download/)

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/common-distros-for-hacking/101-kali-linux.md

@@ -1,43 +0,0 @@
-# Kali Linux
-
-Kali Linux is one of the most popular Linux distributions used by cybersecurity professionals, ethical hackers, and penetration testers. This operating system is designed specifically for advanced security tasks such as penetration testing, exploit development, and digital forensics.
-
-## Features
-
-Developed and maintained by Offensive Security, Kali Linux provides an extensive toolkit that comes pre-installed with numerous security tools, including:
-
-- Metasploit: A powerful exploit development framework
-- Nmap: A network scanning utility
-- Wireshark: A network protocol analyzer
-- John the Ripper: A password-cracking tool
-- Aircrack-ng: A suite for wireless network assessment
-- SQLmap: An automated SQL injection tool
-
-## Advantages
-
-The main advantages of using Kali Linux are:
-
-- **Specialized Tools**: As mentioned above, Kali Linux comes with a plethora of pre-installed tools dedicated to cybersecurity, making it an ideal choice for professionals in the field.
-
-- **Regular Updates**: Kali Linux receives continuous updates to ensure its tools, features, and capabilities are up-to-date, catering to the ever-evolving cybersecurity landscape.
-
-- **Extensive Documentation**: The Kali Linux community offers comprehensive documentation, making it easy to learn and understand the tools and features provided with the distribution.
-
-- **Customization**: Kali Linux can be customized according to individual requirements, allowing users to tailor the operating system to fit their specific objectives.
-
-## Limitations
-
-While Kali Linux is widely used and respected in the cybersecurity community, it has some limitations that users should be aware of:
-
-- **Not for beginners**: Kali Linux is designed specifically for skilled professionals familiar with Linux systems and cybersecurity concepts, and may be overwhelming for those new to Linux or cybersecurity.
-
-- **Resource Intensive**: Kali Linux may have higher system requirements compared to other lightweight distributions, potentially impacting performance on older or resource-constrained devices.
-
-- **Potential Legal Issues**: Since Kali Linux contains tools that can break into systems and networks, it's crucial to use them responsibly and ethically, always obtaining proper authorization for any penetration testing activity to avoid legal repercussions.
-
-## Conclusion
-
-Kali Linux is a powerful and widely used distribution tailored for cybersecurity experts and penetration testers. Its extensive collection of tools, combined with regular updates and customization options, make it an attractive choice for those seeking a reliable and feature-rich operating system geared towards cybersecurity tasks. However, it is essential for users to remain mindful of the responsibility and legality associated with using these tools.
-
-- [@official@kali Linux](https://www.kali.org/)
-- [@feed@Explore top posts about Linux](https://app.daily.dev/tags/linux?ref=roadmapsh)

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/common-distros-for-hacking/index.md

@@ -1 +0,0 @@
-# Common distros for hacking

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/common-network-based-attacks/100-dos-vs-ddos.md

@@ -1,31 +0,0 @@
-# DoS vs DDoS
-
-In this section, we will discuss the differences between DoS (Denial of Service) and DDoS (Distributed Denial of Service) attacks, two common network-based attacks that can severely impact the availability and performance of targeted systems.
-
-## DoS (Denial of Service) Attack
-
-A DoS attack is a type of cyber attack where an attacker aims to make a computer or network resource unavailable to its intended users by overwhelming the target system with requests, it essentially becomes inaccessible due to server overloading.
-
-Some common methods employed in DoS attacks include:
-
-- **Flooding** - The attacker sends a massive number of requests to the target system, overwhelming its capacity to respond and eventually crashing the system.
-- **Ping of Death** - The attacker sends a large, malformed ICMP packet to the target system, which can cause the system to crash.
-
-## DDoS (Distributed Denial of Service) Attack
-
-A DDoS attack is similar to a DoS attack in its intent, but it utilizes multiple computers or devices (usually compromised by malware) to launch the attack. These devices, collectively called a "botnet", send an overwhelming amount of requests to the target system, making it even harder to mitigate the attack and protect the resources.
-
-Some common methods employed in DDoS attacks include:
-
-- **UDP Flood** - A DDoS attack that sends numerous User Datagram Protocol (UDP) packets to the target system, consuming its resources and eventually leading to a crash.
-- **HTTP Flood** - A DDoS attack that generates a large number of HTTP requests to the target server, which exceeds its processing capacity and causes a slowdown or crash.
-
-## Key Differences
-
-- **Scale**: While DoS attacks are limited by the resources of a single attacker, DDoS attacks involve multiple attacking devices, making them more effective at overwhelming and disrupting the target system.
-- **Mitigation**: DoS attacks can usually be mitigated with simpler countermeasures, but DDoS attacks often require more sophisticated defense strategies due to their distributed and coordinated nature.
-
-In conclusion, both DoS and DDoS attacks aim to disrupt the availability of a target system by overwhelming its resources. However, their key differences lie in the scale and complexity of the attack, with DDoS attacks being more powerful and more challenging to defend against. It is crucial for organizations to implement robust security measures to detect and mitigate these attacks to maintain the availability and integrity of their systems.
-
-- [@video@DDOS Attack](https://www.youtube.com/watch?v=PTJ6UZz1pPQ)
-- [@feed@Explore top posts about Cybersecurity](https://app.daily.dev/tags/cyber?ref=roadmapsh)

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/common-network-based-attacks/101-mitm.md

@@ -1,26 +0,0 @@
-# MITM
-
-A _Man-In-The-Middle (MITM)_ attack occurs when a malicious actor intercepts the communication between two parties without their consent, with the objective of eavesdropping or manipulating the exchanged data. By this method, attackers may steal sensitive information, tamper with the transmitted data, or impersonate the involved parties to gain unauthorized control or access.
-
-## 4.1 Types of MITM Attacks
-
-Some common types of MITM attacks include:
-
-- **IP Spoofing:** The attacker impersonates another device's IP address to establish a connection with the victim.
-- **DNS Spoofing:** The attacker modifies the DNS records to redirect the victim to a malicious website instead of the intended one.
-- **ARP Spoofing:** The attacker alters the target's ARP cache to associate their MAC (Media Access Control) address with the victim's IP address, redirecting network traffic through the attacker's device.
-- **SSL and TLS Interception:** The attacker intercepts and decrypts encrypted SSL/TLS communication between the victim and the web server, gaining access to sensitive data.
-
-## 4.2 Prevention and Mitigation Strategies
-
-To reduce the risk of MITM attacks, developers, administrators, and users should follow these best practices:
-
-- **Use HTTPS and encryption:** Make sure to encrypt all sensitive data using secure communication protocols like HTTPS, SSL, or TLS.
-- **Validate certificates:** Use a Certificate Authority (CA) to verify digital certificates for secure connections.
-- **Implement HSTS:** Deploy HTTP Strict Transport Security (HSTS), a security policy that enforces browsers to use HTTPS connections only.
-- **Secure DNS:** Use DNS Security Extensions (DNSSEC) to ensure the integrity and authenticity of DNS records.
-- **Enable network segregation:** Segment networks and restrict access between them to prevent malicious actors from gaining access to sensitive data or systems.
-- **Regularly update software and firmware:** Keep all systems, applications, and devices up-to-date to minimize known vulnerabilities.
-- **Educate users:** Provide awareness training and support resources to help users recognize and avoid potential MITM attacks.
-
-By understanding MITM attacks and implementing the appropriate preventive measures, you can significantly reduce the risk of falling victim to these types of cyber threats.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/common-network-based-attacks/102-arp-poisoning.md

@@ -1,26 +0,0 @@
-# ARP Poisoning
-
-**ARP Poisoning**, also known as ARP spoofing or ARP cache poisoning, is a cyber attack technique that exploits the Address Resolution Protocol (ARP) in a computer network. ARP is responsible for mapping an IP address to a corresponding Media Access Control (MAC) address, so that data packets can be correctly transmitted to the intended network device. An attacker can use ARP poisoning to intercept, modify, or disrupt communications between network devices.
-
-**How It Works:**
-
-- The attacker sends falsified ARP messages to the network, associating their MAC address with the IP address of a targeted device (such as a server or gateway).
-- Other devices on the network treat the attacker's MAC address as the legitimate one for the targeted IP address, updating their ARP tables accordingly.
-- As a result, data packets that were meant for the targeted device are now sent to the attacker instead, potentially enabling them to eavesdrop, modify, or disrupt network traffic.
-
-**Consequences:**
-
-ARP poisoning can lead to serious security issues, including:
-
-- Data leakage: Attackers can intercept sensitive data exchanged between devices on the network.
-- Man-in-the-middle attacks: Attackers can modify data in transit, potentially inserting malicious content.
-- Denial of Service (DoS) attacks: Attackers can render a targeted device unresponsive by flooding it with traffic or by dropping all packets bound for it.
-
-**Prevention and Mitigation:**
-
-Several strategies can help protect networks against ARP poisoning:
-
-- Static ARP entries: Assign static IP-to-MAC address mappings to prevent attackers from forging ARP responses.
-- ARP inspection tools: Use switches, firewalls, or Intrusion Detection/Prevention Systems (IDS/IPS) that support Dynamic ARP Inspection (DAI) or similar features to validate or filter suspicious ARP traffic.
-- IPsec or SSL/TLS: Encrypt traffic between network devices with secure protocols like IPsec or SSL/TLS to mitigate eavesdropping or tampering risks.
-- Regular monitoring: Continuously monitor network traffic and device ARP tables for anomalies or inconsistencies, possibly using Network Intrusion Detection Systems (NIDS) or other security tools.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/common-network-based-attacks/103-evil-twin.md

@@ -1,23 +0,0 @@
-# Evil Twin
-
-An **Evil Twin Attack** is a malicious tactic used by cybercriminals to deceive users by creating a fake wireless Access Point (AP) that mimics the characteristics of a legitimate one. This rogue access point usually has the same network name (SSID) and security settings as a genuine AP, making it difficult for users to differentiate between the two.
-
-## How it works
-
-- The attacker sets up their own hardware in the vicinity of the targeted wireless network and configures a rogue AP with the same SSID and security settings as the genuine network.
-- Unsuspecting users connect to the rogue AP, thinking it's the legitimate network.
-- The attacker can now intercept and, in some cases, alter the user's data transmitted over the network. This can include sensitive information such as login credentials, credit card details, and personal conversations.
-
-## Risks associated with Evil Twin Attacks
-
-- Unauthorized access to sensitive information: The attacker can gain access to your usernames, passwords, and other confidential information.
-- Loss of privacy: The attacker can eavesdrop on personal or business conversations, which can lead to blackmail or identity theft.
-- Data manipulation: The attacker can alter transmitted data, leading to misinformation or unintended actions.
-
-## Preventing Evil Twin Attacks
-
-- **Use a VPN**: A Virtual Private Network (VPN) secures your data by encrypting the information transmitted between your device and the Internet. Even if you connect to a rogue AP, your data will be protected.
-- **Verify the SSID**: Make sure you are connecting to the correct SSID. Be cautious of networks with similar names or those that don't require a password.
-- **Enable two-factor authentication**: Enable two-factor authentication (2FA) for critical accounts and services. This provides an additional layer of security, making it more difficult for attackers to gain unauthorized access.
-- **Keep software up-to-date**: Regularly update your devices, software, and operating system to protect against known vulnerabilities and security threats.
-- **Educate yourself and others**: Be aware of the risks associated with Evil Twin Attacks, and inform others to increase overall security awareness.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/common-network-based-attacks/104-dns-poisoning.md

@@ -1,34 +0,0 @@
-# DNS Poisoning
-
-**DNS Poisoning**, also known as **DNS Cache Poisoning** or **DNS Spoofing**, is a type of cyberattack where cyber-criminals manipulate the Domain Name System (DNS) responses to redirect users to malicious websites. Let's dive deeper to understand how it works and its potential impact.
-
-## How DNS Poisoning Works
-
-The DNS is like the internet's phonebook; it translates human-readable domain names (e.g., www.example.com) into their corresponding IP addresses for computers to understand. This process involves a DNS resolver, which refers to a cached DNS database to find the correct IP address. In a DNS poisoning attack, an attacker exploits vulnerabilities in the DNS to inject false or malicious data into a DNS resolver's cache.
-
-Here's a quick outline of the process:
-
-- User requests the IP address for a legitimate website (e.g., www.example.com).
-- The DNS resolver sends a request to a DNS server to resolve the domain name into the IP address.
-- The attacker intercepts the DNS request and injects false DNS information into the DNS resolver's cache.
-- The DNS resolver then returns the falsified IP address to the user.
-- The user unknowingly accesses the attacker-controlled malicious website instead of the intended legitimate site.
-
-## Impacts of DNS Poisoning
-
-DNS poisoning has several potential impacts on both users and organizations:
-
-- **Phishing and Identity Theft**: By redirecting users to malicious websites, attackers can steal sensitive information, such as login credentials or personal details, to be used for identity theft or other fraudulent activities.
-- **Malware Distribution**: Malicious websites may expose users to malware, ransomware, or other cyber threats.
-- **Loss of Trust**: If an organization's domain is targeted in a DNS poisoning attack, its customers may lose trust and doubt the security of the organization's online services.
-
-## Preventing and Mitigating DNS Poisoning
-
-Here are some steps you can take to prevent and mitigate the risk of DNS poisoning:
-
-- **Use DNSSEC**: DNSSEC (Domain Name System Security Extensions) is a security protocol that adds an additional layer of authentication and integrity to DNS responses, making it harder for attackers to corrupt DNS data.
-- **Keep Software Updated**: Regularly update your DNS software, operating systems, and other network tools to ensure they're protected against known vulnerabilities.
-- **Use Secure DNS Resolvers**: Choose a secure DNS resolver that has built-in mechanisms to prevent DNS poisoning, such as validating DNSSEC signatures.
-- **Monitor Your DNS Traffic**: Regularly monitoring DNS query logs can help you identify suspicious patterns or unusual activities, which may indicate DNS poisoning attempts.
-
-In summary, DNS poisoning is a potent cyber threat that manipulates DNS data to redirect users to malicious websites. By implementing security measures such as DNSSEC, keeping software updated, and closely monitoring DNS traffic, you can significantly reduce the risk of falling victim to DNS poisoning attacks.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/common-network-based-attacks/105-spoofing.md

@@ -1,29 +0,0 @@
-# Spoofing
-
-Spoofing is a type of cyber attack where an attacker impersonates or masquerades as another entity (person or system) to gain unauthorized access to sensitive information, manipulate communications or bypass network security measures. Spoofing can come in various forms, including:
-
-## IP Spoofing
-
-IP Spoofing refers to when an attacker sends fake packets with a forged source IP address. This is often done to bypass IP-based security measures or to make an attack seem like it's coming from another source. Potential consequences of a successful IP spoofing attack include unauthorized access to systems, data manipulation and denial of service attacks.
-
-To protect against IP spoofing, organizations can implement ingress and egress filtering and adopt network protocols that include authentication for incoming packets.
-
-## Email Spoofing
-
-Email spoofing involves forging the header information of an email to make it appear as if it's sent from a legitimate source. Attackers often use this tactic in phishing attacks, where emails are made to look like they are from trusted sources, prompting recipients to click on malicious links or share sensitive information.
-
-To defend against email spoofing, it is essential to use email authentication protocols, such as Sender Policy Framework (SPF), Domain Key Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC).
-
-## Caller ID Spoofing
-
-In caller ID spoofing, an attacker changes the caller ID information to deceive the recipient. This technique is commonly used in phone scams, where the attacker disguises their identity to create a sense of trust, convince the recipient to share personal information or execute malicious activities.
-
-To reduce the risk of caller ID spoofing, be cautious of unexpected calls from unknown numbers, never share sensitive information over the phone, and implement call-blocking services.
-
-## Address Resolution Protocol (ARP) Spoofing
-
-ARP Spoofing, also known as ARP poisoning, involves an attacker forging ARP messages to associate their MAC address with the IP address of a legitimate network device. This allows the attacker to intercept and modify network traffic, potentially leading to man-in-the-middle attacks or denial of service.
-
-To defend against ARP spoofing, organizations can employ dynamic ARP inspection, static ARP entries, and intrusion detection systems that monitor for unusual ARP activity.
-
-In summary, spoofing attacks can impact various aspects of digital communication, whether it be IP-based, email, phone, or network traffic. To protect against spoofing, be vigilant and employ defensive measures, such as network authentication protocols, monitoring suspicious activities, and educating users about potential risks.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/common-network-based-attacks/106-deauth-attack.md

@@ -1,33 +0,0 @@
-# Deauth Attack
-
-A **Deauthentication (Deauth) Attack** is a type of Denial-of-Service (DoS) attack that specifically targets wireless networks. It works by exploiting how Wi-Fi devices communicate with one another, intentionally causing legitimate users to be disconnected from the access point. The attacker sends a flood of deauthentication (Deauth) frames to the targeted access point, effectively overwhelming it and forcing connected clients to disconnect.
-
-## How Does a Deauth Attack Work?
-
-Deauth attacks take advantage of the management frames used in the 802.11 Wi-Fi standard. These control frames ensure efficient operation of communications between connected devices and include the authentication, association, and deauthentication subtypes. Since management frames are often not encrypted, attackers can easily generate and transmit fake deauthentication frames to force disconnections.
-
-When a Deauth frame is received by a user's device, it releases its connection to the access point, and the user must re-connect in order to reestablish data transfer with the Wi-Fi network.
-
-## Impacts and Consequences
-
-Deauth attacks can cause the following problems:
-
-- **Loss of connectivity:** The most obvious consequence is that network connectivity is lost, disrupting any network-related activity and potentially causing loss of unsaved data.
-
-- **Network congestion:** As deauthenticated devices try to reconnect, this increased activity can cause network congestion, leading to further performance degradation.
-
-- **Credentials theft:** Deauth attacks can be used in conjunction with fake access points, allowing attackers to trick users into connecting to these malicious networks, and subsequently stealing their credentials and sensitive data.
-
-## How to Prevent Deauth Attacks
-
-There isn't a foolproof solution to protect against deauth attacks, particularly due to the inherent lack of encryption in management frames. However, you can take the following steps to reduce your risk:
-
-- **Enable 802.11w (Protected Management Frames):** Some routers support the 802.11w standard, which can protect deauthentication and disassociation frames through encryption.
-
-- **Use a strong authentication method:** Enabling strong methods like WPA3 and EAP-TLS on your network can help ensure that devices are more resistant to malicious disconnections.
-
-- **Monitor your network for suspicious activity:** Utilize a network monitoring tool or Wi-Fi analyzer to detect anomalies and possible deauth attack attempts.
-
-- **Secure your access points:** Regularly update your router’s firmware and configure its settings to disable remote management access, applying strong access credentials to minimize unauthorized access.
-
-As an author of this guide, I advise you to stay diligent and follow the best practices in order to safeguard your network from deauth attacks and other security threats.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/common-network-based-attacks/107-vlan-hopping.md

@@ -1,25 +0,0 @@
-# VLAN Hopping
-
-VLAN hopping is a common network-based attack that exploits the vulnerabilities of the VLAN trunking protocols in a local area network (LAN). The objective of this attack is to gain unauthorized access to other VLANs or to bypass the network's security protocols by hopping between VLANs.
-
-## How VLAN Hopping Works
-
-There are two primary methods of VLAN hopping:
-
-- **Switch Spoofing:** In this approach, an attacker configures their device to act as a switch and establish a trunk link with the actual network switch. Since trunk links are designed to carry traffic from multiple VLANs, the attacker can then access traffic from all the VLANs that are allowed on the trunk.
-
-- **Double Tagging:** This method involves sending frames with multiple 802.1Q VLAN tags. By adding an extra tag, an attacker can confuse the switch and cause it to forward the frame to another VLAN, providing unauthorized access to that VLAN's traffic.
-
-## Preventing VLAN Hopping
-
-To secure your network from VLAN hopping attacks, consider implementing the following best practices:
-
-- **Disable Unused Ports:** Shut down any unused ports on your switches and configure them as access ports instead of trunk ports. This will limit the opportunity for an attacker to establish a trunk link.
-
-- **Configure Allowed VLANs on Trunk Links:** Restrict the VLANs that can be carried on trunk links by explicitly specifying the allowed VLANs. This will prevent an attacker from accessing unauthorized VLANs through a trunk link.
-
-- **Implement VLAN Access Control Lists (VACLs):** VACLs can be used to filter traffic at the VLAN level, preventing unauthorized traffic from entering or leaving a VLAN.
-
-- **Enable 802.1Q Native VLAN Tagging:** By enabling native VLAN tagging and assigning a unique, unused VLAN ID as the native VLAN, you can prevent double tagging attacks.
-
-Remember that implementing these security practices is crucial in protecting your network from VLAN hopping and other types of network-based attacks. Always stay vigilant and keep your network's security protocols up-to-date to minimize the chances of a successful cyber attack.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/common-network-based-attacks/108-rogue-access-point.md

@@ -1,29 +0,0 @@
-# Rogue Access Point
-
-A **Rogue Access Point (RAP)** is an unauthorized wireless access point that is installed or connected to a network without the network administrator's consent. These access points can be set up by attackers to exploit security vulnerabilities within the network or by employees for personal usage. RAPs can lead to several network-based attacks, causing severe damage to an organization's security.
-
-## Risks Associated with Rogue Access Points
-
-- **Unauthorized Access**: Attackers can use RAPs to gain unauthorized access to a victim's sensitive data.
-
-- **Man-in-the-Middle Attacks**: Cybercriminals can intercept or alter the communication between two parties using RAPs, performing a Man-in-the-Middle attack.
-
-- **Information Theft**: By monitoring the traffic passing through a RAP, attackers can steal sensitive information such as usernames, passwords, and credit card information.
-
-- **Network Vulnerabilities**: RAPs can create new security holes because they often bypass security measures such as firewalls, intrusion detection systems, and VPNs.
-
-## Detecting and Preventing Rogue Access Points
-
-Here are some measures to help detect and prevent rogue access points:
-
-- **Wireless Intrusion Detection Systems (WIDS)**: WIDS helps identify and locate unauthorized access points, clients and ad-hoc connections in an organization's wireless network.
-
-- **Regular Network Scans**: Perform regular network scans to detect any unauthorized devices connected to the network.
-
-- **Network Access Control (NAC)**: Implement Network Access Control to restrict unauthorized devices from accessing the internal network.
-
-- **Encryption and Authentication**: Apply strong encryption and authentication protocols such as WPA3, to reduce the chances of unauthorized devices connecting to the network.
-
-- **User Awareness**: Educate employees about the risks associated with rogue access points and how to avoid unintentionally installing them.
-
-By staying vigilant and implementing robust security measures, organizations can reduce the risks associated with rogue access points and protect their networks from potential cyberattacks.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/common-network-based-attacks/109-war-driving-dialing.md

@@ -1,35 +0,0 @@
-# War-driving/dialing
-
-## War Driving
-
-War driving is a technique in which an attacker physically drives around attempting to discover open or poorly secured wireless networks. This practice allows the attacker to exploit network vulnerabilities and gain unauthorized access to sensitive information. The goal of war driving is to identify targets, typically homes, offices, or businesses, with WLANs.
-
-## Key elements of War Driving
-
-- **Detection**: War driving begins with the detection of nearby wireless access points using laptops, mobile devices, or any device with WiFi scanning capabilities.
-- **Mapping**: After detecting the wireless signals, the attacker maps them using GPS or other location-based services.
-- **Analysis**: Once the target is identified, the attacker analyzes the network security to find the weakness and vulnerabilities.
-- **Exploitation**: Finally, the attacker exploits the discovered vulnerabilities to gain unauthorized access to the network.
-
-## War Dialing
-
-War dialing is a similar attack method but involves calling numerous phone lines in search of modems and fax machines. War dialing allows the attacker to identify insecure phone lines and unauthorized access points.
-
-## Key elements of War Dialing
-
-- **Detection**: War dialing starts by automating the process of calling a range of phone numbers using software, searching for modem or fax machine-tones.
-- **Mapping**: The attacker collects the list of phone numbers that responded with an appropriate connection tone.
-- **Analysis**: The attacker will analyze the phone lines to assess their security and vulnerabilities.
-- **Exploitation**: The attacker exploits the discovered vulnerabilities to gain unauthorized access to the systems connected to the modems or fax machines.
-
-## Prevention Strategies
-
-To protect your network against war driving or war dialing, it's important to:
-
-- Implement strong security measures such as WPA3 or WPA2-Enterprise for WiFi networks.
-- Employ proper firewall configurations.
-- Disable broadcasting your SSID (network name) to make your WiFi network invisible to casual passersby.
-- Use strong authentication methods for remote access systems.
-- Regularly update your network devices with the latest security patches.
-- Periodically conduct vulnerability assessments to stay ahead of potential weaknesses.
-- Educate employees and users about the risks of unsecured networks and the importance of following security guidelines.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/common-network-based-attacks/index.md

@@ -1 +0,0 @@
-# Common network based attacks

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/common-standards/index.md

@@ -1 +0,0 @@
-# Common standards

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/find-and-use-logs/100-event-logs.md

@@ -1,43 +0,0 @@
-# Event Logs
-
-Event logs are essential components of cyber security, as they provide a detailed record of activities within a computer system or network. These logs are generated by the operating system, applications, and security devices, offering important information that can help administrators identify vulnerabilities, improve security measures, and detect potential threats.
-
-## Key components of event logs
-
-Event logs typically consist of the following components:
-
-- **Timestamp**: The date and time when the event occurred. This information helps in correlating events and identifying patterns.
-- **Event ID**: A unique identifier for the event, typically assigned by the generating system.
-- **Source**: The application or service that generated the event. This can be an operating system, security software, or a third-party application.
-- **User**: The user account associated with the event, if applicable.
-- **Description**: A detailed message about the event, which may include the reason for the activity, its outcome, and any relevant data.
-
-## Types of event logs
-
-Event logs can be broadly categorized into the following types:
-
-- **System logs**: These logs contain events related to the operating system and its components. For example, system startup and shutdown events, driver load failures, and hardware issues.
-
-- **Application logs**: These logs contain events generated by installed applications. Application logs can provide insight into the functioning of specific programs, helping identify potential security risks or malfunctions.
-
-- **Security logs**: These logs include events generated by security-related components such as firewalls, antivirus software, and intrusion detection systems. Security logs are particularly useful for identifying unauthorized access attempts, policy violations, and other threats to your system.
-
-## How to access and analyze event logs
-
-Depending on your operating system, there are various tools and methods for accessing and analyzing event logs. Here are some common ways to do it:
-
-- **Windows**: The built-in "Event Viewer" tool allows you to view and analyze logs in a graphical interface. To access Event Viewer, simply type "eventvwr.msc" into the Run dialog or search for "Event Viewer" in the Start menu.
-
-- **macOS**: The "Console" application provides access to macOS event logs. To find Console, search for it using Spotlight, or navigate to the "Applications" > "Utilities" folder and open Console from there.
-
-- **Linux**: There are numerous tools and methods to examine event logs in Linux, with the primary log files typically stored under the `/var/log/` directory. The `dmesg`, `journalctl`, and `tail` commands are some common ways to view log data in the command-line interface.
-
-## Best practices for managing event logs
-
-To ensure optimal use of event logs in your cybersecurity efforts, consider implementing the following best practices:
-
-- **Monitor logs regularly**: Review event logs frequently to catch potential security issues and address them in a timely manner.
-- **Configure log rotation**: Limit the size and age of log files to prevent the system from running out of storage space and ensure that older events are archived for easy retrieval.
-- **Implement centralized logging**: For more complex environments, use a centralized log management system that aggregates logs from multiple sources, facilitating easier analysis and correlation of events across the entire network.
-- **Protect sensitive log information**: Ensure access to log files is restricted to authorized personnel and that log data is encrypted as necessary to prevent unauthorized access and tampering.
-- **Stay informed about common log entries**: Understand the common log entries for your operating system, applications, and security software to quickly identify unusual or suspicious activities in your logs.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/find-and-use-logs/101-syslogs.md

@@ -1,28 +0,0 @@
-# syslogs
-
-Syslogs, short for System Logs, are essential components in the world of cybersecurity as they represent a consolidated logging system that operates on a central server. It collects and stores log messages from various devices and applications within an organization's network. Syslogs provide insights into system events, errors, and activities occurring within the network, enabling administrators and security teams to monitor and analyze the data.
-
-## Benefits of Syslogs
-
-- Centralized Logging: Syslogs are centralized repositories for log data, making it easier to monitor multiple devices and applications from a single location.
-- Troubleshooting & Analysis: The data from syslogs can be used to troubleshoot issues or discover potential security breaches, allowing for a faster resolution and improved overall network security.
-- Regulatory Compliance: Syslogs can help organizations meet industry-specific standards and guidelines by keeping a record of system events and data.
-- Efficient Storage: Centralized storage allows for efficient data management, reducing the need for manual log management across different devices.
-
-## Types of Syslog Messages
-
-Syslog messages can be categorized into three parts:
-
-- **Facility**: The source of the log entry, usually a system process, daemon or application.
-- **Severity**: A numeric code that denotes the level of urgency of the logged event or message (0-7) where 0 is the highest (most urgent) and 7 is the lowest (least urgent).
-- **Message**: The actual descriptive text of the log entry.
-
-## Syslog Configuration
-
-Setting up a syslog server usually involves installing a syslog daemon, configuring it to listen for incoming log messages, and defining the log storage location. Popular syslog server software includes `rsyslog`, `syslog-ng`, and `Windows Event Collector`. Configuring syslog clients is done by specifying the IP address or hostname of the syslog server and the protocol used for communication. Once the setup is complete, the syslog server will begin receiving and storing log messages from the configured clients.
-
-## Analyzing Syslog Data
-
-Syslog data analysis can be complicated due to the volume and variety of log messages. However, various log analysis tools, such as Graylog, Logstash, and Splunk, simplify this process by providing features like data visualization, filtering, and alerting. These syslog analysis tools extract valuable information from raw log data and help identify patterns, trends, and potential threats.
-
-In conclusion, syslogs are a powerful resource for monitoring, troubleshooting, and securing your organization's network. By utilizing syslog servers and analysis tools, security teams can gather and analyze valuable data to maintain compliance and ensure the overall health of their network.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/find-and-use-logs/102-netflow.md

@@ -1,26 +0,0 @@
-# netflow
-
-NetFlow is a network protocol developed by Cisco that collects and monitors network traffic flow data. It provides valuable information about network usage, performance, and potential security threats, which can be helpful in cyber security analysis and incident response.
-
-## How NetFlow Works
-
-NetFlow-enabled devices (such as routers, switches, and firewalls) analyze the IP packets passing through them and generate flow records. A flow record is a set of key field values that characterize the traffic flow, including source and destination IP addresses, source and destination ports, protocol type, and more. These flow records are then periodically exported to a NetFlow collector, which aggregates, analyzes, and stores the data for further processing.
-
-## Benefits of Using NetFlow Data for Cyber Security
-
-- **Visibility**: NetFlow data provides greater visibility into your network traffic, allowing you to monitor who is accessing your network, what resources they are using, and when they are doing so.
-- **Threat Detection**: By analyzing NetFlow data, you can uncover anomalous behaviors, detect security incidents, and identify potential insider threats.
-- **Forensics**: NetFlow logs can serve as evidence for forensic investigations when a security breach occurs.
-- **Optimization**: Analyzing NetFlow data can help optimize network performance by identifying bandwidth hogs, misconfigurations, or bottlenecks.
-- **Compliance**: NetFlow data can be used to demonstrate compliance with regulatory requirements or internal policies by proving that specific controls are in place.
-
-## How to Get Started with NetFlow
-
-To implement NetFlow in your organization, you need to follow these steps:
-
-- **Enable NetFlow**: Configure NetFlow on your routers, switches, and firewalls. Most vendors support NetFlow or an equivalent flow-based protocol.
-- **Set up a NetFlow Collector**: Deploy a NetFlow collector server that receives, aggregates, and stores the exported flow records. There are both open-source (such as ntopng, Flowalyzer) and commercial solutions (such as SolarWinds, Plixer) available.
-- **Analyze and Monitor**: Use a NetFlow analysis tool or platform to filter, visualize, and explore your network traffic data. This can be the same tool as your NetFlow collector, or a separate solution that integrates with it.
-- **Integrate with Other Security Tools**: Enhance your security posture by correlating NetFlow data with other security tools such as intrusion detection systems, security information, and event management (SIEM), threat intelligence, and more.
-
-By incorporating NetFlow into your cyber security strategy, you can greatly improve your network visibility, threat detection capabilities, and overall security posture.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/find-and-use-logs/103-packet-captures.md

@@ -1,42 +0,0 @@
-# Packet Captures
-
-Packet captures, also known as _pcaps_, refer to the interception and logging of network traffic. In a cybersecurity context, analyzing packet captures can provide valuable insight into network activity, potential threats, and vulnerabilities. This section will introduce you to the essentials of packet captures and introduce some popular tools used for capturing and analyzing network traffic.
-
-## Why are Packet Captures Important?
-
-Analyzing packet captures allows cybersecurity professionals to:
-
-- Monitor network activity for unusual or malicious behavior
-- Inspect and debug network performance issues
-- Investigate security incidents by tracing malicious activity
-- Ensure compliance with regulations by tracking sensitive data movement
-
-Being able to effectively analyze packet captures is a critical skill for anyone involved in network monitoring or incident response.
-
-## Common Packet Capture Tools
-
-There are several widely used packet capture tools worth familiarizing yourself with:
-
-- **Wireshark**: A popular, open-source network protocol analyzer that allows you to capture and interactively analyze network traffic. Wireshark supports filtering, decryption, and flexible analysis options.
-
-- **Tcpdump**: A powerful command-line tool for capturing network traffic. Tcpdump is lightweight, versatile, and compatible with most Unix-based operating systems.
-
-- **Tshark**: A command-line version of Wireshark, providing many of its powerful features in a lightweight and scriptable tool.
-
-- **Nmap**: A flexible network discovery and security auditing tool. Not only can Nmap perform packet captures, but also host and port scanning, OS and service detection, and vulnerability assessments.
-
-## Tips for Analyzing Packet Captures
-
-When working with packet captures, consider the following best practices:
-
-- **Filtering**: Use capture filters to narrow down the displayed traffic based on specific criteria, such as IP addresses, protocols, or ports. This will enable you to focus on relevant data and reduce information overload.
-
-- **Organizing**: Maintain an organized folder structure and clear naming conventions for your pcap files. This simplifies the retrieval and analysis of historical data during investigations.
-
-- **Decryption**: Encrypted network traffic might hinder your analysis. Understanding how to decrypt protocols such as SSL/TLS or WPA/WPA2 will enable you to examine packet contents in detail.
-
-- **Correlation**: Combine packet capture analysis with other sources of information, such as logs, alerts, or threat intelligence, to obtain a comprehensive view of network activity.
-
-## Conclusion
-
-Packet captures are a vital component of cybersecurity, allowing professionals to monitor, detect, and respond to potential threats in a timely and effective manner. By understanding the various tools and techniques related to packet captures, you'll be well-equipped to take on this crucial aspect of your cybersecurity responsibilities.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/find-and-use-logs/104-firewall-logs.md

@@ -1,43 +0,0 @@
-# Firewall Logs
-
-Firewall logs are records of events generated by a network or computer firewall, which plays a critical role in maintaining the security of your systems. These logs provide valuable insights into the traffic entering and leaving your network, allowing you to monitor and analyze potential threats, detect security breaches, and maintain compliance with various security standards.
-
-Below are the key components of firewall logs you should be familiar with:
-
-## Types of Firewall Logs
-
-There are two main types of firewall logs:
-
-- **Traffic logs:** These logs provide information about allowed and blocked connections, including details like the source and destination IP addresses, ports, protocols, and packet sizes.
-
-- **Event logs:** These logs provide information on the general activities of the firewall, such as system events (startup, shutdown, and configuration changes) and security incidents (attempted attacks, suspicious activity, etc.).
-
-## Importance of Firewall Logs
-
-Firewall logs are essential for a variety of reasons:
-
-- **Security incident detection and response:** Firewall logs help you identify security breaches and quickly respond to potential threats by providing real-time and historical data on connections.
-
-- **Network troubleshooting:** Firewall logs can help network administrators diagnose and troubleshoot network issues by providing insights into blocked connections, resource usage, and other network activities.
-
-- **Compliance and audits:** Many security standards and regulatory frameworks, such as GDPR, HIPAA, and PCI DSS, require organizations to maintain robust log management practices. Firewall logs are crucial components of your overall security logging strategy.
-
-- **Forensic analysis:** Firewall logs can be used during investigations to understand the timeline, source, and scope of a security incident, enabling organizations to enhance their security measures.
-
-- **Optimizing firewall configurations and rules:** By monitoring and analyzing firewall logs on an ongoing basis, you can fine-tune your firewall's rules and settings to ensure optimal network performance and security.
-
-## Analyzing Firewall Logs
-
-To effectively use firewall logs, it's crucial to establish a consistent and effective log analysis process. Here are some steps you can follow:
-
-- **Collect and aggregate logs:** Ensure logs from all your firewalls across the network are collected in a centralized location. This can be done using log management tools, SIEM solutions, or custom scripts.
-
-- **Monitor in real time:** Leverage realtime monitoring tools to quickly detect security incidents or suspicious activities and act promptly when required.
-
-- **Set alerts and notifications:** Create alerts and notifications for specific events in your firewall logs (e.g., repeated failed login attempts). This will help you to stay on top of potential security threats.
-
-- **Perform periodic audits and reviews:** Regularly review your firewall logs to ensure your network remains secure and identify any configuration changes or optimizations needed.
-
-- **Retain logs per compliance requirements:** Ensure you store and retain your firewall logs as per your organization's data retention policies and legal regulations.
-
-By effectively implementing firewall log management, you can greatly enhance your organization's cybersecurity posture and be better prepared to respond to potential threats.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/find-and-use-logs/index.md

@@ -1 +0,0 @@
-# Find and use logs

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/incident-response-and-discovery-tools/108-arp.md

@@ -1,36 +0,0 @@
-# arp
-
-ARP (Address Resolution Protocol) is a crucial part of network communication which enables devices to discover and map IP addresses to their corresponding MAC addresses. This protocol is particularly important in cyber security as it helps us understand the devices on a network, and can sometimes be exploited by attackers to perform various network level attacks.
-
-## How ARP Works
-
-In a typical network, devices communicate using their IP addresses. However, the actual communication between devices is facilitated by their MAC (Media Access Control) addresses. ARP is responsible for resolving IP addresses to MAC addresses. Here's a simple example to help illustrate this process:
-
-- Device A wants to communicate with Device B.
-- Device A knows Device B's IP address but not its MAC address.
-- Device A broadcasts an ARP request on the network, asking "Who has this IP address? Please tell me your MAC address."
-- When Device B receives the request and recognizes its own IP address, it sends an ARP reply to Device A, containing its MAC address.
-- Device A can now use the MAC address to communicate directly with Device B.
-
-## Security Concerns
-
-While ARP is essential to the proper functioning of a network, it also introduces certain security risks. The primary reason for this vulnerability is that ARP is trust-based and does not have built-in authentication. This creates an opportunity for attackers to exploit the system using techniques such as:
-
-## ARP Spoofing/Poisoning
-
-ARP spoofing is an attack in which an attacker sends fake ARP messages to a network, causing the devices to associate the attacker's MAC address with an IP address that legitimately belongs to another device. This allows the attacker to intercept, modify, or manipulate the traffic between the target devices, potentially resulting in a man-in-the-middle (MITM) attack or denial of service (DoS).
-
-## ARP Cache Poisoning
-
-Similar to ARP spoofing, ARP cache poisoning is the process of injecting dishonest entries into an ARP cache. This can cause devices to send sensitive information to unintended recipients or facilitate attacks like MITM or DoS.
-
-## ARP in Incident Response and Discovery Tools
-
-To counter ARP-based attacks and ensure secure communication within a network, various incident response and discovery tools can be utilized, some of which include:
-
-- **ARP monitoring tools**: These tools monitor ARP activity to detect potential anomalies, such as multiple ARP replies from a single IP address, which could signify an ARP spoofing attack.
-- **Static ARP entries**: Configuring static ARP entries on a device eliminates the need for dynamic ARP resolution and minimizes the risk of ARP cache poisoning.
-- **Network traffic analyzers**: Network traffic analysis tools, like Wireshark, can help spot suspicious ARP activity and reveal inconsistencies in ARP messages.
-- **Intrusion Detection Systems (IDSs)**: These systems monitor network traffic for spotting potential security threats, including ARP-based attacks.
-
-In conclusion, understanding the ARP protocol and its potential security risks is crucial for maintaining a secure network environment. By utilizing incident response and discovery tools, it is possible to detect, prevent, and mitigate ARP-based attacks, ensuring a safer network for all connected devices.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/incident-response-and-discovery-tools/112-tail.md

@@ -1,74 +0,0 @@
-# tail
-
-## Overview
-
-`tail` is a command-line utility that allows you to display the last part of files. It is a highly versatile tool, commonly used in system administration and cybersecurity to monitor log files, trace errors, and observe real-time system activities. This utility is available by default on most Unix-based operating systems, such as Linux and macOS.
-
-## Usage
-
-The basic syntax for the `tail` command is:
-
-```bash
-tail [options] [file_name]
-```
-
-- `options`: Flags that modify the behavior of the command.
-- `file_name`: The name of the file you want to display.
-
-Some common options in `tail` include:
-
-- `-n [lines]`: Output the last `[lines]` lines, instead of the default last 10 lines.
-- `-f`: Follow the file as it grows, displaying new content in real time.
-- `-F`: Similar to `-f`, but also tries to keep the file open if it's removed, can't be accessed or replaced
-- `-q`: Quiet mode - never output headers with file names
-- `-s [seconds]`: Sleep for approximately `[seconds]` between iterations. This is applicable with `-f` flag.
-
-## Examples
-
-- Display the last 10 lines of a file:
-
-```bash
-tail file_name
-```
-
-- Display the last 50 lines of a file:
-
-```bash
-tail -n 50 file_name
-```
-
-- Monitor a log file in real time:
-
-```bash
-tail -f log_file
-```
-
-- Monitor multiple log files in real time:
-
-```bash
-tail -f log_file1 log_file2 log_file3
-```
-
-## Use Cases in Cyber Security
-
-`tail` is often used by cybersecurity professionals to analyze log files, trace errors, and monitor system activities. Some common use cases include:
-
-- Identifying unauthorized access attempts by monitoring the contents of the `/var/log/auth.log` file in real time:
-
-```bash
-tail -f /var/log/auth.log
-```
-
-- Analyzing the most recent entries in a web server log file to identify unusual requests or suspicious activities:
-
-```bash
-tail -n 50 /var/log/apache2/access.log
-```
-
-- Monitoring system log files to quickly identify and respond to security incidents or anomalies:
-
-```bash
-tail -f /var/log/syslog
-```
-
-In summary, `tail` is a powerful and versatile command-line utility that proves to be an invaluable resource for system administrators and cybersecurity professionals, providing real-time monitoring and analysis of log files and system activities.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/incident-response-and-discovery-tools/index.md

@@ -1 +0,0 @@
-# Incident response and discovery tools

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/other-attacks/100-buffer-overflow.md

@@ -1,33 +0,0 @@
-# Buffer Overflow
-
-A buffer overflow is a common type of cybersecurity vulnerability that occurs when a program writes or reads more data than the fixed-size buffer can hold, resulting in the data to overwrite other data in memory. The overflow can cause data corruption and lead to unexpected behavior, such as application crashes or even the execution of malicious code.
-
-## Causes of Buffer Overflow
-
-Buffer overflow vulnerabilities are usually caused by:
-
-- Insufficient input validation: The program doesn't properly validate the length of the input before writing it into the buffer.
-- Off-by-one errors: The code uses an incorrect boundary condition, leading to one extra byte being written outside the buffer.
-- Integer overflows: The buffer size is calculated using an integer variable that is too small to represent the required size.
-
-## Exploitation
-
-Attackers can exploit buffer overflow vulnerabilities to:
-
-- Crash the application, causing a denial of service (DoS).
-- Overwrite critical data or control structures, causing the application to behave unexpectedly.
-- Inject and execute malicious code, compromising the security of the system.
-
-## Prevention Techniques
-
-To prevent and mitigate buffer overflow vulnerabilities, the following strategies can be employed:
-
-- Perform thorough input validation and sanitize all inputs to the program.
-- Use safe APIs and libraries that check the size of the data before copying it into the buffer.
-- Apply proper boundary checks and use modern programming languages with memory protection features.
-- Enable compiler protections such as stack canaries and address space layout randomization (ASLR).
-- Regularly scan code for vulnerabilities and conduct security audits.
-
-By being aware of buffer overflow vulnerabilities and implementing these preventive strategies, you can protect your software from potential attacks and keep your systems secure.
-
-- [@article@Buffer Overflows (Hacksplaining)](https://www.hacksplaining.com/exercises/buffer-overflows)

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/other-attacks/101-memory-leak.md

@@ -1,37 +0,0 @@
-# Memory Leak
-
-A **memory leak** occurs when a program or application allocates memory but fails to release it back to the system when it is no longer needed. This can lead to an accumulation of memory resources that are not in use, ultimately causing a system's performance to degrade or even crash as the available memory resources become exhausted.
-
-## Causes of Memory Leaks
-
-Memory leaks can occur due to various reasons such as:
-
-- **Programming Errors**: Memory leaks mainly result from errors in the program's source code, such as improper handling or deallocation of memory resources.
-- **Library or Framework Bugs**: Sometimes, the libraries or frameworks used by an application may contain memory leaks within their implementation.
-- **Operating System or Hardware Bugs**: Certain bugs in the operating system or hardware may also cause memory leaks.
-
-## Effects of Memory Leaks
-
-Memory leaks can have several negative consequences on system performance and stability, including:
-
-- **Performance Degradation**: As the system runs out of available memory, it may become slow and unresponsive, leading to a poor user experience.
-- **System Crashes**: In extreme situations, a memory leak may cause the system to run out of memory altogether, forcing it to crash or reboot.
-- **Resource Exhaustion**: Applications suffering from memory leaks may lead to a gradual depletion of system resources, which can then impact the performance of other applications running on the same system.
-
-## Detecting Memory Leaks
-
-There are several techniques to detect memory leaks:
-
-- **Static Code Analysis**: This method involves analyzing the source code of an application to identify any potential memory leak issues.
-- **Runtime Analysis**: Runtime analysis tools, also known as memory profilers, can monitor an application's memory usage during execution and identify leaks in real-time.
-- **Testing & Monitoring**: Rigorous testing and continuous monitoring of applications can help detect memory leaks as well as performance issues due to resource contention or exhaustion.
-
-## Preventing Memory Leaks
-
-To mitigate the risk of memory leaks:
-
-- **Follow Best Practices**: By following coding best practices and guidelines, developers can minimize the occurrence of memory leaks in their applications.
-- **Code Reviews**: Regularly reviewing the code for potential memory management issues can help identify and fix memory leaks early in the development process.
-- **Utilize Garbage Collection**: Choosing programming languages or frameworks that support automatic garbage collection can help manage memory resources more effectively and prevent memory leaks.
-
-Always remember, addressing memory leaks promptly is crucial in maintaining a secure and efficient computing environment.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/other-attacks/102-xss.md

@@ -1,27 +0,0 @@
-# XSS
-
-Cross-site scripting (XSS) is a type of cybersecurity vulnerability commonly found in web applications. It occurs when an attacker injects malicious scripts into webpages viewed by other users. These scripts can be used to steal sensitive information, such as user credentials or sensitive data. XSS vulnerabilities can lead to various consequences, like account takeover, phishing attacks, and other malicious activities.
-
-There are three main types of XSS attacks:
-
-- **Stored XSS Attacks**: In this type, the malicious script is stored on the web server, typically through user input fields like comments or posts. When other users visit the affected page, their browsers will execute the malicious script.
-
-- **Reflected XSS Attacks**: Here, the attacker sends a malicious URL containing the script to unsuspecting users. When they click the link, their browsers execute the malicious script, which can steal sensitive information or perform unauthorized actions.
-
-- **DOM-based XSS Attacks**: In these cases, the attacker manipulates the Document Object Model (DOM) of a webpage in the user's browser, causing the malicious script to be executed. This method does not involve direct interaction with the webserver.
-
-## Preventing XSS Attacks
-
-To protect your web applications from XSS attacks, consider implementing the following best practices:
-
-- **Input Validation**: Validate and sanitize user inputs to ensure that they only contain acceptable data. Reject any inputs that contain malicious codes or unexpected characters.
-
-- **Output Encoding**: Encode your application's outputs properly, so special characters are displayed in a way that prevents script execution.
-
-- **Content Security Policy (CSP)**: Implement a strict CSP, which serves as a layer of defense against XSS by specifying the sources of allowed scripts and other file types that can be executed by the browser.
-
-- **Secure HTTP Headers**: Set secure values for HTTP headers, such as X-XSS-Protection, X-Content-Type-Options, X-Frame-Options, and X-Content-Security-Policy, to prevent common XSS attack vectors.
-
-- **Regular Security Testing**: Perform regular security audits and penetration tests to identify and fix any vulnerabilities in your web applications.
-
-Remember, XSS vulnerabilities pose a significant risk to user privacy and web application security. By following these best practices, you can build a robust defense against cross-site scripting attacks and keep your users' sensitive data protected.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/other-attacks/103-sql-injection.md

@@ -1,41 +0,0 @@
-# SQL Injection
-
-SQL Injection is a type of cyber attack that targets web applications and databases. This technique takes advantage of vulnerabilities in the application's code by injecting malicious SQL statements and exploiting them to gain unauthorized access or to manipulate the data in a database. Attackers can potentially use this technique to retrieve, modify, delete, or even add data to the database without proper authorization.
-
-## How SQL Injection Works
-
-SQL Injection works by identifying input fields in a web application, such as text boxes or URL parameters, and testing whether these fields are vulnerable to SQL code injection. When an attacker identifies a vulnerable input field, they inject SQL code to manipulate the underlying SQL query or to execute additional queries on the database.
-
-For example, consider a web application that allows users to log in by providing a username and password. The application might use the following SQL query to authenticate the user:
-
-```sql
-SELECT * FROM users WHERE username = '$username' AND password = '$password'
-```
-
-In this case, `$username` and `$password` are replaced with the values provided by the user. If an attacker enters the following input for the username field, they can manipulate the query to bypass the password check:
-
-```
-' OR 1=1 --
-```
-
-The resulting query would look like:
-
-```sql
-SELECT * FROM users WHERE username = '' OR 1=1 -- ' AND password = '$password'
-```
-
-As `1=1` is always true, the query returns a result, and the attacker gains unauthorized access.
-
-## Preventing SQL Injection Attacks
-
-To protect your web applications from SQL Injection attacks, you should:
-
-- **Use Parameterized Queries and Prepared Statements**: These techniques separate user input from the SQL query, making it harder for an attacker to inject malicious code. Most modern web development frameworks and database libraries support parameterized queries and prepared statements.
-
-- **Validate User Input**: Always validate and sanitize user input before incorporating it into a SQL query. Use strict data types and validate input against predefined patterns or value ranges.
-
-- **Limit Database Permissions**: Limit the privileges of the database accounts used by your web applications. This confines the potential damage if an attacker manages to perform an SQL injection attack.
-
-- **Keep Software Up-to-Date**: Regularly update your web application software and database management systems to ensure that you are protected against known vulnerabilities.
-
-By understanding SQL Injection attacks and employing the best practices to prevent them, you can safeguard your web applications and secure your sensitive data from malicious actors.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/other-attacks/104-csrf.md

@@ -1,32 +0,0 @@
-# CSRF
-
-Cross-Site Request Forgery, or CSRF, is a type of attack that exploits the trust that a user's browser has in a web application. It tricks the user's browser into executing unwanted actions on a web application in which the user is currently authenticated.
-
-## How CSRF Works
-
-- A user logs into a vulnerable web application.
-- The web application returns a cookie to the user's browser, indicating that the user is authenticated.
-- The attacker creates a malicious link or embeds malicious HTML/JavaScript code on another website.
-- The user, while still authenticated to the web application, visits the attacker's website, which triggers the malicious code.
-- The attacker's code sends a request to the targeted web application, leveraging the user's authenticated cookie.
-- The vulnerable web application performs the malicious action as if the request came from the user.
-
-## Impact of CSRF Attacks
-
-CSRF attacks can result in unauthorized actions being performed on a user's behalf, often without the user's knowledge. Consequences might include unauthorized:
-
-- Data modifications
-- Privilege escalation
-- Account takeovers
-
-## Prevention Measures
-
-Here are some techniques to help prevent CSRF attacks:
-
-- **Use CSRF Tokens:** Implement a unique, unpredictable token in each sensitive request (e.g., form submissions) to ensure that the request originates from the same domain.
-- **Double-submit Cookies:** Generate a unique token for each session and include it as a hidden value in forms, then validate it against the corresponding session cookie.
-- **SameSite Cookies:** Use the `SameSite` attribute in cookies to instruct the browser to only send the cookie when the request originates from the same domain.
-- **Content Security Policy (CSP):** Implement a CSP header to mitigate cross-site scripting, which can be a vector for CSRF attacks.
-- **Restrict CORS:** Limit Cross-Origin Resource Sharing (CORS) to trusted domains to prevent unauthorized communication between different origins.
-
-By understanding and applying these preventive measures, the risk of CSRF attacks can be significantly reduced, enhancing the overall safety and security of web applications.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/other-attacks/105-replay-attack.md

@@ -1,31 +0,0 @@
-# Replay Attack
-
-A **Replay Attack** is a malicious action where an attacker intercepts data transmitted between two parties, records the data, and retransmits it at a later time to create unauthorized access or gain some benefit. This type of attack happens when the data sent by the original sender is not altered in any way but simply replayed, making the system think that it is receiving a legitimate request.
-
-## How Does a Replay Attack Work?
-
-Replay attacks work by the following process:
-
-- The attacker intercepts communication between two parties (e.g., a user authenticating with a server).
-- The attacker records the intercepted data, such as login credentials or session tokens.
-- The attacker retransmits the recorded data to the target system at a later time, fooling the system into thinking that it is a legitimate request from the original sender.
-
-## Risks and Consequences
-
-Some potential risks and consequences of replay attacks include:
-
-- Unauthorized access: An attacker can gain access to the target system using replayed credentials or session tokens.
-- Data theft: The attacker may steal sensitive data by impersonating a legitimate user.
-- Financial fraud: In the case of online transactions, an attacker could potentially replay a transaction, causing the victim to pay for the same item or service multiple times.
-
-## Prevention Techniques
-
-To prevent replay attacks, consider the following measures:
-
-- **Timestamps**: Include a timestamp in the data being transmitted, and have the receiving system verify that it is receiving the request within a pre-determined time window.
-- **Nonces**: Use a unique, one-time number (nonce) in each transmitted message. The receiving party should check for duplicate nonces to ensure that the message has not been replayed.
-- **Session management**: Implement proper session management policies, such as setting timeouts and regularly renewing session tokens.
-- **Encryption**: Use strong, end-to-end encryption for data being transmitted between parties. This prevents an attacker from intercepting and reading the data.
-- **Message authentication**: Implement message authentication mechanisms, such as digital signatures or Message Authentication Codes (MAC), to ensure the integrity of the transmitted data.
-
-Understanding and implementing these prevention techniques will help alleviate the risks associated with replay attacks and enhance the overall security of your system.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/other-attacks/106-pass-the-hash.md

@@ -1,24 +0,0 @@
-# Pass the Hash
-
-Pass the hash (PtH) is a type of cyber attack that enables an attacker to authenticate to remote systems by using the underlying NTLM or LanMan hash of a user's password, rather than requiring the plaintext password itself. This type of attack exploits the fact that a password hash can be used for authentication instead of the actual password, giving an attacker access to a user's account without the need to crack the password itself.
-
-## How does Pass the Hash work?
-
-- **Initial compromise**: The attacker first compromises a single workstation or user account on the target network. This can be done via social engineering, phishing, exploiting software vulnerabilities, or other methods.
-
-- **Hash extraction**: Once the attacker gains access to the compromised system, they are able to extract the password hashes of users stored in the system. Tools like Mimikatz, Windows Credential Editor, or PowerShell scripts can be used to obtain these hashes.
-
-- **Lateral movement**: The attacker then leverages the extracted password hashes to access other systems and services within the network. This is done by using the PtH technique to bypass authentication mechanisms and impersonate legitimate users. The attacker continues to search for and collect additional password hashes, looking for privileged account hashes that can grant them further access.
-
-- **Privilege escalation**: The attacker uses the stolen privileged account hashes to gain increased permissions on the network. This can lead to the attacker gaining control over critical systems, allowing them to exfiltrate sensitive data or even create backdoors for future attacks.
-
-## Mitigation Strategies
-
-To defend against pass the hash attacks, organizations should implement a combination of the following measures:
-
-- **Network segmentation**: Divide the network into separate segments, restricting access to sensitive systems and limiting unauthorized lateral movement.
-- **Multi-factor authentication (MFA)**: Implement MFA for user accounts, particularly for administrator accounts, to make it more difficult for an attacker to authenticate using stolen hashes.
-- **Strong password policies**: Enforce strong, unique passwords to make it harder for attackers to crack hashes or gain unauthorized access.
-- **Least privilege principle**: Limit user account privileges and ensure that users only have the permissions necessary for their job roles.
-- **Credential Guard**: Use Windows Credential Guard or similar security features on supported operating systems to protect stored credentials and limit the risk of hash extraction.
-- **Regular monitoring and auditing**: Continuously monitor and audit user activities, access logs, and system security to detect and prevent unauthorized access or suspicious activity.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/other-attacks/107-directory-traversal.md

@@ -1,35 +0,0 @@
-# Directory Traversal
-
-Directory traversal, also known as path traversal, is a type of cyber attack that allows an attacker to access restricted files and directories on a server, usually with the goal of obtaining sensitive information. This vulnerability occurs when user input is not adequately validated and the attacker can manipulate it to traverse the server directory structure.
-
-## How it Works
-
-In a directory traversal attack, the attacker attempts to exploit an input field (e.g., a file or image upload form, URL parameters, etc.) that takes a file path as input. By supplying specially crafted input, an attacker can manipulate the server into providing access to unauthorized files and directories.
-
-For example, consider a web application that allows users to view the contents of a specific file by specifying its path through a URL parameter, such as:
-
-```
-https://www.example.com/file.php?path=/user/documents/report.pdf
-```
-
-In this case, an attacker could manipulate the `path` parameter to traverse the server's directories, like this:
-
-```
-https://www.example.com/file.php?path=../../../../etc/passwd
-```
-
-If the server doesn't properly validate and sanitize the input, it might reveal the contents of the `/etc/passwd` file, which contains sensitive information about system users.
-
-## Mitigation Techniques
-
-There are several methods to prevent directory traversal attacks:
-
-- **Input Validation:** Ensure that user input is strictly validated and sanitized. For example, one can check for the presence of special characters (e.g., '..', '/', '\'), disallowing them if found.
-
-- **Access Control:** Implement proper access control mechanisms to prevent unauthorized access to files and directories. For example, use a whitelist approach to establish which files and directories the user is allowed to access.
-
-- **Least Privilege:** Practice the principle of least privilege by ensuring that an application runs with only the necessary permissions needed for its operation. This can minimize the potential impact of a directory traversal attack.
-
-- **Use Chroot Jails:** Deploy applications inside chroot jails to restrict access to a certain directory, thwarting attempts to traverse outside that directory.
-
-By implementing these countermeasures, you can minimize the risk of directory traversal attacks and help protect your system's critical files and directories.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/other-attacks/index.md

@@ -1 +0,0 @@
-# Other attacks

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/secure-vs-unsecure-protocols/100-ftp-vs-sftp.md

@@ -1,37 +0,0 @@
-# FTP vs SFTP
-
-## FTP (File Transfer Protocol)
-
-FTP is a standard network protocol used to transfer files from one host to another over a TCP-based network, such as the Internet. It is an unsecure protocol that relies on clear-text data transmission, meaning data is sent in plain text and can be easily intercepted by malicious actors.
-
-**Pros of FTP:**
-
-- Simple and widely supported by many systems
-- Easy to set up and use
-
-**Cons of FTP:**
-
-- Insecure, as it transmits data in plain-text
-- Passwords and file contents can be intercepted by malicious actors
-- Vulnerable to attacks like packet sniffing and man-in-the-middle
-
-## SFTP (SSH File Transfer Protocol)
-
-SFTP, also known as Secure File Transfer Protocol, is an extension of SSH (Secure Shell) protocol that allows for the encrypted transfer of files over a secure channel. Unlike FTP, SFTP encrypts both data and commands, providing privacy and integrity to the data transmission.
-
-**Pros of SFTP:**
-
-- Secure, as it uses encryption to protect data in transit
-- Provides authentication, ensuring that the sender and receiver are who they claim to be
-- Mitigates the risk of attacks like packet sniffing and man-in-the-middle
-
-**Cons of SFTP:**
-
-- May be slightly slower than FTP due to the encryption and decryption process
-- Can be more difficult to set up and configure
-
-**Conclusion**
-
-In summary, although FTP is easier to set up and has been widely used for file transfers historically, SFTP is the more secure and recommended option. SFTP provides encryption, data integrity, and authentication, ensuring that your data is protected while in transit.
-
-It's essential to prioritize cybersecurity when transferring files between systems. Therefore, it is encouraged to adopt SFTP over FTP to significantly reduce the risk of data breaches and potential attacks.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/secure-vs-unsecure-protocols/101-ssl-vs-tls.md

@@ -1,32 +0,0 @@
-# SSL vs TLS
-
-Secure Socket Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols designed to provide secure communication over a computer network. Both of these protocols provide data privacy, integrity, and authentication between a client and server. However, TLS is an updated and more secure version of SSL. In this section, we will discuss the differences between SSL and TLS, and why TLS should be preferred over SSL.
-
-## SSL (Secure Socket Layer)
-
-SSL was originally developed by Netscape in the mid-1990s to secure transactions over the internet. There have been three versions of SSL:
-
-- SSL 1.0: This version was never publicly released due to security flaws.
-- SSL 2.0: Released in 1995, this version had several security vulnerabilities which led to its deprecation.
-- SSL 3.0: Released in 1996, this version addressed several security issues found in SSL 2.0. However, due to the discovery of new vulnerabilities (such as POODLE attack), SSL 3.0 is also considered insecure and deprecated.
-
-## TLS (Transport Layer Security)
-
-TLS was introduced by the Internet Engineering Task Force (IETF) in 1999 as a replacement for SSL. TLS can be considered as the new version of SSL with improved security features. The TLS protocol has gone through several updates:
-
-- TLS 1.0: This version was also vulnerable to certain attacks and is now considered insecure.
-- TLS 1.1: It addressed some of the security issues of TLS 1.0 but is also nearing end-of-life.
-- TLS 1.2: Released in 2008, it improved security features significantly and is widely used today.
-- TLS 1.3: Released in 2018, it offers even better security enhancements and improved performance.
-
-## Key Differences between SSL and TLS
-
-- **Security**: TLS provides better security due to the use of stronger encryption algorithms, updated cipher suites, and improved key exchange mechanisms.
-- **Performance**: TLS 1.3 has reduced the number of round-trips required for the handshake process, resulting in faster connection times.
-- **Backward Compatibility**: TLS is designed to be backward compatible with SSL 3.0, allowing systems using TLS to communicate with those still using SSL. However, it's strongly recommended to disable SSL 3.0 support to avoid potential attacks.
-
-## Recommendation
-
-Given the security concerns with SSL and the outdated encryption methods it uses, it is essential to use TLS for secure communication. It is recommended to use the latest version of TLS (currently, 1.3) for maximum security and performance.
-
-In conclusion, make sure to configure your systems and applications to use TLS and disable SSL to ensure secure communication and protection against known vulnerabilities.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/secure-vs-unsecure-protocols/102-ipsec.md

@@ -1,30 +0,0 @@
-# IPSEC
-
-_IPsec_ is a collection of protocols and encryption algorithms specifically designed to protect packets during data transfer within an IP network. It is particularly effective for establishing secure connections and preventing data tampering, data sniffing, and other threats in both IPv4 and IPv6 networks. IPsec provides multiple security features, including:
-
-- **Authentication:** IPsec verifies the identity of the sender and receiver, ensuring that the data is being transmitted to the correct destination.
-- **Confidentiality:** IPsec encrypts data, which prevents unauthorized access and keeps the data confidential during transmission.
-- **Data Integrity:** IPsec adds a unique digital signature to each packet to ensure that it has not been tampered with during transmission.
-- **Anti-Replay Protection:** IPsec implements a mechanism to prevent attackers from replaying and injecting duplicate packets into the communication stream.
-
-IPsec operates at the network layer, making it suitable for protecting various applications without requiring modification to the application layer. This advantage makes it particularly useful in Virtual Private Networks (VPNs) and other secure communication setups.
-
-## Key Components of IPsec
-
-IPsec primarily consists of two main components:
-
-- **AH (Authentication Header):** AH provides data integrity and authentication by adding an authentication header to each IP packet. It verifies that the packet has not been altered during transit by checking the integrity of the data and the identity of the sender.
-
-- **ESP (Encapsulating Security Payload):** ESP provides confidentiality by encrypting the data in IP packets. This ensures that the packet's contents are safe from unauthorized access and tampering during transmission.
-
-IPsec also uses two primary modes of operation:
-
-- **Transport Mode:** In transport mode, IPsec is applied only to the payload of an IP packet. This mode is typically used for securing end-to-end communication between hosts.
-
-- **Tunnel Mode:** In tunnel mode, IPsec is applied to the entire IP packet, including the header. This mode is commonly used in VPNs, where the entire packet is encapsulated, providing security between two networks.
-
-## IPsec in Practice
-
-To use IPsec, an organization must first establish a security association (SA) between the communicating parties. The SA contains the necessary information, such as encryption keys and chosen encryption algorithms, for secured communication. The Internet Key Exchange (IKE) protocol is widely used to create and manage SAs.
-
-Overall, IPsec is a flexible and powerful tool for enhancing cybersecurity at the network layer. By incorporating IPsec into your network configurations, you can prevent various threats and provide secure communication to your users.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/secure-vs-unsecure-protocols/103-dnssec.md

@@ -1,35 +0,0 @@
-# DNSSEC
-
-DNSSEC is an important security standard designed to protect the integrity of DNS (Domain Name System) data. The DNS is responsible for translating human-readable domain names (e.g. www.example.com) into IP addresses that computers can understand. However, the traditional DNS is vulnerable to several types of attacks, such as cache poisoning or man-in-the-middle attacks. This is where DNSSEC comes in.
-
-## What is DNSSEC?
-
-DNSSEC adds an extra layer of security to the DNS by validating DNS responses using cryptographic signatures. It ensures that the information received from a DNS server has not been tampered with, guaranteeing the authenticity and integrity of the data.
-
-## Key Features of DNSSEC
-
-- **Digital Signatures**: DNSSEC adds digital signatures to DNS data, which are verified by the recipient's DNS resolver. This prevents attackers from altering or forging DNS data.
-
-- **Public-Key Cryptography**: DNSSEC uses public-key cryptography to generate and verify digital signatures. This allows anyone to verify the authenticity of DNS data without possessing the private key used to create the signatures.
-
-- **Chain of Trust**: DNSSEC establishes a chain of trust from the root of the DNS tree down to individual domain names. Each level in the hierarchy vouches for the validity of the cryptographic keys used by its subdomains, creating a reliable mechanism for verifying DNS data.
-
-## How Does DNSSEC Work?
-
-- **Zone Signing**: DNS data is organized into zones. When a zone is signed with DNSSEC, a set of public and private keys is created for the zone. The DNS data is then signed using the private key, creating a digital signature.
-
-- **Delegation Signing**: To establish a chain of trust, a special type of DNS record called a DS (Delegation Signer) record is created in the parent zone. This DS record contains a hash of the public key of the child zone, effectively vouching for its authenticity.
-
-- **DNSSEC Validation**: When a DNS resolver receives a DNSSEC-protected DNS reply, it verifies the digital signatures using the public keys obtained from the parent zone. If the signatures are valid, the resolver can confidently consider the DNS data authentic and untampered.
-
-## Challenges and Limitations
-
-While DNSSEC significantly improves DNS security, it does have some challenges and limitations:
-
-- **Complex Setup**: Implementing DNSSEC can be complex, requiring significant planning and technical knowledge.
-
-- **Key Management**: Securely managing and regularly updating cryptographic keys is crucial but can be demanding.
-
-- **Larger DNS Responses**: DNSSEC adds additional data to DNS responses, which can lead to larger response sizes and possible performance impacts.
-
-Despite these challenges, DNSSEC is a critical security measure to protect against DNS-based attacks, and its adoption is highly recommended.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/secure-vs-unsecure-protocols/104-ldaps.md

@@ -1,33 +0,0 @@
-# LDAPS
-
-**LDAPS** (Lightweight Directory Access Protocol over SSL) is a secure version of LDAP, a protocol used for accessing and maintaining directory services over an IP network. LDAPS allows for secure communications between clients and servers by encrypting data transmitted over the network using Secure Sockets Layer (SSL) or Transport Layer Security (TLS).
-
-## Why should you use LDAPS?
-
-When using the plain LDAP protocol, the data transmitted between client and server is not encrypted, and therefore, it is susceptible to eavesdropping and man-in-the-middle attacks. By implementing LDAPS, you ensure that sensitive information, such as user credentials and organizational data, is protected while it is in transit.
-
-## How does LDAPS work?
-
-LDAPS uses SSL/TLS to establish an encrypted connection between client and server before any LDAP traffic is exchanged. The process involves the following steps:
-
-- A client initiates an SSL/TLS-protected connection to the server on the default LDAPS port (636) or the customized port defined by the server administrator.
-
-- The server presents its SSL/TLS certificate to the client, allowing the client to verify the server's authenticity and establish trust.
-
-- Following a successful certificate validation, the client and server negotiate the encryption algorithm and key length to be used during the secure session.
-
-- Once the secure session is established, the client and server proceed to exchange LDAP messages over the encrypted channel.
-
-- To close the secure session, either the client or the server sends an SSL/TLS close_notify alert.
-
-## Best practices for implementing LDAPS
-
-To ensure a secure and reliable LDAPS setup, you should consider the following best practices:
-
-- **Use valid and up-to-date SSL/TLS certificates:** Obtain your certificates from a trusted Certificate Authority (CA) and ensure they're renewed before expiration.
-- **Configure strong encryption algorithms:** Choose the encryption algorithms and key lengths that provide strong protection and comply with your organization's security policies.
-- **Validate server certificates on the client-side:** Properly configure client applications to validate server certificates to avoid trusting malicious servers.
-- **Monitor and manage the LDAPS infrastructure:** Regularly review logs, analyze performance, and keep software up-to-date to maintain a secure and efficient setup.
-- **Enforce a gradual transition from LDAP to LDAPS:** Before fully migrating to LDAPS, run both protocols during the transition period to ensure a smooth migration and to avoid potential downtime.
-
-By understanding LDAPS and implementing it correctly, you can ensure secure communication while accessing and managing your directory services, thereby enhancing your organization's overall cybersecurity.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/secure-vs-unsecure-protocols/105-srtp.md

@@ -1,21 +0,0 @@
-# SRTP
-
-SRTP is an extension of the Real-Time Transport Protocol (RTP) that provides enhanced security to audio and video communication. RTP is widely used for Voice over IP (VoIP) as well as audio and video streaming provided by applications such as Skype, Google Hangouts, YouTube Live, and Webex.
-
-While RTP allows for real-time transmission of audio and video, it lacks security measures, exposing the transmitted data to potential eavesdropping or tampering. SRTP fills in this gap by adding encryption, message authentication, and replay protection.
-
-## Encryption
-
-SRTP uses Advanced Encryption Standard (AES) with a 128-bit key length in order to encrypt the RTP payloads. This ensures that your communication data remains private and shielded from unauthorized access.
-
-## Message Authentication
-
-Message authentication, also known as data integrity, ensures that the messages you send are not tampered with during transmission. SRTP utilizes HMAC-SHA1 to detect any changes made to the original message, guaranteeing that the receiver can trust the authenticity of the message.
-
-## Replay Protection
-
-Replay protection is implemented in SRTP to prevent attackers from re-sending previously captured SRTP packets. This is achieved by checking sequence numbers and maintaining a replay list, allowing the protocol to drop packets that are recognized as duplicates.
-
-## Conclusion
-
-As a result, SRTP provides an added layer of security while maintaining the real-time capabilities of RTP. Combining these security features, SRTP has become the preferred protocol in audio and video communication for various applications that require a higher level of security and privacy. Implementing secure protocols such as SRTP is an essential step in enhancing your overall cybersecurity.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/secure-vs-unsecure-protocols/106-s-mime.md

@@ -1,35 +0,0 @@
-# S/MIME
-
-S/MIME is an encryption and digital signature technology that adds a layer of security to email communications. It enhances the security of email messages by providing confidentiality, integrity, and authentication while using standard mail protocols like SMTP, IMAP, and POP3.
-
-S/MIME uses a public key infrastructure (PKI) to ensure the secure exchange of messages. Users must obtain a digital certificate that contains a pair of private and public keys used to encrypt and decrypt messages.
-
-## Features of S/MIME
-
-- **Encryption**: S/MIME encrypts the email content, ensuring that only the intended recipient can read the message. This protects the sensitive information from eavesdroppers and unauthorized access.
-
-- **Digital Signature**: S/MIME enables the sender to digitally sign the message, ensuring the recipient that the message is authentic and hasn't been tampered with during transmission. It verifies the sender's identity and integrity of the message content.
-
-- **Message integrity**: The digital signature of S/MIME prevents any tampering, alteration, or unauthorized modification of the email content during transmission. It ensures the recipient that the message received is exactly the same as the message sent.
-
-## How to use S/MIME
-
-To use S/MIME, both the sender and recipient must have a digital certificate issued by a trusted certificate authority, which binds their email address and public key. Once you have a digital certificate, follow these steps:
-
-- Configure your email client (like Outlook, Thunderbird, or Apple Mail) to use S/MIME for signing and encrypting messages.
-
-- Import the digital certificate into your email client or webmail application.
-
-- When composing an email, select the option to sign, encrypt, or both.
-
-## Limitations of S/MIME
-
-Although S/MIME provides a strong layer of security to email communications, it has some limitations:
-
-- **Complexity**: The use of digital certificates and the need for both sender and recipient to have a certificate may deter some users from adopting it.
-
-- **Compatibility**: Not all email clients support S/MIME, which may limit its usage among users or organizations.
-
-- **Certificate management**: Managing digital certificates can be challenging, especially for organizations or users with a large number of certificates. Regularly updating and renewing certificates is crucial to maintaining security.
-
-Despite these limitations, S/MIME remains an essential security measure for protecting sensitive email communications. It's highly recommended for organizations dealing with confidential data and for individuals who prioritize privacy and security.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/secure-vs-unsecure-protocols/index.md

@@ -1 +0,0 @@
-# Secure vs unsecure protocols

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/tools-for-unintended-purposes/index.md

@@ -1 +0,0 @@
-# Tools for unintended purposes

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/uderstand-frameworks/100-attck.md

@@ -1,29 +0,0 @@
-# ATT&CK
-
-The **ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework** is a valuable resource for understanding the methods and strategies that adversaries are likely to use when attacking a target system or network. Developed by MITRE Corporation, ATT&CK is a comprehensive, regularly updated repository of threat actor tactics and techniques seen in real-world attacks.
-
-## Key Components
-
-There are four main components of the ATT&CK framework:
-
-- **Tactics**: These represent the intentions or strategic goals of an attacker, such as gaining initial access to a target network or moving laterally within it.
-- **Techniques**: These are the specific methods employed by attackers to accomplish their tactical objectives. Techniques are usually associated with multiple tactics, and can be standardized or customized by threat actors.
-- **Sub-techniques**: Sub-techniques provide more granularity to specific techniques, breaking them down into smaller components that can be observed or mitigated individually.
-- **Mitigations**: This component focuses on the defensive measures that organizations can take to prevent or respond to the attacker's tactics and techniques.
-
-## ATT&CK Matrix
-
-The ATT&CK Matrix is a visualization tool that organizes tactics and techniques into a table that represents the stages of an attack lifecycle. It's designed to help security practitioners understand the relationships between tactics and techniques, making it easier to use the framework effectively in threat analysis, detection, and prevention efforts.
-
-## Real-World Application
-
-By understanding the possible threats detailed in the ATT&CK framework and incorporating them into your cybersecurity strategy, you can better assess your organization's vulnerabilities, develop improved defensive procedures, and respond more effectively to incidents. The matrix could be used to:
-
-- Identify gaps in your security posture
-- Develop more robust defensive measures tailored to specific attack scenarios
-- Evaluate the effectiveness of current detection and prevention tools
-- Train your team in identifying and responding to typical attack patterns
-
-In summary, the ATT&CK framework is an invaluable resource for understanding the techniques and methods used by adversaries in real-world cyber attacks. As an author of a cyber security guide, ensuring that you are familiar with ATT&CK can help you build a more effective, comprehensive, and robust security strategy to keep your organization safe.
-
-- [@article@Link to MITRE ATT&CK](https://attack.mitre.org/)

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/uderstand-frameworks/101-kill-chain.md

@@ -1,21 +0,0 @@
-# Kill chain
-
-The **Kill Chain** is a cyber security framework that helps in understanding and identifying the steps an attacker goes through in order to carry out a successful cyber attack. Originated from military concepts, kill chain models are typically used to dissect cyber attacks, offering valuable insights to identify weak points and devise strategies for protecting systems and networks.
-
-In the context of cyber security, the kill chain approach has been adapted by various organizations, including Lockheed Martin's Cyber Kill Chain. Here is a brief overview of the seven stages of the Lockheed Martin Cyber Kill Chain framework:
-
-- **Reconnaissance:** This is the initial phase where the attacker does research, gathers information and identifies potential targets, such as email addresses, social media profiles, or specific systems and networks.
-
-- **Weaponization:** In this phase, the attacker creates a weapon, such as a malware or virus, and packages it with an exploit (a piece of software or script that takes advantage of a vulnerability in a system).
-
-- **Delivery:** The attacker transfers the weapon to the target, typically via email attachments, compromised websites or various other means.
-
-- **Exploitation:** Upon reaching the target, the weapon exploits the vulnerability, usually gaining unauthorized access and control.
-
-- **Installation:** The attacker installs the malicious software on the target system, ensuring that it can persist and remain undetected.
-
-- **Command and Control (C2):** The attacker now establishes a channel of communication with the compromised system to remotely control it and further carry out malicious activities.
-
-- **Actions on Objectives:** With full access, the attacker now achieves their intended goal, which may be data exfiltration, system disruption or other malicious outcomes.
-
-To protect against cyber threats, it is essential to understand these steps, identify the weak spots in your organization's security posture, and apply the necessary measures to prevent, detect or respond to potential threats in a timely manner. By utilizing the kill chain approach, you can effectively improve your organization's cyber security defenses and mitigate the risks posed by cybercriminals.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/uderstand-frameworks/102-diamond-model.md

@@ -1,14 +0,0 @@
-# Diamond Model
-
-The Diamond Model is a popular framework in cybersecurity that helps analysts assess, analyze, and mitigate cyber threats. This model was developed to better understand and counter advanced persistent threats (APTs) and targeted cyber-attacks. The fundamental concept of the Diamond Model is its focus on the interactions between four core elements of an intrusion event:
-
-- **Adversary:** This represents the individual or group responsible for conducting the cyber-attack. Understanding the adversary's motivation, resources, and capabilities helps when developing defensive strategies against their threats.
-- **Capability:** The tools, tactics, and techniques employed by the adversary to infiltrate and exploit a target's systems or networks. These could include malware, exploits, social engineering, or other methods.
-- **Infrastructure:** The physical or virtual systems and services, such as servers, domains, or command and control (C2) networks, used by the adversary to conduct their operations. In some cases, an adversary may leverage compromised infrastructure from other victims to hide their true origin.
-- **Victim:** The targeted individual, group, or organization that is being attacked or potentially at risk. Understanding the victim's vulnerabilities, as well as the potential impact of an intrusion, allows for better prioritization of defenses and incident response efforts.
-
-By examining these four elements and their relationships, analysts can gain a comprehensive understanding of an intrusion event and derive actionable insights to enhance their organization's cyber defense posture. Analyzing intrusion events using the Diamond Model helps uncover patterns, identify potential weaknesses, and prioritize remediation efforts to better protect the environment from future threats.
-
-In addition to the core elements, the Diamond Model also considers external factors, such as social, political, and economic contexts, which could influence the adversary's behavior or choice of targets. This broader context can further refine the analysis and help develop more robust defensive strategies.
-
-In conclusion, the Diamond Model of Intrusion Analysis is an effective framework for better understanding and addressing the ever-evolving cybersecurity landscape. By focusing on the interactions between adversaries, their capabilities, infrastructure, and victims, organizations can effectively mitigate risks, improve their defenses, and enhance their overall cybersecurity posture.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/uderstand-frameworks/index.md

@@ -1 +0,0 @@
-# Uderstand frameworks

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-common-tools/100-virus-total.md

@@ -1,12 +0,0 @@
-# VirusTotal
-
-[VirusTotal](https://www.virustotal.com/) is a free online service that analyzes files and URLs to detect viruses, worms, trojans, and other kinds of malicious content. It uses multiple antivirus engines and website scanners to provide a comprehensive report on the security status of a file or website.
-
-VirusTotal is not a substitute for traditional antivirus software, but it can be used as a complementary tool to assess the security of specific files and websites. Key features of VirusTotal include:
-
-- **File analysis:** Users can upload a file (up to 650MB) to the VirusTotal platform, where it will be analyzed by a variety of antivirus engines. The platform then provides a report that shows if any of the antivirus engines flagged the file as suspicious or malicious.
-- **URL analysis:** Users can submit a URL to VirusTotal for scanning, and the platform will analyze the website using multiple website scanners, such as blacklisting services and domain reputation tools, to determine if the site is a potential security risk.
-- **APIs and integrations:** VirusTotal offers a public API that allows developers to access its resources programmatically. This means you can integrate VirusTotal's features into your own tools or applications, enhancing your security capabilities with the power of multiple antivirus engines.
-- **Community and collaboration:** VirusTotal enables users to create a free account, which grants them access to a range of additional features, such as sharing comments and opinions about files and URLs with other users. This allows the community to work together to better understand and detect potential security threats.
-
-When encountering a suspicious file or website, consider using VirusTotal as an additional resource to better understand the potential risks associated with it. However, keep in mind that no security tool is infallible, and maintaining a layered approach to cybersecurity should always be a top priority.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-common-tools/101-joe-sandbox.md

@@ -1,25 +0,0 @@
-# Joe Sandbox
-
-Joe Sandbox is a powerful and comprehensive malware analysis platform that is designed to automatically analyze and detect various types of malicious files, such as ransomware, Trojans, and exploit documents. It helps organizations to deeply understand the behavior of potentially harmful files and provides actionable insights to improve their cyber-defense.
-
-## Key Features:
-
-- **Deep Analysis:** Joe Sandbox employs a combination of static, dynamic, and behavioral analysis techniques to uncover even the most evasive malware threats.
-- **System Compatibility:** It provides support for multiple operating systems, including Windows & Android. Joe Sandbox also supports various hypervisors such as VMWare, VirtualBox, and QEMU.
-- **File Formats:** The platform can work with a variety of file formats, including executable files (.exe, .dll), Java applets, PDFs, Microsoft Office documents, and URL links.
-- **API Integration:** Joe Sandbox offers RESTful APIs which facilitate seamless integration with other IT security products and threat intelligence services.
-- **Reporting:** Detailed and customizable reports capture valuable information about the analyzed samples, including IoCs (Indicators of Compromise), file information, network activity, and dropped artifacts.
-- **Signature-Based Detection:** The platform integrates signature-based detection to facilitate rapid identification of known malware families.
-- **Cloud-based or on-premises deployment:** Joe Sandbox provides users the option to choose between deploying the malware analysis in-house (on-premises) or leveraging the cloud version for added flexibility and cost savings.
-
-## Use Cases:
-
-Joe Sandbox proves to be an instrumental tool by helping organizations in performing the following tasks:
-
-- Detecting and categorizing new and emerging malware threats
-- Analyzing suspicious files or network activities
-- Enhancing threat hunting capabilities with advanced threat intelligence
-- Improving incident response processes by understanding attack vectors and indicators of compromise
-- Educating staff and creating awareness about the latest malware trends and attack techniques
-
-In summary, Joe Sandbox plays a critical role in strengthening an organization's cyber-security posture by delivering in-depth malware analysis and detection capabilities. Utilizing this tool effectively can result in a proactive and robust defense mechanism against increasingly complex and targeted cyber-threats.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-common-tools/102-any-run.md

@@ -1,25 +0,0 @@
-# any.run
-
-[Any.Run](https://any.run/) is an interactive online malware analysis tool that helps researchers, analysts, and security enthusiasts investigate and understand potential malware, viruses, and other malicious files. This platform enables users to safely execute and observe file behavior in an isolated environment, known as a sandbox. By evaluating the behavior patterns of a suspicious file, Any.Run can help identify its potential threat to a user's system.
-
-## Key Features
-
-- **Interactive Online Sandbox:** Any.Run provides an online sandbox environment where users can securely upload and execute suspicious files for analysis without affecting their own computer systems.
-
-- **Real-time Analysis:** As the file is executed in the sandbox, Any.Run provides real-time monitoring and visualization of processes, network activity, and file system changes. This aids in understanding the potential impact of a malicious file.
-
-- **Integrated Threat Intelligence:** Any.Run automatically checks external threat intelligence sources like VirusTotal, which helps users see how the file has been classified by other antivirus solutions.
-
-- **Multiple Operating Systems Support:** Users can select different operating systems and software configurations in the sandbox environment for more realistic and relevant analysis results.
-
-- **Collaborative Analysis:** Any.Run allows users to share the results of their analysis with other researchers, fostering collaboration and threat intelligence sharing within the cybersecurity community.
-
-## Getting Started
-
-- Create an account on [Any.Run website](https://any.run/)
-- Once logged in, click on the "New Task" button to create a new analysis task.
-- Upload the file you want to analyze or provide a URL to download the file for analysis.
-- Choose the operating system and other virtual environment settings.
-- Start the analysis task, and monitor file behavior through the live visualization and output reports provided by Any.Run.
-
-By utilizing Any.Run as part of your cybersecurity toolkit, you can gain in-depth insights into the behavior and impact of potentially malicious files, leading to more effective and informed decisions about your cyber threat landscape.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-common-tools/103-urlvoid.md

@@ -1,17 +0,0 @@
-# urlvoid
-
-_URLVoid_ is a reputable online service designed to help webmasters, security analysts, and internet users to detect potentially harmful websites by scanning their domain names. By providing detailed reports on domains' security reputation, URLVoid empowers users with vital information about potential risks associated with a website before they access it.
-
-URLVoid offers the following features:
-
-- **Blacklist Checks**: The platform scans the provided domain using a variety of blacklists, including antivirus engines, domain and IP reputation platforms, and phishing databases. The results of these checks give users an indication if the domain is considered malicious or if it has a poor reputation.
-
-- **Website Analysis**: URLVoid crawls the domain and provides useful insights such as its registration date, hosting company, server location, and SSL certificates (if any). Additionally, it generates a screenshot preview of the website's landing pages.
-
-- **WHOIS & DNS Lookup**: Access information about the domain's registration and ownership (WHOIS) and Domain Name System (DNS) records. This data can be helpful in tracking the registrant behind a suspicious website or verifying the legitimacy of a domain.
-
-- **IP Address Detection**: URLVoid also lists associated IP addresses of the scanned domain, helping users check IP-based threats or evaluate the reputation of specific IP addresses.
-
-To use URLVoid, visit their website at [www.urlvoid.com](https://www.urlvoid.com/), input the URL or domain, and the service will generate a comprehensive report within seconds.
-
-Keep in mind, URLVoid serves as a starting point for investigating potentially harmful websites. A clean report does not guarantee the absolute safety of a domain; conversely, false positives occasionally occur. We recommend using URLVoid in combination with other security tools and practices to ensure your online safety.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-common-tools/104-urlscan.md

@@ -1,23 +0,0 @@
-# urlscan
-
-URLScan is a popular security tool that helps protect your web server from potential harmful HTTP requests. It is an effective defense against a myriad of web-based attacks such as SQL injection, cross-site scripting (XSS), and server-directory traversal.
-
-## Key Features
-
-- **Analyzing Requests**: URLScan examines incoming HTTP requests to identify potentially malicious patterns or signs of an attack.
-- **Blocking URLs**: By filtering URLs with specific patterns or known bad signatures, URLScan helps protect your web server from harmful requests.
-- **Customizable Rules**: You can create custom rules tailored to your specific environment to provide a comprehensive security solution.
-- **Logging**: URLScan logs security-related events, allowing you to monitor and act on potential security threats.
-
-## Usage in Cyber Security
-
-Some common use-cases for URLScan in the cyber security realm are:
-
-- **Prevent SQL Injection**: URLScan is capable of detecting requests that contain SQL-like patterns, helping to secure your web applications from SQL injection attacks.
-- **Mitigate XSS Attacks**: URLScan can be configured to deny requests with common cross-site scripting patterns or specific user-agent strings associated with known exploits.
-- **Control Access to Sensitive Directories**: By configuring URLScan to block access to specific directories or file types, you can reduce the risk of unauthorized access to sensitive files on your web server.
-- **Monitor Suspicious Activity**: Since URLScan provides detailed logs of security events, you can use this information to quickly identify and respond to potential security threats.
-
-## Conclusion
-
-URLScan is an essential tool for maintaining web server security in today's complex online environment. By implementing this tool, you can mitigate common web-based attacks and reduce the number of potential threats to your web server. Don’t forget to monitor the logs generated by URLScan regularly to stay on top of potential threats and ensure the ongoing security of your web application.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-common-tools/105-whois.md

@@ -1,33 +0,0 @@
-# WHOIS
-
-**Whois** is a widely-used protocol and tool that allows you to query domain registration and ownership information. It is often useful in the cyber security field for researching and investigating the origins, hosting providers, or administrators associated with a particular domain or IP address.
-
-## How to Use Whois
-
-There are various ways you can access the Whois database, as listed below:
-
-- **Command Line**: Most operating systems come with a command-line version of Whois. For example, you can simply open your command prompt or terminal and type in `whois example.com` to find information about `example.com`.
-
-- **Websites**: Many websites offer specialized Whois lookup services, such as [ICANN's Whois Lookup](https://whois.icann.org/) and [Whois.net](https://www.whois.net/).
-
-- **Software Tools**: You can use specialized software tools like [Network-Tools](http://network-tools.com/) and [WebHostingHero Whois Finder](https://www.webhostinghero.com/whois-finder/) to access the Whois database.
-
-## Whois Information
-
-When performing a Whois query, you may typically find the following information:
-
-- **Domain registrar**: The company that registers and manages the domain.
-
-- **Domain owner**: The person or organization responsible for the domain, including their name, address, phone number, and email address.
-
-- **Domain's creation, expiration, and last update dates**: These dates can be useful to determine the age and history of a domain, as well as checking for recent changes.
-
-- **Domain status**: This can include `active`, `inactive`, `pending`, `locked`, or `expired`, depending on the current state of the domain.
-
-- **Domain's name servers**: These are the servers responsible for resolving the domain to its corresponding IP address(es).
-
-## Privacy & Limitations
-
-It is important to note that Whois information may not always be accurate, as domain owners can provide false information or use privacy protection services to mask their identity. Additionally, some registrars may limit the number of Whois queries from a single IP address, which can limit the usefulness of Whois in some scenarios.
-
-In conclusion, Whois is a valuable tool for understanding domain registration and ownership information. It can be used by cyber security professionals, among others, to investigate potentially malicious websites or domains, identify patterns or relationships among sites, and gain insights into a domain's history and ownership. Remember to consider the limitations of the information obtained through Whois and always verify the gathered information through various sources.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-common-tools/index.md

@@ -1 +0,0 @@
-# Understand common tools

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-the-following-terms/100-antivirus.md

@@ -1,21 +0,0 @@
-# Antivirus
-
-Antivirus (or anti-virus) software is a program designed to protect your computer from malicious software, also known as malware. Malware includes viruses, worms, ransomware, spyware, and trojans, among others. The main function of antivirus software is to detect, prevent, and remove malware from your computer or network.
-
-## Key Features of Antivirus Software
-
-- **Real-time scanning**: Antivirus programs continuously monitor your computer for potential threats, enabling them to identify and neutralize malware before it can cause harm.
-
-- **Malware detection**: Antivirus software uses a combination of signature-based detection and behavioral analysis to identify known and unknown malware. Signature-based detection relies on a database of known virus signatures while behavioral analysis examines how the software behaves on your system.
-
-- **Automatic updates**: Since new malware is created daily, antivirus software must be frequently updated to stay effective. Most antivirus software can automatically update their virus definitions (database of known malware signatures) and software modules to maintain maximum protection.
-
-- **Quarantine and removal**: Upon detecting malware, antivirus software will attempt to either remove the threat entirely or quarantine it to prevent it from causing further damage to your system.
-
-- **System scans**: It is essential to perform regular system scans to identify and remove any malware that may have bypassed real-time scanning. Most antivirus programs offer quick, full, and custom scanning options.
-
-- **External device scanning**: Antivirus software can also scan external devices, such as USB drives and CDs, for potential threats before they can infect your computer.
-
-- **Email protection**: Email is a common vector for malware distribution. Antivirus programs often include email scanning as a feature to detect and prevent email-borne threats.
-
-By installing and maintaining an up-to-date antivirus program, you can significantly reduce the risk of falling victim to cyber attacks and maintain a secure environment for your computer and personal data.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-the-following-terms/101-antimalware.md

@@ -1,33 +0,0 @@
-# Antimalware
-
-Antimalware, short for anti-malware, is a type of software designed to detect, prevent, and remove malicious software (malware) from a computer system or network. Malware can include various types of threats, such as viruses, worms, Trojans, spyware, adware, and ransomware. Antimalware software plays a critical role in maintaining the security and integrity of your system by detecting and eliminating these threats.
-
-## How Antimalware Works
-
-Antimalware software typically uses a combination of methods to identify and remove malware, including:
-
-- **Signature-based detection**: This method compares files on your system against a database of known malware signatures, which are unique patterns or characteristics of each malware type. If a file matches a known signature, the antimalware software quarantines or deletes it.
-
-- **Heuristic analysis**: Heuristic analysis is a more advanced technique that looks for suspicious behavior or previously unknown malware. Instead of relying solely on known malware signatures, heuristic analysis uses algorithms to detect new or modified malware based on the characteristics or behavior patterns of known threats.
-
-- **Real-time protection**: Antimalware software often provides real-time protection by continuously scanning your system and monitoring activities to identify and stop malicious activities as they occur.
-
-- **File quarantine and removal**: If a potential threat is detected, the antimalware software quarantines the file, preventing it from causing further damage to your system. You can then decide whether to delete the file or restore it if it's a false positive.
-
-- **Regular updates**: As new malware types and variants are discovered constantly, it's crucial for antimalware software to receive regular updates to its signature database and heuristic algorithms. This ensures the software can effectively protect your system against emerging threats.
-
-## Choosing Antimalware Software
-
-When selecting an antimalware solution, consider the following factors:
-
-- **Compatibility**: Make sure the software is compatible with your operating system and other security tools you may be using.
-
-- **Performance**: Ensure the software has a minimal impact on your system's performance and does not slow down your computer significantly.
-
-- **Usability**: Choose a solution that's easy to install, configure, and use. User-friendly software is especially important for users who are not tech-savvy.
-
-- **Effectiveness**: Look for an antimalware tool that has a high detection rate and a low false positive rate, as well as comprehensive real-time protection capabilities.
-
-- **Reputation**: Choose an antimalware product from a reputable vendor with a proven track record of successful malware detection and removal.
-
-In conclusion, antimalware is a crucial component of a well-rounded cybersecurity strategy. Investing in a comprehensive antimalware solution can help protect your computer systems, data, and personal information from a wide range of threats. Regularly update your antimalware software and maintain good cyber hygiene practices to minimize your risk of malware infections.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-the-following-terms/102-edr.md

@@ -1,17 +0,0 @@
-# EDR
-
-**Endpoint Detection and Response (EDR)** is a cybersecurity technology that helps organizations to continuously monitor, detect, investigate, and remediate potential threats on endpoint devices. These devices include computers, laptops, smartphones, and other IoT devices that are connected to a network.
-
-EDR is particularly important in modern security strategies, as it allows security teams to gain visibility and control over a wide range of endpoints and their activities. Traditional antivirus software and firewalls may not provide sufficient protection against advanced cyber threats, making EDR a necessary addition for organizations to proactively combat cyber attacks.
-
-Here are the main components of EDR:
-
-- **Monitoring**: EDR solutions continuously monitor endpoint devices and collect vast amounts of data associated with user, file, network, and process activities. This data helps to track potential threats and their effects on devices in real-time.
-
-- **Detection**: EDR uses advanced analytics and machine learning to identify suspicious or malicious activities, which might indicate a breach, malware infection, or a targeted attack. It helps security teams detect threats that may have evaded prevention mechanisms, like antivirus software.
-
-- **Investigation**: EDR provides the necessary tools for security teams to quickly investigate incidents, identify the root cause, and the scope of the attack. It also collects evidence to understand the attacker's methods, motives, and objectives.
-
-- **Remediation**: After identifying a security incident, EDR solutions allow security teams to take prompt remedial actions, such as isolating affected devices, rolling back malicious changes, or blocking related network connections.
-
-In summary, EDR is a crucial cybersecurity technology that helps organizations protect their network and devices from advanced cyber threats by providing continuous monitoring, prompt detection, thorough investigation, and effective remediation capabilities.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-the-following-terms/103-dlp.md

@@ -1,35 +0,0 @@
-# DLP
-
-**Data Loss Prevention** (DLP) is a set of tools, strategies, and best practices aimed at preventing unauthorized access, use, or transfer of sensitive and confidential information. Organizations use DLP to protect their data and comply with legal and industry regulations, such as GDPR, HIPAA, and PCI-DSS.
-
-DLP solutions monitor and control the flow of data both within the organization's network and in transit over the internet. They help to identify potential breaches and unauthorized actions, allowing security teams to react and prevent data loss.
-
-## Key Components of DLP
-
-- **Data Identification**: DLP solutions must first identify which data is sensitive and needs to be protected. This can include personally identifiable information (PII), financial information, intellectual property, or other data critical to the organization.
-
-- **Data Monitoring**: The DLP system tracks and analyzes users' interactions with sensitive data. This includes data access, modification, copying, and sharing both internally and externally.
-
-- **Policy Enforcement**: DLP solutions apply pre-defined security policies to protect sensitive data. These policies can include access control, encryption, data masking, and data classification.
-
-- **Incident Response**: In case of a potential data breach or security incident, the DLP system should generate alerts and provide forensic evidence for the security teams to investigate and remediate the issue.
-
-- **Reporting and Audit**: DLP solutions produce reports and audit logs to demonstrate compliance with applicable regulations, measure the effectiveness of the DLP program, and make informed decisions for improvement.
-
-## Implementing DLP
-
-Effective Data Loss Prevention requires a combination of technology, policies, and user education. Some steps to consider when implementing DLP include:
-
-- **Set objectives**: Define what types of data are critical to your organization and establish the goals of your DLP program.
-
-- **Create policies**: Develop appropriate policies for handling sensitive data, such as defining who has access, where the data can be stored, and how it can be shared.
-
-- **Choose the right solution**: Evaluate and select the most suitable DLP tools for your organization, taking factors like scalability, ease of use, and integration capabilities into account.
-
-- **Implement and enforce**: Deploy the selected DLP tools and apply the defined policies across the organization, ensuring that users adhere to the security measures in place.
-
-- **Educate and train**: Educate employees about the importance of DLP and provide training on the policies and tools implemented, enabling users to understand their roles and responsibilities in protecting sensitive data.
-
-- **Monitor and adapt**: Regularly analyze the effectiveness of your DLP solution and make adjustments as needed to address new threats, regulatory changes, or shifting business requirements.
-
-By implementing a comprehensive Data Loss Prevention strategy, organizations can proactively protect their sensitive data and reduce the risk of data breaches, regulatory fines, and damage to their reputation.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-the-following-terms/104-firewall-nextgen-firewall.md

@@ -1,19 +0,0 @@
-# Firewall and Nextgen Firewall
-
-A **Next-Generation Firewall (NGFW)** is an advanced type of firewall that goes beyond traditional network security by providing more in-depth inspection, visibility, and control over network traffic. It is designed to defend against modern-day threats and sophisticated attacks.
-
-## Key features of Next-Generation Firewalls:
-
-- **Application awareness:** NGFWs can identify and control applications running on a network, regardless of the port or protocol used. This provides more granular control over network traffic and enhances security.
-
-- **Integrated Intrusion Prevention System (IPS):** Next-gen firewalls come with built-in IPS capabilities, which helps in detecting and blocking potential threats and vulnerabilities in real-time.
-
-- **User identity awareness:** NGFWs can track and enforce security policies based on user identities (rather than just IP addresses), providing better visibility and control over user activities.
-
-- **Advanced threat protection:** Next-gen firewalls often include features like sandboxing and threat intelligence to detect and block advanced threats such as zero-day attacks, ransomware, and targeted attacks.
-
-- **SSL/TLS inspection:** NGFWs can decrypt and inspect SSL/TLS encrypted traffic, enabling the detection of threats hidden within encrypted communications.
-
-- **Centralized management and reporting:** These firewalls offer a centralized management console to easily manage security policies and monitor network activities.
-
-By combining these advanced protection features, Next-Generation Firewalls provide enhanced visibility and control, enabling organizations to effectively secure their networks in today's complex and ever-evolving cyber-threat landscape.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-the-following-terms/105-hips.md

@@ -1,17 +0,0 @@
-# HIPS
-
-HIPS, or Host-based Intrusion Prevention System, is a security software designed to protect individual devices or hosts by monitoring and analyzing system behavior in real time. Its primary goal is to detect and block suspicious activities, malicious attacks, and unauthorized access attempts.
-
-Unlike network-based intrusion prevention systems (NIPS), which focus on protecting the entire network, HIPS focuses on a specific device, providing a supplementary layer of security. It operates at the host level, working together with traditional antivirus and firewall solutions.
-
-Key features of HIPS include:
-
-- **Behavioral Analysis**: HIPS monitors system activities, such as network connections, file modifications, and registry changes, to identify unusual or malicious behavior patterns.
-
-- **Signature-based Detection**: Similar to antivirus software, HIPS uses a database of known attack signatures to detect and prevent known threats.
-
-- **System Hardening**: By enforcing security policies and configurations, HIPS helps prevent unauthorized access attempts and reduce system vulnerabilities.
-
-- **Zero-day Protection**: HIPS can identify and block previously unknown threats, providing protection against new malware and vulnerabilities that traditional signature-based solutions might miss.
-
-In summary, a Host-based Intrusion Prevention System (HIPS) effectively safeguards individual devices by detecting and preventing suspicious activities and known threats. By implementing HIPS alongside other cybersecurity measures, organizations can enhance their overall security posture and keep their systems protected from various cyber threats.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-the-following-terms/106-nids.md

@@ -1,23 +0,0 @@
-# NIDS
-
-A Network Intrusion Detection System (NIDS) is a security solution that monitors network traffic for any suspicious activity, malicious threats, or policy violations. This system primarily focuses on detecting attacks from both external and internal sources. NIDS plays a critical role in protecting valuable information assets and maintaining overall network security.
-
-Here are some key features of NIDS:
-
-## Passive Monitoring
-
-NIDS observes network traffic passively, without interfering or causing any performance impact. By silently monitoring network activity, NIDS detects suspicious activities in real-time without disrupting regular network operations.
-
-## Traffic Analysis
-
-NIDS inspects network packets and observes their content and behavior. Network traffic patterns are analyzed against predefined rules or signatures of known threats, which helps determine if a network intrusion is taking place.
-
-## Threat and Policy Violations Identification
-
-NIDS identifies possible attacks or intrusions by comparing network activity against known threat signatures or user-defined policies. When activities match a specific pattern or when policy violations occur, the system generates an alert, logs the incident, and may take appropriate action to mitigate the threat.
-
-## Alert and Response
-
-In the event of a detected threat or policy violation, NIDS produces alerts and reports to provide administrators with crucial information about the event. Depending on the configuration, the system may also respond by blocking the suspicious traffic, isolating the affected device, or taking other pre-defined actions.
-
-Implementing NIDS as a part of your cyber security strategy is an essential step for ensuring the ongoing integrity and confidentiality of your network environment.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-the-following-terms/107-nips.md

@@ -1,17 +0,0 @@
-# NIPS
-
-A **Network Intrusion Prevention System (NIPS)** is a security mechanism designed to monitor and protect your network from malicious activities, such as cyberattacks, unauthorized access, and security vulnerabilities. NIPS are essential components of a robust cybersecurity strategy to ensure that your network remains secure and reliable.
-
-Key features of NIPS include:
-
-- **Traffic monitoring:** NIPS constantly analyze the traffic flowing through your network, enabling it to detect any unusual activity or patterns that may indicate a potential cyberattack or intrusion attempt.
-
-- **Threat detection:** By using various techniques, such as signature-based detection, anomaly-based detection, and behavior-based detection, NIPS can identify known and unknown threats and alert you to their presence in your network.
-
-- **Prevention and blocking:** Upon identifying a threat, NIPS can promptly take action to stop it from causing damage or compromising your network's integrity. This could include blocking malicious traffic, terminating connections, or even re-configuring your network to prevent further intrusion attempts.
-
-- **Reporting and alerts:** NIPS provide you with detailed reports and real-time alerts about any detected threats, enabling your security team to take appropriate action and mitigate potential risks.
-
-Using NIPS as part of your cybersecurity strategy can help you maintain the security and stability of your network, while also providing you with valuable insights into potential threats and vulnerabilities. By implementing a Network Intrusion Prevention System, you can stay one step ahead of cybercriminals and safeguard your company's valuable assets.
-
-Read on to understand other crucial cybersecurity terms and strengthen your security knowledge.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-the-following-terms/108-host-based-firewall.md

@@ -1,17 +0,0 @@
-# Host Based Firewall
-
-A _host-based firewall_ is a software application or suite of applications that manage and control the flow of network traffic on an individual computer or host. Unlike a network firewall, which typically provides protection for multiple devices connected to a network, a host-based firewall focuses on securing and protecting only the device on which it is installed.
-
-**Key Features of a Host-Based Firewall:**
-
-- **Control Incoming and Outgoing Traffic:** Host-based firewalls can be configured to allow or deny specific types of network traffic both to and from the device. This includes blocking or allowing access to certain ports, IP addresses, or protocols.
-
-- **Rule-Based Management:** Users can create and customize rules for how a host-based firewall should handle network traffic. These rules can be based on various factors, such as the origin or destination of the traffic, the protocol being used, or the specific application generating or receiving the traffic.
-
-- **Application-Level Protection:** Some host-based firewalls offer application-level protection, where the firewall is capable of inspecting, filtering, and blocking traffic at the application layer. This feature provides more fine-grained control over network traffic and can help protect against application-specific vulnerabilities and attacks.
-
-- **Intrusion Detection and Prevention:** Many host-based firewalls include intrusion detection and prevention systems (IDS/IPS) that can detect and block known malicious traffic patterns or behavior, adding an extra layer of security against network-based threats.
-
-- **Ease of Deployment and Management:** Host-based firewalls can be easily installed and managed on individual devices, making them well-suited for scenarios where installing a network-based firewall might not be feasible or cost-effective.
-
-Using a host-based firewall can help strengthen a device's security posture by providing an additional layer of protection against network threats. However, it is important to remember that a host-based firewall should be just one element of a comprehensive cybersecurity strategy, which also includes updating software and operating systems, strong passwords, and regular backing up of data.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-the-following-terms/109-sandboxing.md

@@ -1,14 +0,0 @@
-# Sandboxing
-
-Sandboxing is a security technique used to isolate an application from the rest of the system to prevent potential security violations. In simple terms, a sandbox is like a closed environment where the program, or a part of the code, can be executed without affecting the rest of the system.
-
-The main purpose behind sandboxing is to protect the system, particularly from potentially malicious or untrusted applications. This way, a sandboxed application has restricted access to system resources, and its actions are closely monitored and limited to its designated environment.
-
-Some benefits of sandboxing include:
-
-- **Reduced risk of attacks:** By isolating potentially dangerous applications, sandboxing reduces the risks of malicious attacks or unintentional security breaches.
-- **Error containment:** Sandboxing helps ensure that any errors or bugs in a program do not spread to other parts of the system.
-- **Testing and analysis:** Sandboxed environments can be used to safely test new applications or analyze potentially malicious software without risking the integrity of the overall system.
-- **Resource management:** Sandboxing can help manage the resources that an application can consume, preventing it from monopolizing system resources and negatively affecting the performance of other applications.
-
-It's important to note that while sandboxing is an essential tool in strengthening cybersecurity, it is not foolproof. Skilled attackers may still find ways to escape a sandboxed environment and cause harm to the system. However, using sandboxing techniques as part of a comprehensive security strategy provides a valuable layer of protection for your system.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-the-following-terms/110-acl.md

@@ -1,23 +0,0 @@
-# ACL
-
-An Access Control List (ACL) is a security feature used in computer systems, networks, and applications to define rules and restrictions for granting or denying access to specific resources. It helps organizations manage user access rights, ensuring that only authorized users can access sensitive information and resources.
-
-ACLs consist of entries that specify the permissions each user or group of users have for a particular resource. These permissions can include read, write, execute, and delete access.
-
-## Key Components of an ACL
-
-- **Resource:** The object or system that you want to protect, such as files, folders, applications, or network devices.
-
-- **User or Group:** The user account or group of users that need access to the protected resource.
-
-- **Permission:** A set of actions (e.g., read, write, execute) the user or group is allowed to perform on the resource.
-
-## Why ACLs are Important for Cyber Security:
-
-- **Access control:** ACLs are a fundamental tool for implementing access controls, making it an essential component of an organization's overall security strategy.
-
-- **Auditing and compliance:** ACLs help organizations ensure compliance with various regulations and industry standards by providing detailed information regarding user access to critical and sensitive resources.
-
-- **Reduced risk of unauthorized access:** Implementing ACLs minimizes the risk of unauthorized users accessing an organization's confidential information, as well as prevents unauthorized changes that can lead to data breaches or loss.
-
-In summary, Access Control Lists play a vital role in maintaining an organization's cyber security posture by controlling access to resources and ensuring that only authorized users can perform specific actions on those resources.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-the-following-terms/111-eap-vs-peap.md

@@ -1,36 +0,0 @@
-# EAP vs PEAP
-
-## Extensible Authentication Protocol (EAP)
-
-EAP is an authentication framework that provides different authentication methods for various networks. It supports multiple authentication types, allowing organizations to choose the most suitable one to secure their network. EAP operates in the link layer of the OSI model and is commonly used in wireless networks and remote access connections.
-
-_Pros:_
-
-- Highly flexible, supports multiple authentication methods
-- Can be easily updated to use new authentication methods
-
-_Cons:_
-
-- Not an authentication mechanism itself, but a framework
-- Requires the use of an additional authentication server
-
-## Protected Extensible Authentication Protocol (PEAP)
-
-PEAP is a popular EAP method designed to provide secure communication within an organization's network. It creates a secure tunnel between the client and the authentication server using Transport Layer Security (TLS), which encapsulates other EAP methods within that tunnel. This process adds an extra layer of security by protecting the authentication process from eavesdropping or man-in-the-middle attacks.
-
-_Pros:_
-
-- Encrypts authentication data, preventing unauthorized access
-- Works alongside other EAP methods
-- Simplifies the deployment of client certificates
-
-_Cons:_
-
-- Requires the use of a Public Key Infrastructure (PKI)
-- May not be supported by all devices and network configurations
-
-In summary:
-
-- EAP is a flexible authentication framework that supports various authentication methods, while PEAP is an EAP method that adds a layer of security by utilizing TLS.
-- EAP provides an adaptable solution for organizations looking for diverse authentication options, whereas PEAP focuses on enhancing security by encrypting the authentication process.
-- Choosing between EAP and PEAP will depend on your organization's security requirements, network infrastructure, and compatibility with devices or systems.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-the-following-terms/112-wpa-vs-wpa2-vs-wpa3-vs-wep.md

@@ -1,26 +0,0 @@
-# WPA vs WPA2 vs WPA3 vs WEP
-
-In this section, we will discuss the differences between various wireless security protocols: WPA, WPA2, WPA3, and WEP.
-
-## WEP (Wired Equivalent Privacy)
-
-WEP was the first wireless security protocol, introduced in 1999, with the goal of providing a level of privacy and security similar to that of wired networks. However, WEP has major security flaws and can be easily compromised. It uses a weak encryption algorithm (RC4) and static encryption keys that can be easily cracked with readily available tools.
-
-## WPA (Wi-Fi Protected Access)
-
-WPA was introduced in 2003 as a temporary solution to address the security shortcomings of WEP. It improved security by implementing Temporal Key Integrity Protocol (TKIP) for encryption and using dynamic encryption keys that change with each data packet transmitted. WPA also incorporated a pre-shared key (PSK) authentication method. However, WPA still uses the RC4 encryption algorithm, which has known vulnerabilities.
-
-## WPA2 (Wi-Fi Protected Access 2)
-
-WPA2, released in 2004, is an upgraded version of WPA and is now the most widely used wireless security standard. It replaced the RC4 encryption algorithm with the much more secure Advanced Encryption Standard (AES). WPA2 offers two authentication methods: WPA2-Personal (using a pre-shared key (PSK)) and WPA2-Enterprise (using the 802.1X authentication framework). WPA2 provides a significant improvement in security over WPA, but it is still vulnerable to certain attacks, such as the KRACK attack.
-
-## WPA3 (Wi-Fi Protected Access 3)
-
-WPA3 is the latest and most secure wireless security protocol, launched in 2018. It offers several major improvements over WPA2, including:
-
-- Simultaneous Authentication of Equals (SAE): A more secure password-based authentication method that protects against dictionary and brute-force attacks.
-- 192-bit security suite: An enhanced level of encryption for enterprise and government networks requiring higher security levels.
-- Enhanced Open: Improved security for open Wi-Fi networks by encrypting data transmission without requiring a shared password.
-- Easy Connect: Streamlined configuration for IoT devices with limited or no display interface.
-
-In summary, WPA3 addresses many of the security vulnerabilities found in WPA2 and provides a higher level of security for wireless networks. However, as it is relatively new, not all devices currently support WPA3.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-the-following-terms/113-wps.md

@@ -1,13 +0,0 @@
-# WPS
-
-Wi-Fi Protected Setup (WPS) is a feature available in many Wi-Fi routers and access points that is designed to simplify the process of connecting devices to a wireless network. With WPS, users can easily connect to a secure Wi-Fi network without the need for manually entering the network's password.
-
-There are multiple methods for using WPS, some of which include:
-
-- **Push-button method**: This is the most common method of using WPS. The user simply pushes the WPS button on the router, and then on the device they want to connect within a certain time period. This automatically establishes a secure connection between the device and the router.
-- **PIN method**: In this method, a unique Personal Identification Number (PIN) is generated by the router or access point, which the user must then enter on the device they wish to connect.
-- **NFC method**: Some devices come with near-field communication (NFC) capabilities, allowing users to establish a secure connection by simply tapping their device against the router or access point.
-
-Though WPS can provide ease of use and quick connectivity, it has some security concerns. The main concern arises from the PIN method, as the 8-digit PINs are susceptible to brute force attacks. This vulnerability can allow an attacker to gain unauthorized access to a network. As a result, many cyber security experts recommend disabling WPS or using the push-button method only.
-
-In conclusion, while WPS can make connecting devices to a wireless network more convenient, its associated security risks make it essential for users to be aware of best practices to protect their networks.

src/data/roadmaps/cyber-security/content/103-security-skills-and-knowledge/understand-the-following-terms/index.md

@@ -1 +0,0 @@
-# Understand the following terms