Add cybersecurity content (#7136)

* add 80+ topics

* 7 topics

* 19 topics

* complete cyber roadmap

* expanded internal links into full urls

src/data/roadmaps/cyber-security/content/arp@fzdZF-nzIL69kaA7kwOCn.md

@@ -1,10 +1,6 @@
 # ARP
 
-ARP is a protocol used by the Internet Protocol (IP) to map an IP address to a physical address, also known as a Media Access Control (MAC) address. ARP is essential for routing data between devices in a Local Area Network (LAN) as it allows for the translation of IP addresses to specific hardware on the network.
-
-When a device wants to communicate with another device on the same LAN, it needs to determine the corresponding MAC address for the target IP address. ARP helps in this process by broadcasting an ARP request containing the target IP address. All devices within the broadcast domain receive this ARP request and compare the target IP address with their own IP address. If a match is found, the device with the matching IP address sends an ARP reply which contains its MAC address.
-
-The device that initiated the ARP request can now update its ARP cache (a table that stores IP-to-MAC mappings) with the new information, and then proceed to send data to the target's MAC address.
+ARP is a protocol used by the Internet Protocol (IP) to map an IP address to a physical address, also known as a Media Access Control (MAC) address. ARP is essential for routing data between devices in a Local Area Network (LAN) as it allows for the translation of IP addresses to specific hardware on the network. When a device wants to communicate with another device on the same LAN, it needs to determine the corresponding MAC address for the target IP address. ARP helps in this process by broadcasting an ARP request containing the target IP address. All devices within the broadcast domain receive this ARP request and compare the target IP address with their own IP address. If a match is found, the device with the matching IP address sends an ARP reply which contains its MAC address. The device that initiated the ARP request can now update its ARP cache (a table that stores IP-to-MAC mappings) with the new information, and then proceed to send data to the target's MAC address.
 
 Learn more from the following resources: 
 

src/data/roadmaps/cyber-security/content/arp@hkO3Ga6KctKODr4gos6qX.md

@@ -1,10 +1,6 @@
 # ARP
 
-ARP is a protocol used by the Internet Protocol (IP) to map an IP address to a physical address, also known as a Media Access Control (MAC) address. ARP is essential for routing data between devices in a Local Area Network (LAN) as it allows for the translation of IP addresses to specific hardware on the network.
-
-When a device wants to communicate with another device on the same LAN, it needs to determine the corresponding MAC address for the target IP address. ARP helps in this process by broadcasting an ARP request containing the target IP address. All devices within the broadcast domain receive this ARP request and compare the target IP address with their own IP address. If a match is found, the device with the matching IP address sends an ARP reply which contains its MAC address.
-
-The device that initiated the ARP request can now update its ARP cache (a table that stores IP-to-MAC mappings) with the new information, and then proceed to send data to the target's MAC address.
+ARP is a protocol used by the Internet Protocol (IP) to map an IP address to a physical address, also known as a Media Access Control (MAC) address. ARP is essential for routing data between devices in a Local Area Network (LAN) as it allows for the translation of IP addresses to specific hardware on the network. When a device wants to communicate with another device on the same LAN, it needs to determine the corresponding MAC address for the target IP address. ARP helps in this process by broadcasting an ARP request containing the target IP address. All devices within the broadcast domain receive this ARP request and compare the target IP address with their own IP address. If a match is found, the device with the matching IP address sends an ARP reply which contains its MAC address. The device that initiated the ARP request can now update its ARP cache (a table that stores IP-to-MAC mappings) with the new information, and then proceed to send data to the target's MAC address.
 
 Learn more from the following resources: 
 

src/data/roadmaps/cyber-security/content/attck@auR7fNyd77W2UA-PjXeJS.md

@@ -1,12 +1,6 @@
 # ATT&CK
 
-MITRE ATT&CK® stands for Adversarial Tactics, Techniques & Common Knowledge. 
-
-MITRE ATT&CK documents various strategies, methods, and processes employed by adversaries at every stage of a cybersecurity incident, from the reconnaissance and strategizing phase to the final implementation of the attack. 
-
-The insights provided by MITRE ATT&CK can empower security professionals and teams to enhance their defensive strategies and responses against potential threats.
-
-This framework was created by the non-profit organization MITRE Corporation and is continuously updated with contributions from cybersecurity experts worldwide.
+MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. It provides a comprehensive matrix of attack methods used by threat actors, organized into tactics like initial access, execution, persistence, and exfiltration. This framework is widely used by cybersecurity professionals for threat modeling, improving defensive capabilities, and developing more effective security strategies. ATT&CK helps organizations understand attacker behavior, assess their security posture, and prioritize defenses against the most relevant threats.
 
 Learn more from the following resources:
 

src/data/roadmaps/cyber-security/content/aws@0LztOTc3NG3OujCVwlcVU.md

@@ -4,4 +4,8 @@ Amazon Web Services (AWS) is a leading cloud computing platform provided by Amaz
 
 Learn more from the following resources:
 
+- [@roadmap@AWS Roadmap](https://roadmap.sh/aws)
+- [@official@AWS Website](https://aws.amazon.com)
+- [@article@How to create an AWS account](https://grapplingdev.com/tutorials/how-to-create-aws-account)
+- [@video@AWS Overview](https://www.youtube.com/watch?v=a9__D53WsUs)
 - [@course@AWS Complete Tutorial](https://www.youtube.com/watch?v=B8i49C8fC3E)

src/data/roadmaps/cyber-security/content/azure@GklBi7Qx1akN_cS9UMrha.md

@@ -1,37 +1,9 @@
 # Azure
 
-Microsoft Azure, often referred to simply as "Azure", is a cloud computing platform and service offered by Microsoft. Azure provides a wide range of cloud services, tools, and resources for organizations and developers to build, deploy, and manage applications on a global scale. With support for multiple programming languages and frameworks, Azure makes it easier to move existing applications or create new ones for the cloud environment.
+Azure is Microsoft's comprehensive cloud computing platform that offers a wide range of services for building, deploying, and managing applications. It provides infrastructure as a service (IaaS), platform as a service (PaaS), and software as a service (SaaS) solutions, supporting various programming languages, tools, and frameworks. Azure's services include virtual machines, storage, databases, AI and machine learning, IoT, and more. It offers global data center coverage, integrated DevOps tools, and robust security features, making it a versatile platform for businesses of all sizes to innovate, scale, and transform their operations in the cloud.
 
-## Key Features
+Learn more from the following resources:
 
-- **Compute Power**: Azure offers a variety of virtual machines, containers, and serverless computing options to execute and scale applications.
-
-- **Storage**: Azure provides several storage options - Blob Storage for unstructured data, File Storage for file shares, and Disk Storage for block storage.
-
-- **Databases**: Azure offers managed relational databases, NoSQL databases, and in-memory databases for different needs and workloads.
-
-- **Analytics**: Azure provides tools and services for big data and advanced analytics, including Azure Data Lake, Azure Machine Learning, and Power BI.
-
-- **Networking**: Azure supports various networking services, such as Virtual Networks, Load Balancers, and Content Delivery Networks, to ensure secure and reliable connectivity to applications.
-
-- **Security**: Azure provides a range of security services and features to help protect your applications and data, including Advanced Threat Protection, Azure Active Directory, and Azure Firewall.
-
-- **Identity & Access Management**: Azure Active Directory (AD) provides identity and access management services, enabling secure sign-on and multi-factor authentication for applications and users.
-
-- **Hybrid Cloud**: Azure supports hybrid cloud deployment, meaning you can run some parts of your infrastructure on-premises and some on Azure.
-
-## Pros and Cons
-
-**Pros**:
-
-- Wide range of services and features
-- Integration with other Microsoft products
-- Strong support for hybrid cloud
-- Good for large enterprises already using Microsoft technologies
-
-**Cons**:
-
-- Can be complex to navigate and manage
-- Potentially costly depending on usage and services
-
-Azure is an excellent choice for those looking to leverage a vast array of cloud services, particularly if you're already invested in the Microsoft ecosystem. It's important to keep in mind, though, that the platform's complexity can lead to a steeper learning curve, and managing costs can be challenging as usage scales.
+- [@official@Azure Website](https://azure.microsoft.com)
+- [@video@Azure DevOps Tutorial for Beginners](https://www.youtube.com/watch?v=4BibQ69MD8c)
+- [@feed@daily.dev Azure Feed](https://app.daily.dev/tags/azure)

src/data/roadmaps/cyber-security/content/basics-and-concepts-of-threat-hunting@_x3BgX93N-Pt1_JK7wk0p.md

@@ -1,10 +1,7 @@
 # Basics and Concepts of Threat Hunting
 
-Threat hunting is a proactive approach to cybersecurity where security professionals actively search for hidden threats or adversaries that may have bypassed traditional security measures, such as firewalls and intrusion detection systems. Rather than waiting for automated tools to flag suspicious activity, threat hunters use a combination of human intuition, threat intelligence, and advanced analysis techniques to identify indicators of compromise (IoCs) and potential threats within a network or system.
+Threat hunting is a proactive approach to cybersecurity where security professionals actively search for hidden threats or adversaries that may have bypassed traditional security measures, such as firewalls and intrusion detection systems. Rather than waiting for automated tools to flag suspicious activity, threat hunters use a combination of human intuition, threat intelligence, and advanced analysis techniques to identify indicators of compromise (IoCs) and potential threats within a network or system. The process involves several key concepts, starting with a **hypothesis**, where a hunter develops a theory about potential vulnerabilities or attack vectors that could be exploited. They then conduct a **search** through logs, traffic data, or endpoint activity to look for anomalies or patterns that may indicate malicious behavior. **Data analysis** is central to threat hunting, as hunters analyze vast amounts of network and system data to uncover subtle signs of attacks or compromises. If threats are found, the findings lead to **detection and mitigation**, allowing the security team to contain the threat, remove malicious entities, and prevent similar incidents in the future.
 
-The process involves several key concepts, starting with a **hypothesis**, where a hunter develops a theory about potential vulnerabilities or attack vectors that could be exploited. They then conduct a **search** through logs, traffic data, or endpoint activity to look for anomalies or patterns that may indicate malicious behavior. **Data analysis** is central to threat hunting, as hunters analyze vast amounts of network and system data to uncover subtle signs of attacks or compromises. If threats are found, the findings lead to **detection and mitigation**, allowing the security team to contain the threat, remove malicious entities, and prevent similar incidents in the future.
-
-Threat hunting also involves **continuous learning** and adapting, as hunters refine their techniques based on evolving attack methods and the latest threat intelligence. This approach improves an organization’s overall security posture by identifying sophisticated or previously unknown threats that might evade conventional security measures.
 
 Learn more from the following resources:
 

src/data/roadmaps/cyber-security/content/basics-of-computer-networking@T0aU8ZQGShmF9uXhWY4sD.md

@@ -1,14 +1,6 @@
 # Basics of Computer Networking
 
-Computer networking involves connecting multiple computers and devices to share resources, such as data, applications, and internet connections. Networks can range from small local area networks (LANs) to large-scale wide area networks (WANs), such as the internet. The basic components of a network include devices (computers, servers, routers), transmission media (wired or wireless), and network protocols, which govern communication between devices.
-
-Key concepts in networking include:
-
-1. **IP Addressing**: Every device on a network has a unique Internet Protocol (IP) address, which allows it to be identified and communicate with other devices.
-2. **Subnetting**: This involves dividing a network into smaller, manageable sections to optimize performance and security.
-3. **Routing**: Routers are used to forward data between different networks, ensuring that information reaches the correct destination.
-4. **DNS**: The Domain Name System translates human-readable domain names into IP addresses, enabling easier navigation and communication on the internet.
-5. **TCP/IP Protocol**: The Transmission Control Protocol/Internet Protocol (TCP/IP) suite is the foundation of most networks, handling how data is broken into packets, transmitted, and reassembled.
+Computer networking is the practice of connecting computers and devices to share data and resources. It involves the use of protocols like TCP/IP for communication, hardware such as routers and switches for directing traffic, and various network topologies (e.g., star, mesh, bus) for organizing connections. Networks can be categorized by size and scope, from small local area networks (LANs) to wide area networks (WANs) that span large geographical areas. Key concepts include IP addressing, subnetting, DNS for name resolution, and network security measures. Understanding networking basics is crucial for managing data flow, troubleshooting connectivity issues, and ensuring efficient communication in modern computing environments.
 
 Learn more from the following resources:
 

src/data/roadmaps/cyber-security/content/basics-of-reverse-engineering@uoGA4T_-c-2ip_zfEUcJJ.md

@@ -1,8 +1,6 @@
 # Basics of Reverse Engineering
 
-Reverse engineering is the process of deconstructing a system, software, or hardware to understand its internal workings, design, and functionality without having access to its source code or original documentation. In cybersecurity, reverse engineering is often used to analyze malware or software vulnerabilities to uncover how they operate, allowing security professionals to develop defenses, patches, or detection methods. This involves breaking down the binary code, disassembling it into machine code, and then interpreting it to understand the logic, behavior, and intent behind the program.
-
-Reverse engineering can also be used in hardware to investigate a device's design or performance, or in software development for compatibility, debugging, or enhancing legacy systems. The process typically includes static analysis, where the code is examined without execution, and dynamic analysis, where the program is executed in a controlled environment to observe its runtime behavior. The insights gained through reverse engineering are valuable for improving security, fixing bugs, or adapting systems for different uses. However, it’s important to be aware of the legal and ethical boundaries, as reverse engineering certain software or hardware can violate intellectual property rights.
+Reverse engineering is the process of deconstructing a system, software, or hardware to understand its internal workings, design, and functionality without having access to its source code or original documentation. In cybersecurity, reverse engineering is often used to analyze malware or software vulnerabilities to uncover how they operate, allowing security professionals to develop defenses, patches, or detection methods. This involves breaking down the binary code, disassembling it into machine code, and then interpreting it to understand the logic, behavior, and intent behind the program. Reverse engineering can also be used in hardware to investigate a device's design or performance, or in software development for compatibility, debugging, or enhancing legacy systems. The process typically includes static analysis, where the code is examined without execution, and dynamic analysis, where the program is executed in a controlled environment to observe its runtime behavior. The insights gained through reverse engineering are valuable for improving security, fixing bugs, or adapting systems for different uses. However, it’s important to be aware of the legal and ethical boundaries, as reverse engineering certain software or hardware can violate intellectual property rights.
 
 Learn more from the following resources:
 

src/data/roadmaps/cyber-security/content/basics-of-subnetting@E8Z7qFFW-I9ivr0HzoXCq.md

@@ -1,8 +1,6 @@
 # Basics of Subnetting
 
-Subnetting is a technique used in computer networking to divide a large network into smaller, more manageable sub-networks, or "subnets." It enhances network performance and security by reducing broadcast traffic and enabling better control over IP address allocation. Each subnet has its own range of IP addresses, which allows network administrators to optimize network traffic and reduce congestion by isolating different sections of a network.
-
-In subnetting, an IP address is split into two parts: the network portion and the host portion. The network portion identifies the overall network, while the host portion identifies individual devices within that network. Subnet masks are used to define how much of the IP address belongs to the network and how much is reserved for hosts. By adjusting the subnet mask, administrators can create multiple subnets from a single network, with each subnet having a limited number of devices. Subnetting is particularly useful for large organizations, allowing them to efficiently manage IP addresses, improve security by segmenting different parts of the network, and control traffic flow by minimizing unnecessary data transmissions between segments.
+Subnetting is a technique used in computer networking to divide a large network into smaller, more manageable sub-networks, or "subnets." It enhances network performance and security by reducing broadcast traffic and enabling better control over IP address allocation. Each subnet has its own range of IP addresses, which allows network administrators to optimize network traffic and reduce congestion by isolating different sections of a network. In subnetting, an IP address is split into two parts: the network portion and the host portion. The network portion identifies the overall network, while the host portion identifies individual devices within that network. Subnet masks are used to define how much of the IP address belongs to the network and how much is reserved for hosts. By adjusting the subnet mask, administrators can create multiple subnets from a single network, with each subnet having a limited number of devices. Subnetting is particularly useful for large organizations, allowing them to efficiently manage IP addresses, improve security by segmenting different parts of the network, and control traffic flow by minimizing unnecessary data transmissions between segments.
 
 Learn more from the following resources:
 

src/data/roadmaps/cyber-security/content/basics-of-threat-intel-osint@wN5x5pY53B8d0yopa1z8F.md

@@ -1,8 +1,6 @@
 # Basics of Threat Intel, OSINT
 
-Threat Intelligence (Threat Intel) and Open-Source Intelligence (OSINT) are both critical components in cybersecurity that help organizations stay ahead of potential threats. Threat Intelligence refers to the collection, analysis, and dissemination of information about potential or current attacks targeting an organization. This intelligence typically includes details on emerging threats, attack patterns, malicious IP addresses, and indicators of compromise (IoCs), helping security teams anticipate, prevent, or mitigate cyberattacks. Threat Intel can be sourced from both internal data (such as logs or past incidents) and external feeds, and it helps in understanding the tactics, techniques, and procedures (TTPs) of adversaries.
-
-OSINT, a subset of Threat Intel, involves gathering publicly available information from open sources to assess and monitor threats. These sources include websites, social media, forums, news articles, and other publicly accessible platforms. OSINT is often used for reconnaissance to identify potential attack vectors, compromised credentials, or leaks of sensitive data. It’s also a valuable tool in tracking threat actors, as they may leave traces in forums or other public spaces. Both Threat Intel and OSINT enable organizations to be more proactive in their cybersecurity strategies by identifying vulnerabilities, understanding attacker behavior, and implementing timely defenses based on actionable insights.
+Threat Intelligence (Threat Intel) and Open-Source Intelligence (OSINT) are both critical components in cybersecurity that help organizations stay ahead of potential threats. Threat Intelligence refers to the collection, analysis, and dissemination of information about potential or current attacks targeting an organization. This intelligence typically includes details on emerging threats, attack patterns, malicious IP addresses, and indicators of compromise (IoCs), helping security teams anticipate, prevent, or mitigate cyberattacks. Threat Intel can be sourced from both internal data (such as logs or past incidents) and external feeds, and it helps in understanding the tactics, techniques, and procedures (TTPs) of adversaries. OSINT, a subset of Threat Intel, involves gathering publicly available information from open sources to assess and monitor threats. These sources include websites, social media, forums, news articles, and other publicly accessible platforms. OSINT is often used for reconnaissance to identify potential attack vectors, compromised credentials, or leaks of sensitive data. It’s also a valuable tool in tracking threat actors, as they may leave traces in forums or other public spaces. Both Threat Intel and OSINT enable organizations to be more proactive in their cybersecurity strategies by identifying vulnerabilities, understanding attacker behavior, and implementing timely defenses based on actionable insights.
 
 Learn more from the following resources:
 

src/data/roadmaps/cyber-security/content/basics-of-vulnerability-management@lcxAXtO6LoGd85nOFnLo8.md

@@ -8,5 +8,6 @@ Next, **remediation** is carried out through patching, configuration changes, or
 
 Learn more from the following resources:
 
-- [@article@What is vulnerability management?](https://www.rapid7.com/fundamentals/vulnerability-management-and-scanning/)
+- [@article@What is vulnerability management? - Rapid7](https://www.rapid7.com/fundamentals/vulnerability-management-and-scanning/)
+- [@article@What is Vulnerability Management? - CrowdStrike](https://www.crowdstrike.com/cybersecurity-101/vulnerability-management/)
 - [@video@Vulnerability Management explained by experts](https://www.youtube.com/watch?v=RE6_Lo2wSIg)

src/data/roadmaps/cyber-security/content/blue--red--purple-teams@7tDxTcKJNAUxbHLPCnPFO.md

@@ -1,8 +1,6 @@
 # Blue Team vs Red Team vs Purple Team
 
-In the context of cybersecurity, Blue Team, Red Team, and Purple Team are terms used to describe different roles and methodologies employed to ensure the security of an organization or system. Let's explore each one in detail.
-
-In cybersecurity, Blue Team and Red Team refer to opposing groups that work together to improve an organization's security posture. The Blue Team represents defensive security personnel who protect systems and networks from attacks, while the Red Team simulates real-world adversaries to test the Blue Team's defenses. Purple Team bridges the gap between the two, facilitating collaboration and knowledge sharing to enhance overall security effectiveness. This approach combines the defensive strategies of the Blue Team with the offensive tactics of the Red Team, creating a more comprehensive and dynamic security framework that continuously evolves to address emerging threats and vulnerabilities.
+In the context of cybersecurity, Blue Team, Red Team, and Purple Team are terms used to describe different roles and methodologies employed to ensure the security of an organization or system. Let's explore each one in detail. In cybersecurity, Blue Team and Red Team refer to opposing groups that work together to improve an organization's security posture. The Blue Team represents defensive security personnel who protect systems and networks from attacks, while the Red Team simulates real-world adversaries to test the Blue Team's defenses. Purple Team bridges the gap between the two, facilitating collaboration and knowledge sharing to enhance overall security effectiveness. This approach combines the defensive strategies of the Blue Team with the offensive tactics of the Red Team, creating a more comprehensive and dynamic security framework that continuously evolves to address emerging threats and vulnerabilities.
 
 Learn more from the following resources:
 

src/data/roadmaps/cyber-security/content/box@4Man3Bd-ySLFlAdxbLOHw.md

@@ -4,4 +4,5 @@ Box is a popular cloud storage service that provides individuals and businesses
 
 Learn more from the following resources:
 
-- [@official@Box Website](https://www.box.com/en-gb/home)
+- [@official@Box Website](https://www.box.com/en-gb/home)
+- [@video@Box Cloud Storage Review 2024](https://www.youtube.com/watch?v=ktNDLO1T96c)

src/data/roadmaps/cyber-security/content/ip@FdoqB2---uDAyz6xZjk_u.md

@@ -1,8 +1,6 @@
 # IP
 
-IP, or Internet Protocol, is a fundamental concept in cybersecurity that refers to the way data is transferred across networks, specifically the internet. It is a core component of the internet's architecture and serves as the primary building block for communication between devices connected to the network.
-
-An IP address is a unique identifier assigned to each device connected to a network, like a computer or smartphone. It comprises a series of numbers separated by dots (e.g., 192.168.1.1). IP addresses can be either IPv4 (32-bit) or the newer IPv6 (128-bit) format, which provides more available addresses. They allow devices to send and receive data packets to and from other devices on the internet.
+IP, or Internet Protocol, is a fundamental concept in cybersecurity that refers to the way data is transferred across networks, specifically the internet. It is a core component of the internet's architecture and serves as the primary building block for communication between devices connected to the network. An IP address is a unique identifier assigned to each device connected to a network, like a computer or smartphone. It comprises a series of numbers separated by dots (e.g., 192.168.1.1). IP addresses can be either IPv4 (32-bit) or the newer IPv6 (128-bit) format, which provides more available addresses. They allow devices to send and receive data packets to and from other devices on the internet.
 
 Learn more from the following resources:
 

src/data/roadmaps/cyber-security/content/lan@xWxusBtMEWnd-6n7oqjHz.md

@@ -1,39 +1,8 @@
 # LAN
 
-A **Local Area Network (LAN)** is a vital component of cyber security that you must understand. This chapter covers a brief introduction to LAN, its basic functionalities and importance in maintaining a secure network environment.
+A Local Area Network (LAN) is a computer network that interconnects computers and devices within a limited area, such as a home, office, school, or small group of buildings. LANs typically use Ethernet or Wi-Fi technologies to enable high-speed data communication among connected devices. They allow for resource sharing, including files, printers, and internet connections. LANs are characterized by higher data transfer rates, lower latency, and more direct control over network configuration and security compared to wide area networks (WANs). Common LAN applications include file sharing, collaborative work, local hosting of websites or services, and networked gaming. The advent of software-defined networking and cloud technologies has expanded LAN capabilities, enabling more flexible and scalable local network infrastructures.
 
-## What is LAN?
+Learn more from the following resources:
 
-LAN stands for Local Area Network, which is a group of computers and other devices interconnected within a limited geographical area, like an office, school campus or even a home. These networks facilitate sharing of resources, data and applications among connected devices. They can be wired (Ethernet) or wireless (Wi-Fi).
-
-## Key Components of LAN
-
-LAN comprises several key components, including:
-
-- **Workstations**: End user devices like computers, laptops or smartphones connected to the network.
-- **Servers**: Computers that provide resources and services to the workstations.
-- **Switches**: Networking devices that connect workstations and servers, and distribute network traffic efficiently.
-- **Routers**: Devices that connect the LAN to the internet or other networks (e.g., Wide Area Networks or WANs).
-
-## Importance of LAN
-
-LANs play a fundamental role in modern organizations, providing:
-
-- **Resource Sharing**: They allow sharing of resources such as printers, scanners, storage drives and software applications across multiple users.
-- **Communication**: They enable faster communication between connected devices and allow users to collaborate effectively using email, chat or VoIP services.
-- **Data Centralization**: They allow data storage and retrieval from central servers rather than individual devices, which simplifies data management and backups.
-- **Scalability**: LANs can be easily expanded to accommodate more users and resources to support business growth.
-
-## LAN Security
-
-Understanding LAN is crucial for maintaining a secure network environment. Since a LAN connects multiple devices, it forms the central point of various security vulnerabilities. Implementing effective security measures is vital to prevent unauthorized access, data leaks, and malware infections. Some best practices for securing your LAN include:
-
-- **Firewalls**: Deploy hardware-based and software-based firewalls to protect your network from external and internal threats.
-- **Antivirus Software**: Use antivirus applications on workstations and servers to prevent malware infections.
-- **Wireless Security**: Implement robust Wi-Fi security measures like WPA2 encryption and strong passwords to prevent unauthorized access.
-- **Access Controls**: Implement network access controls to grant authorized users access to specific resources and data.
-- **Network Segmentation**: Divide the network into separate zones based on required access levels and functions to contain potential threats.
-- **Regular Updates**: Keep your workstations, servers and network devices up-to-date with security patches and updates to fix vulnerabilities.
-- **Network Monitoring**: Use network monitoring tools to keep track of network traffic and identify potential threats or anomalies.
-
-By understanding the components and importance of LAN, you can effectively contribute to improving your organization's cyber security posture. In the next chapter, we will discuss additional cyber security topics that you need to be familiar with.
+- [@article@What is a LAN?](https://www.cisco.com/c/en_uk/products/switches/what-is-a-lan-local-area-network.html)
+- [@video@LAN vs. WAN: What's the Difference?](https://www.youtube.com/watch?v=5OoX_cRLaNM)

src/data/roadmaps/cyber-security/content/ldap@lV3swvD6QGLmD9iVfbKIF.md

@@ -1,27 +1,8 @@
 # LDAP
 
-LDAP is a protocol used to access directory services, i.e., a hierarchical database that holds information about various objects, such as users, groups, computer accounts, and more. In the context of cybersecurity, it's essential in storing information related to authentication, authorization, and user profiles. LDAP is primarily utilized in enterprise environments as a centralized system for managing user accounts and their permissions.
+LDAP (Lightweight Directory Access Protocol) is a standardized application protocol for accessing and maintaining distributed directory information services over an IP network. It's primarily used for querying and modifying directory services, such as user authentication and information lookup. LDAP organizes data in a hierarchical tree structure and is commonly used in enterprise environments for centralized user management, authentication, and authorization. It supports features like single sign-on and can integrate with various applications and services. LDAP is widely used in conjunction with Active Directory and other directory services to provide a centralized repository for user accounts, groups, and other organizational data, facilitating efficient user and resource management in networked environments.
 
-**How LDAP works**
+Learn more from the following resources:
 
-- It is based on a client-server model, where the client sends a request to the server (usually an LDAP directory server), and the server responds accordingly.
-- LDAP servers store directory entries in a hierarchical (tree-like) structure, starting from the root (known as the "base DN") and following a series of branches down to individual entries.
-- Each entry in the LDAP directory has a distinguished name (DN), which uniquely identifies the entry in the hierarchy.
-
-**LDAP in Cyber Security**
-In cybersecurity, LDAP servers are often used for the following purposes:
-
-- **Authentication**: LDAP stores user account and password information, which can be used to authenticate users to access specific applications or resources.
-- **Authorization**: Using LDAP directory groups, you can manage access controls for users and grant or deny permissions based on their role or membership.
-- **User Management**: LDAP provides a single, centralized repository for managing user account information, making it easier to maintain consistent user data across multiple systems or applications.
-
-**LDAP Security Best Practices**
-To enhance the security of your LDAP implementation, consider adopting these best practices:
-
-- Use secure protocols like LDAPS (LDAP over SSL) or StartTLS to encrypt the data transmitted between the client and the LDAP server.
-- Implement strong access control rules to ensure that only authorized clients can access the LDAP directory.
-- Regularly update and patch both client-side and server-side LDAP software to protect against known vulnerabilities.
-- Limit the searchable scope on the client-side, to minimize the risk of information disclosure.
-- Use strong authentication methods, such as multi-factor authentication (MFA), to secure access to the LDAP directory.
-
-In conclusion, LDAP is a critical component in many enterprise-level cybersecurity architectures, as it plays a vital role in handling authentication and authorization processes. To ensure the security of your LDAP implementation, it's crucial to follow best practices and carefully manage access to directory services.
+- [@article@What Is LDAP & How Does It Work?](https://www.okta.com/uk/identity-101/what-is-ldap/)
+- [@video@](https://www.youtube.com/watch?v=vy3e6ekuqqg)

src/data/roadmaps/cyber-security/content/ldaps@z_fDvTgKw51Uepo6eMQd9.md

@@ -1,8 +1,6 @@
 # Lightweight Directory Access Protocol Secure (LDAPS)
 
-LDAPS (Lightweight Directory Access Protocol Secure) is a secure version of the Lightweight Directory Access Protocol (LDAP), which is used to access and manage directory services over a network. LDAP is commonly employed for user authentication, authorization, and management in environments like Active Directory, where it helps manage access to resources such as applications and systems.
-
-LDAPS adds security by encrypting LDAP traffic using SSL/TLS (Secure Sockets Layer/Transport Layer Security) protocols, protecting sensitive information like usernames, passwords, and directory data from being intercepted or tampered with during transmission. This encryption ensures data confidentiality and integrity, making LDAPS a preferred choice for organizations that require secure directory communication.
+LDAPS (Lightweight Directory Access Protocol Secure) is a secure version of the Lightweight Directory Access Protocol (LDAP), which is used to access and manage directory services over a network. LDAP is commonly employed for user authentication, authorization, and management in environments like Active Directory, where it helps manage access to resources such as applications and systems. LDAPS adds security by encrypting LDAP traffic using SSL/TLS (Secure Sockets Layer/Transport Layer Security) protocols, protecting sensitive information like usernames, passwords, and directory data from being intercepted or tampered with during transmission. This encryption ensures data confidentiality and integrity, making LDAPS a preferred choice for organizations that require secure directory communication.
 
 By using LDAPS, organizations can maintain the benefits of LDAP while ensuring that sensitive directory operations are protected from potential eavesdropping or man-in-the-middle attacks on the network.
 

src/data/roadmaps/cyber-security/content/linux@4frVcjYI1VlVU9hQgpwcT.md

@@ -1,43 +1,12 @@
 # Linux
 
-Linux is an open-source operating system (OS) that is widely popular due to its flexibility, stability, and security features. As a Unix-based OS, Linux has a command-line interface, which allows users to perform various tasks through text commands. However, graphical user interfaces (GUIs) can also be installed for ease of use.
-
-## Key Features
-
-- **Open-source**: Anyone can view, modify, and distribute the Linux source code, promoting collaboration and continuous improvement within the OS community.
-- **Modular design**: Linux can be customized for various computing environments, such as desktops, servers, and embedded systems.
-- **Stability and performance**: Linux is well-known for its ability to handle heavy loads without crashing, making it an ideal choice for servers.
-- **Strong Security**: Linux has robust security mechanisms, such as file permissions, a built-in firewall, and an extensive user privilege system.
-- **Large Community**: Linux has a vast, active user community that offers a wealth of knowledge, user-contributed software, and support forums.
-
-## Popular Linux Distributions
-
-There are numerous Linux distributions available, catering to specific user needs and preferences. Some popular distributions include:
-
-- **Ubuntu**: A user-friendly distribution suitable for beginners, often used for desktop environments.
-- **Fedora**: A cutting-edge distribution with frequent updates and innovative features, ideal for developers and advanced users.
-- **Debian**: A very stable distribution that prioritizes free software and benefits from a large, active community.
-- **Arch Linux**: A highly customizable distribution that allows users to build their system from the ground up, suited for experienced users.
-- **CentOS**: A distribution focused on stability, security, and manageability, making it a popular choice for server environments.
-
-## Security Best Practices for Linux
-
-While Linux is inherently secure, there are best practices to enhance your system's security further:
-
-- Keep your system updated: Regularly update your kernel, OS packages, and installed software to ensure you have the latest security patches.
-- Enable a firewall: Configure and enable a firewall, such as `iptables`, to control incoming and outgoing network traffic.
-- Use strong passwords and user accounts: Create separate accounts with strong passwords for different users and grant them only the required privileges.
-- Disable unused services: Unnecessary services can be potential security risks; ensure only required services are running on your system.
-- Implement a Security-Enhanced Linux (SELinux) policy: SELinux provides a mandatory access control (MAC) system that restricts user and process access to system resources.
-
-By understanding Linux's features and best practices, you can leverage its powerful capabilities and robust security features to enhance your computing environment's performance and safety.
+Linux is an open-source, Unix-like operating system kernel first released by Linus Torvalds in 1991. It forms the core of various operating systems known as Linux distributions. Linux is known for its stability, security, and flexibility, making it popular for servers, embedded systems, and increasingly for desktop use. It supports a wide range of hardware and offers powerful command-line interfaces alongside graphical user interfaces. Linux adheres to Unix principles, emphasizing modularity and the philosophy of "do one thing and do it well." Its open-source nature allows for community-driven development and customization. Linux is widely used in cloud computing, supercomputers, and Android devices, and is a fundamental component of the LAMP (Linux, Apache, MySQL, PHP) web server stack.
 
 Learn more from the following resources:
 
 - [@roadmap@Linux Roadmap](https://roadmap.sh/linux)
-- [@article@Learn Linux](https://linuxjourney.com/)
-- [@video@Linux in 100 Seconds](https://www.youtube.com/watch?v=rrB13utjYV4)
-- [@video@Introduction to Linux](https://youtu.be/sWbUDq4S6Y8)
 - [@article@Linux Commands Cheat Sheet](https://cdn.hostinger.com/tutorials/pdf/Linux-Commands-Cheat-Sheet.pdf)
 - [@course@Linux from scratch - Cisco](https://www.netacad.com/courses/os-it/ndg-linux-unhatched)
+- [@video@Linux in 100 Seconds](https://www.youtube.com/watch?v=rrB13utjYV4)
+- [@video@Introduction to Linux](https://youtu.be/sWbUDq4S6Y8)
 - [@feed@Explore top posts about Linux](https://app.daily.dev/tags/linux?ref=roadmapsh)

src/data/roadmaps/cyber-security/content/local-auth@vYvFuz7lAJXZ1vK_4999a.md

@@ -1,43 +1,4 @@
 # Local Auth
 
-In this section, we will discuss local authentication, which is a crucial aspect of ensuring the security of your computer systems and networks.
+Local authentication refers to the process of verifying a user's identity on a specific device or system without relying on external servers or networks. It typically involves storing and checking credentials directly on the device itself. Common methods include username/password combinations, biometrics (fingerprint, face recognition), or PIN codes. Local authentication is often used for device access, offline applications, or as a fallback when network-based authentication is unavailable. While it offers quick access and works without internet connectivity, it can be less secure than centralized authentication systems and more challenging to manage across multiple devices. Local authentication is commonly used in personal devices, standalone systems, and scenarios where network-based authentication is impractical or unnecessary.
 
-## What is Local Authentication?
-
-Local authentication is the process of verifying a user's identity on a single, isolated system, such as a computer or a server. It refers to the direct checking of user credentials (such as username and password) against a locally stored database, instead of relying on a centralized authentication service.
-
-## How Does Local Authentication Work?
-
-In a local authentication setup, user and password information is stored on the same system where authentication takes place. When a user attempts to log in, the system checks the provided credentials against the stored data. If they match, access is granted, otherwise, it is denied.
-
-Here is a high-level overview of how local authentication works:
-
-- User attempts to log in by entering their credentials, typically a username and password.
-- System checks the provided credentials against a local database.
-- If the credentials match an entry in the database, access is granted to the user.
-- If the credentials do not match any entries in the database, access is denied and an error message is displayed.
-
-## Advantages and Disadvantages of Local Authentication
-
-## Advantages
-
-- **Simplicity**: Local authentication is simple to set up, as it doesn't require any external authentication services or additional infrastructure.
-- **No Dependency on Internet Connectivity**: Since user credentials are stored locally, users can still authenticate even if there is no internet connection.
-
-## Disadvantages
-
-- **Scalability**: Managing and maintaining user accounts on individual systems becomes difficult when the number of systems and users increases.
-- **Increased Risk**: Information about user accounts, including passwords, may be stored in plain text, making them vulnerable to unauthorized access.
-- **Incomplete Security**: Local authentication alone may not provide sufficient security to protect sensitive information, necessitating the use of additional security measures such as secure socket layer (SSL) and two-factor authentication (2FA).
-
-## Best Practices for Local Authentication
-
-To ensure the security of your system while using local authentication:
-
-- Always use strong, unique passwords for each user account.
-- Regularly update and patch the system to keep it secure against known vulnerabilities.
-- Consider implementing additional security measures, such as encryption, to protect sensitive data.
-- Periodically review user accounts to ensure they have the appropriate access privileges and are no longer needed.
-- Implement logs and monitoring to detect any suspicious activity on your system relating to user authentication.
-
-In conclusion, local authentication can be an effective method for authenticating users on a single system. However, it is important to be aware of its limitations and make sure to implement additional security measures when necessary to keep your data safe.

src/data/roadmaps/cyber-security/content/localhost@0TWwox-4pSwuXojI8ixFO.md

@@ -1,25 +1,8 @@
 # localhost
 
-Localhost (also known as loopback address) is a term used to define a network address that is used by a device (usually a computer or a server) to refer to itself. In other words, it's a way for your device to establish a network connection to itself. The most commonly used IP address for localhost is `127.0.0.1`, which is reserved as a loopback address in IPv4 networks. For IPv6 networks, it's represented by `::1`.
+**Localhost** refers to the standard hostname used to access the local computer on which a network service or application is running. It resolves to the loopback IP address `127.0.0.1` for IPv4 or `::1` for IPv6. When you connect to `localhost`, you're effectively communicating with your own machine, allowing you to test and debug network services or applications locally without accessing external networks.
 
-## Purpose and Usage of Localhost
+Learn more from the following resources:
 
-Localhost is useful for a variety of reasons, such as:
-
-- **Testing and Development**: Developers can use localhost to develop and test web applications or software without the need for connecting to external network resources.
-
-- **Network Services**: Some applications and servers use localhost to provide network services to the local system only, optimizing performance and security.
-
-- **Troubleshooting**: Localhost can be used as a diagnostic tool to test if the network stack on the device is functioning correctly.
-
-## Connecting to Localhost
-
-To connect to localhost, you can use several methods depending on the tasks you want to accomplish:
-
-- **Web Browser**: If you're running a local web server, you can simply enter `http://127.0.0.1` or `http://localhost` in your browser's address bar and access the locally hosted web application.
-
-- **Command Line**: You can use utilities like `ping`, `traceroute`, or `telnet` at the command prompt to verify connectivity and network functionality using localhost.
-
-- **Application Settings**: Some applications, such as web servers or database servers, may have configuration settings that allow you to bind them to the loopback address (`127.0.0.1` or `::1`). This will restrict the services to the local system and prevent them from being accessed by external sources.
-
-Remember, connections to localhost do not pass through your computer's physical network interfaces, and as such, they're not subject to the same security risks or performance limitations that a real network connection might have.
+- [@article@What is localhost?](https://www.freecodecamp.org/news/what-is-localhost/)
+- [@video@What is localhost? | Explained](https://www.youtube.com/watch?v=m98GX51T5dI)

src/data/roadmaps/cyber-security/content/lolbas@10qbxX8DCrfyH7tgYexxQ.md

@@ -1,48 +1,9 @@
 # LOLBAS
 
-**LoLBAS** stands for **Living off the Land Binaries and Scripts**. It is a collection of tools, utilities, and scripts, often built-in within an operating system, that attackers exploit for unintended purposes. These tools can assist the adversaries in achieving their objectives without the need to install any additional software, thus avoiding detection by many security solutions.
+**LOLBAS** (Living Off the Land Binaries and Scripts) refers to a collection of legitimate system binaries and scripts that can be abused by attackers to perform malicious actions while evading detection. These tools, which are often part of the operating system or installed software, can be leveraged for various purposes, such as executing commands, accessing data, or modifying system configurations, thereby allowing attackers to carry out their activities without deploying custom malware. The use of LOLBAS techniques makes it harder for traditional security solutions to detect and prevent malicious activities since the binaries and scripts used are typically trusted and deemed legitimate.
 
-In this section, we will explore the concept and significance of LoLBAS, and the challenges they present in the context of cyber security.
+Learn more from the following resources:
 
-## What is LoLBAS?
-
-LoLBAS are legitimate tools, binaries, and scripts that are already present in a system. These may be default OS utilities, like PowerShell or Command Prompt, or commonly installed applications, such as Java or Python. Adversaries utilize these tools to perform malicious activities, as they blend into the environment and are less likely to raise any alarms.
-
-Some examples of LoLBAS include:
-
-- PowerShell: Used for executing commands and scripts for various administrative functions.
-- Cscript and Wscript: Used for executing VBScript and JScript files.
-- Certutil: Used for updating certificate store but can also be leveraged to download files from the internet.
-
-## Why LoLBAS are popular among adversaries?
-
-There are several reasons why adversaries choose to use LoLBAS for their malicious purposes:
-
-- **No additional software required**: As these tools are already a part of the target system, there is no need to install new software that could potentially be detected.
-- **Ease of use**: Many LoLBAS provide powerful capabilities without requiring complex coding. As a result, adversaries can swiftly implement and execute tasks using them.
-- **Masquerading as legitimate actions**: Since LoLBAS are typically used for legitimate purposes, suspicious activities using these tools can blend in with regular traffic, making it difficult to identify and detect.
-
-## Challenges posed by LoLBAS
-
-Utilizing LoLBAS presents unique challenges in cyber security due to the following reasons:
-
-- **Difficulty in detection**: Identifying and differentiating between malicious and legitimate uses of these tools is a challenging task.
-- **False positives**: Blocking, limiting, or monitoring the usage of LoLBAS frequently leads to false positives, as legitimate users might also rely on these tools.
-
-## Securing against LoLBAS attacks
-
-To protect against LoLBAS-based attacks, organizations should consider taking the following steps:
-
-- **Monitor behavior**: Establish baselines of normal system behavior and monitor for deviations, which could suggest malicious use of LoLBAS.
-- **Least privilege principle**: Apply the principle of least privilege by limiting user permissions, reducing the potential attack surface.
-- **Harden systems**: Remove or disable unnecessary tools and applications that could be exploited by adversaries.
-- **Educate users**: Train users on the risks and signs of LoLBAS usage and encourage them to report suspicious activity.
-- **Employ advanced security solutions**: Use technologies like Endpoint Detection and Response (EDR) and behavioral analytics to detect abnormal patterns that could be associated with LoLBAS abuse.
-
-## Conclusion
-
-LoLBAS present a significant challenge to cyber security, as they blend in with legitimate system activities. However, overcoming this challenge is possible through a combination of proactive monitoring, system hardening, and user education.
-
-Ensure you are well prepared to identify and mitigate LoLBAS attacks by following the recommendations provided in this guide. Stay vigilant and stay secure!
-
-- [@article@LOLBAS project](https://lolbas-project.github.io/#)
+- [@official@LOLBAS project](https://lolbas-project.github.io/#)
+- [@article@Understanding the risks of LOLBAS in security](https://pentera.io/blog/the-lol-isnt-so-funny-when-it-bites-you-in-the-bas/)
+- [@video@LOLBAS T1105, MS Process Abuse](https://www.youtube.com/watch?v=fq2_VvAU29g)

src/data/roadmaps/cyber-security/content/loopback@W_oloLu2Euz5zRSy7v_T8.md

@@ -1,22 +1,8 @@
 # loopback
 
-Loopback is an essential concept in IP terminology that refers to a test mechanism used to validate the operation of various network protocols, and software or hardware components. The primary function of the loopback feature is to enable a device to send a data packet to itself to verify if the device's network stack is functioning correctly.
+**Loopback** refers to a special network interface used to send traffic back to the same device for testing and diagnostic purposes. The loopback address for IPv4 is `127.0.0.1`, while for IPv6 it is `::1`. When a device sends a request to the loopback address, the network data does not leave the local machine; instead, it is processed internally, allowing developers to test applications or network services without requiring external network access. Loopback is commonly used to simulate network traffic, check local services, or debug issues locally.
 
-## Importance of Loopback
+Learn more from the following resources:
 
-The concept of loopback is critical for the following reasons:
-
-- **Troubleshooting**: Loopback helps in diagnosing and detecting network connectivity issues. It can also help ascertain whether an application or device is correctly processing and responding to incoming network traffic.
-- **Testing**: Loopback can be used extensively by developers to test software applications or components without external network access. This ensures that the software behaves as expected even without a working network connection.
-
-## Loopback Address
-
-In IP terminology, there's a pre-allocated IP address for loopback. For IPv4, the reserved address is `127.0.0.1`. For IPv6, the loopback address is `::1`. When a device sends a packet to either of these addresses, the packet is rerouted to the local device, making it the source and destination simultaneously.
-
-## Loopback Interface
-
-Apart from loopback addresses, there's also a network device known as the "loopback interface." This interface is a virtual network interface implemented in software. The loopback interface is assigned a loopback address and can be used to emulate network connections for various purposes, such as local services or inter-process communications.
-
-## Summary
-
-Loopback plays a crucial role in IP technology by enabling devices to run diagnostic tests and validate the correct functioning of software and hardware components. Using the loopback addresses for IPv4 (`127.0.0.1`) and IPv6 (`::1`), it allows network packets to circulate internally within the local device, facilitating developers to test and verify network operations.
+- [@article@What is a loopback address?](https://www.geeksforgeeks.org/what-is-a-loopback-address/)
+- [@article@Understanding the loopback address and loopback interfaces](https://study-ccna.com/loopback-interface-loopback-address/)

src/data/roadmaps/cyber-security/content/mac-based@OAukNfV5T0KTnIF9jKYRF.md

@@ -1,35 +1,8 @@
 # MAC-based
 
-_Mandatory Access Control (MAC)_ is a robust security model when it comes to hardening, as it enforces strict policies on operating systems and applications regarding system access. In MAC-based hardening, the end-users are not allowed to modify access controls on your system.
+**Mandatory Access Control (MAC)** is a security model in which access to resources is governed by predefined policies set by the system or organization, rather than by individual users. In MAC, access decisions are based on security labels or classifications assigned to both users and resources, such as sensitivity levels or clearance levels. Users cannot change these access controls; they are enforced by the system to maintain strict security standards and prevent unauthorized access. MAC is often used in high-security environments, such as government or military systems, to ensure that data and resources are accessed only by individuals with appropriate authorization.
 
-## How MAC-based Hardening Works
+Learn more from the following resources:
 
-Typical MAC mechanisms work based on predefined security attributes or labels. These labels determine access permissions and are integrated within the system to classify data, resources, and users. Once these labels are in place, the operating system or a trusted security kernel rigorously enforces the constraints on how they access data.
-
-## Benefits of MAC-Based Hardening
-
-MAC-based hardening offers numerous benefits for organizations seeking to improve their cybersecurity posture:
-
-- **Enforced Security Policies**: MAC policies can be pre-configured in accordance with your organization's security requirements, ensuring consistency on all systems.
-- **Limited Access**: Users have limited access to resources, which reduces the potential for insider threats and accidental leaks of sensitive data.
-- **Protection of Sensitive Data**: By preventing unauthorized users from accessing sensitive data, MAC-based hardening helps protect against data breaches and other cybersecurity risks.
-- **Auditing and Compliance**: MAC-based hardening mechanisms help facilitate audits and compliance with industry regulations.
-
-## Popular MAC-based Models
-
-There are various MAC models implemented in modern software systems. Some of the most popular models include:
-
-- **Bell-LaPadula (BLP) Model**: Designed for confidentiality, the BLP Model enforces the "no read up, no write down" rule, meaning that users may only read data at the same or lower levels of sensitivity, while only allowing data to be written to the same or higher levels of sensitivity.
-- **Biba Model**: Focusing on integrity, the Biba Model enforces the "no write up, no read down" rule, which works opposite to BLP Model.
-- **Clark-Wilson Model**: The Clark-Wilson Model emphasizes well-formed transactions, separation of duties, and certification processes to maintain data integrity and confidentiality.
-
-## Implementing MAC-Based Hardening
-
-To implement MAC-based hardening, it's important to follow these general steps:
-
-- **Establish Security Policies**: Define clear policies and guidelines, including security labels, for the various data classifications, users, and resources.
-- **Select an Appropriate MAC Model**: Choose a MAC model suitable for your organization's needs and implement it across your systems.
-- **Train Staff**: Provide training to your staff to ensure understanding and adherence to your organization's MAC-based policies.
-- **Monitor and Audit**: Continually monitor the system for deviations from the MAC policies and perform periodic audits to verify their enforcement.
-
-In summary, MAC-based hardening offers robust access controls by enforcing strict policies in accordance with your organization's security requirements. In doing so, it reduces the potential for unauthorized access to data and resources, ultimately enhancing your cybersecurity posture.
+- [@video@Mandatory Access Control (MAC) Models](https://www.youtube.com/watch?v=mNN-fEboRAA)
+- [@article@What is Mandatory Access Control?](https://nordlayer.com/learn/access-control/mandatory-access-control/)

src/data/roadmaps/cyber-security/content/macos@dztwr-DSckggQbcNIi4_2.md

@@ -1,29 +1,9 @@
 # MacOS
 
-**macOS** is a series of proprietary graphical operating systems developed and marketed by Apple Inc. It is the primary operating system for Apple's Mac computers. macOS is widely recognized for its sleek design, robust performance, and innovative features, making it one of the most popular operating systems globally.
+**macOS** is an operating system developed by Apple Inc. for its line of Mac computers. Known for its user-friendly interface and integration with other Apple products, macOS features a Unix-based architecture, offering stability, security, and performance. It includes a suite of built-in applications, such as Safari, Mail, and Finder, and supports a wide range of third-party software. macOS provides seamless integration with services like iCloud, Continuity, and Handoff, enhancing productivity and connectivity across Apple devices. Regular updates and a focus on design and usability make macOS a popular choice for both personal and professional use.
 
-## Key Features
+Learn more from the following resources:
 
-- **User-friendly interface**: macOS is known for its simple and intuitive user interface, which makes it easy for users to navigate and use the system efficiently.
+- [@official@MacOS Website](https://www.apple.com/uk/macos/macos-sequoia/)
+- [@video@Mac Tutorial for Beginners 2024](https://www.youtube.com/watch?v=3jeeFc2Vo1U)
 
-- **Security**: macOS has several built-in security features, such as XProtect, Gatekeeper, and FileVault, to provide a secure computing environment. Additionally, macOS is based on UNIX, which is known for its strong security and stability.
-
-- **Integration with Apple ecosystem**: macOS is seamlessly integrated with Apple's software and hardware ecosystem, including iOS, iCloud, and other Apple devices, providing a consistent and well-connected user experience.
-
-- **App Store**: Apple's App Store offers a large and diverse selection of applications for macOS, ensuring easy and secure software downloads and installations.
-
-- **Time Machine**: macOS's Time Machine feature provides an easy and automatic way to back up your data, ensuring you never lose important files and can recover from system crashes.
-
-## Security Tips
-
-- **Keep your macOS up-to-date**: Always ensure that your macOS is running the latest version and security updates, as Apple regularly releases patches to fix potential vulnerabilities.
-
-- **Enable the Firewall**: Make sure to enable macOS's built-in firewall to protect your system from unauthorized access and potential intrusions.
-
-- **Use strong, unique passwords**: Ensure that your macOS user account is protected with a strong, unique password and enable two-factor authentication for your Apple ID.
-
-- **Be cautious with downloads**: Be careful when downloading and installing software from unknown sources. Use the macOS App Store whenever possible, and avoid downloading from third-party websites.
-
-- **Install antivirus software**: To add an extra layer of security, consider installing a reputable antivirus program on your Mac to protect against malware and other threats.
-
-By following these security tips and staying vigilant, users can ensure their Mac remains a secure and enjoyable computing environment.

src/data/roadmaps/cyber-security/content/man@LrwTMH_1fTd8iB9wJg-0t.md

@@ -1,32 +1,8 @@
 # MAN
 
-A Metropolitan Area Network **(MAN)** is a type of computer network that spans across a metropolitan area or a large geographical area, typically covering a city or a region. It is designed to interconnect various local area networks **(LANs)** and wide area networks **(WANs)** to enable communication and data exchange between different locations within the metropolitan area.
+A **Metropolitan Area Network (MAN)** is a type of network that spans a city or large campus, connecting multiple local area networks (LANs) within that geographic area. MANs are designed to provide high-speed data transfer and communication services to organizations, institutions, or businesses across a city. They support a variety of applications, including internet access, intranet connectivity, and data sharing among multiple locations. Typically, MANs are faster and cover a broader area than LANs but are smaller in scope compared to wide area networks (WANs).
 
-## Examples of MAN
+Learn more from the following resources:
 
-Some examples of Metropolitan Area Networks **(MANs)** include:
-
-1. **Cable TV Networks:** Many cable TV networks also offer internet services to their subscribers, creating a MAN that covers a specific metropolitan area.
-2. **Educational Institutions:** Universities, colleges, and research institutions often have their own MANs to interconnect their campuses and facilities spread across a metropolitan area.
-3. **City-Wide Wi-Fi Networks:** Some cities have established their own Wi-Fi networks to provide internet access to residents and businesses, creating a MAN that covers the entire city.
-4. **Public Transportation Networks:** Some metropolitan areas have implemented MANs to provide internet connectivity on public transportation networks such as buses and trains.
-
-## Advantages of MAN
-
-- **Improved Connectivity:** MANs provide a high-speed and reliable means of communication between different locations within a metropolitan area, facilitating efficient data exchange and collaboration among organizations, businesses, and individuals.
-
-- **Cost-Effective:** Compared to establishing multiple separate networks for each location, implementing a MAN can be more cost-effective as it allows for shared infrastructure and resources, reducing overall costs of networking equipment and maintenance.
-
-- **Scalability:** MANs are highly scalable and can be expanded to accommodate new locations or increased network traffic as the metropolitan area grows, making it a flexible solution for evolving connectivity needs.
-
-- **Centralized Management:** A MAN allows for centralized management of the network, making it easier to monitor and control network operations, troubleshoot issues, and implement security measures.
-
-## Disadvantages of MAN
-
-- **Complexity:** MANs can be complex to design, implement, and maintain due to their large scale and geographical spread. They require skilled network administrators and engineers to manage and troubleshoot the network effectively.
-
-- **Cost of Implementation:** Establishing a MAN requires significant upfront investment in networking infrastructure and equipment, which can be a barrier to entry for smaller organizations or municipalities.
-
-- **Limited Coverage:** MANs are typically limited to metropolitan areas, and their coverage may not extend to remote or rural areas outside the metropolitan region, which can pose connectivity challenges for organizations located in those areas.
-
-- **Vulnerability to Single Point of Failure:** Since MANs are centralized networks, they are susceptible to a single point of failure, such as a failure in the main network node, which can disrupt the entire network and impact communication and data exchange among connected locations.
+- [@article@What is a Metropolitan Area Network?](https://www.cloudflare.com/en-gb/learning/network-layer/what-is-a-metropolitan-area-network/)
+- [@video@Network Types: MAN](https://youtu.be/4_zSIXb7tLQ?si=1jTQ5C9PT4WUOztP&t=183)

src/data/roadmaps/cyber-security/content/memdump@wspNQPmqWRjKoFm6x_bVw.md

@@ -1,26 +1,8 @@
 # memdump
 
-Memdump is a handy tool designed for forensic analysis of a system's memory. The main purpose of Memdump is to extract valuable information from the RAM of a computer during a cyber security incident or investigation. By analyzing the memory dump, cyber security professionals can gain insights into the attacker's methods, identify malicious processes, and uncover potential evidence for digital forensics purposes.
+**memdump** is a tool or process used to capture the contents of a computer's physical memory (RAM) for analysis. This "memory dump" can be useful in digital forensics, debugging, or incident response to identify active processes, open files, network connections, or potentially malicious code running in memory. By analyzing a memory dump, security professionals can investigate malware, recover encryption keys, or gather evidence in case of a breach. Tools like `memdump` (Linux utility) or `DumpIt` (Windows) are commonly used to perform this process.
 
-## Key Features
+Learn more from the following resources:
 
-- **Memory Dumping**: Memdump allows you to create an image of the RAM of a computer, capturing the memory contents for later analysis.
-- **File Extraction**: With Memdump, you can extract executable files or any other file types from the memory dump to investigate potential malware or data theft.
-- **String Analysis**: Memdump can help you identify suspicious strings within the memory dump, which may provide crucial information about an ongoing attack or malware's behavior.
-- **Compatibility**: Memdump is compatible with various operating systems, including Windows, Linux, and macOS.
+- [@official@memdump](https://www.kali.org/tools/memdump/)
 
-## Example Usage
-
-For a Windows environment, you can use Memdump as follows:
-
-```
-memdump.exe -O output_file_path
-```
-
-This command will create a memory dump of the entire RAM of the system and save it to the specified output file path. You can then analyze this memory dump using specialized forensic tools to uncover valuable information about any cyber security incidents.
-
-Remember that Memdump should always be executed with administrator privileges so that it can access the entire memory space.
-
-## Conclusion
-
-Memdump is a powerful forensic tool that can greatly assist you in conducting an incident response or discovery process. By capturing and analyzing a system's memory, you can identify threats, gather evidence, and ultimately enhance your overall cyber security posture.

src/data/roadmaps/cyber-security/content/mfa--2fa@pnfVrOjDeG1uYAeqHxhJP.md

@@ -1,29 +1,8 @@
 # MFA and 2FA
 
-## Introduction
+**Multi-Factor Authentication (MFA)** and **Two-Factor Authentication (2FA)** are security methods that require users to provide two or more forms of verification to access a system. **2FA** specifically uses two factors, typically combining something the user knows (like a password) with something they have (like a phone or token) or something they are (like a fingerprint). **MFA**, on the other hand, can involve additional layers of authentication beyond two factors, further enhancing security. Both methods aim to strengthen access controls by making it harder for unauthorized individuals to gain access, even if passwords are compromised.
 
-Multi-Factor Authentication (MFA) and Two-Factor Authentication (2FA) are security measures designed to enhance the protection of user accounts and sensitive information. These supplementary methods require the user to provide more than one form of verification to access an account, making it more difficult for unauthorized users to gain access. In this section, we'll discuss the basics of MFA and 2FA and why they are crucial to cybersecurity.
+Learn more from the following resources:
 
-## Two-Factor Authentication (2FA)
-
-2FA strengthens security by requiring two distinct forms of verification before granting access. This means that even if a malicious actor has your password, they will still need the second form of verification to access your account, reducing the risk of unauthorized access.
-
-Two-Factor Authentication usually involves a combination of:
-
-- Something you know (e.g., passwords, PINs)
-- Something you have (e.g., physical tokens, mobile phones)
-- Something you are (e.g., biometrics, such as fingerprints or facial recognition)
-
-A common example of 2FA is when you receive a unique code via SMS when logging into a website or access sensitive information. You will need to provide that code along with your password to gain access, adding an extra layer of security.
-
-## Multi-Factor Authentication (MFA)
-
-MFA enhances security even further by requiring more than two forms of verification, incorporating three or more factors from the categories mentioned earlier (knowledge, possession, and inherence). By incorporating additional authentication methods, MFA raises the bar for attackers, making it much more difficult for them to gain access.
-
-The main advantage of using MFA over 2FA is that even if one factor is compromised, there are still additional hurdles for an attacker to overcome. For example, if someone intercepts your mobile phone as the second factor, they would still have to bypass a biometric authentication requirement.
-
-## Importance in Cybersecurity
-
-Using MFA and 2FA lends more security to user accounts, lowering the chances of being compromised. They provide multiple layers of protection, making it significantly harder for cybercriminals to breach accounts or gain unauthorized access.
-
-Implementing 2FA and MFA should be a priority for businesses and individuals alike in order to maintain a high level of cybersecurity. By educating users on the benefits and importance of these forms of authentication and ensuring their widespread adoption, we can create a more secure online environment.
+- [@article@What is MFA?](https://www.onelogin.com/learn/what-is-mfa)
+- [@article@What is 2FA?](https://www.microsoft.com/en-gb/security/business/security-101/what-is-two-factor-authentication-2fa)

src/data/roadmaps/cyber-security/content/ms-office-suite@-5haJATqlmj0SFSFAqN6A.md

@@ -1,19 +1,8 @@
 # Microsoft Office Suite
 
-Microsoft Office Suite, often referred to as MS Office, is one of the most widely-used software suites for productivity, communication, and document creation. It is a comprehensive set of applications designed to increase efficiency in both professional and personal settings. Below is an overview of the key applications within the MS Office Suite:
+The **Microsoft Office Suite** is a collection of productivity software developed by Microsoft, commonly used in both personal and professional settings. It includes core applications such as **Word** (word processing), **Excel** (spreadsheets), **PowerPoint** (presentations), and **Outlook** (email and calendar). Other applications in the suite may include **Access** (database management), **OneNote** (note-taking), and **Teams** (collaboration and communication). The suite offers integrated tools for creating, managing, and sharing documents, data, and communications, supporting a wide range of business and personal productivity tasks.
 
-- **Microsoft Word:** A versatile word processing application that allows users to create, format, and edit text documents. It is equipped with various tools for formatting, spell-checking, and collaborating in real-time with others.
+Learn more from the following resources:
 
-- **Microsoft Excel:** Excel is a powerful spreadsheet application that enables users to create, edit, and analyze data in a tabulated format. Functions and formulas simplify complicated calculations while charts and graphs help visualize data.
-
-- **Microsoft PowerPoint:** PowerPoint is a widely-used presentation software that allows users to create visually engaging slides with various multimedia elements. It is an effective tool for sharing ideas, data and presenting complex concepts in an understandable format.
-
-- **Microsoft Outlook:** Outlook is an email management system that integrates emails, calendars, tasks, and contacts into a single platform. It enables users to efficiently manage their inboxes, organize schedules and manage contacts.
-
-- **Microsoft OneNote:** OneNote is a digital notebook that allows users to take notes, annotate, and capture and store information from various sources (including web pages), organize it intuitively, and sync it across devices.
-
-- **Microsoft Access:** Access is a relational database management system that provides users with the tools needed to create, modify, and store data in an organized manner.
-
-As part of Microsoft's Office 365 subscription, users also have access to cloud-based services like OneDrive, Skype for Business, and Microsoft Teams, which further enhance collaboration and productivity.
-
-When considering your cyber security strategy, it is essential to ensure that your MS Office applications are always up-to-date. Regular updates improve security, fix bugs, and protect against new threats. Additionally, it is crucial to follow best practices, such as using strong passwords and only downloading reputable add-ins, to minimize potential risks.
+- [@official@Microsoft Office Suite Directory](https://www.microsoft.com/en-gb/microsoft-365/products-apps-services)
+- [@video@Every Office 365 App Explained](https://www.youtube.com/watch?v=2W0T2qGZ9Dc)

src/data/roadmaps/cyber-security/content/nac-based@6oAzYfwsHQYNVbi7c2Tly.md

@@ -1,27 +1,8 @@
 # NAC-based
 
-Network Access Control (NAC) based hardening is a crucial component in enhancing the security of your network infrastructure. NAC provides organizations with the ability to control and manage access to the network resources, ensuring that only authorized users and devices can connect to the network. It plays a vital role in reducing the attack surface and preventing unauthorized access to sensitive data and resources.
+Network Access Control (NAC) based hardening is a crucial component in enhancing the security of your network infrastructure. NAC provides organizations with the ability to control and manage access to the network resources, ensuring that only authorized users and devices can connect to the network. It plays a vital role in reducing the attack surface and preventing unauthorized access to sensitive data and resources. By implementing NAC-based hardening in your cybersecurity strategy, you protect your organization from threats and maintain secure access to critical resources.
 
-## Key Features of NAC-Based Hardening
+Learn more from the following resouces:
 
-- **Authentication and Authorization:** NAC-based hardening ensures that users and devices connecting to the network are properly authenticated and have been granted appropriate access permissions. This includes the use of strong passwords, multi-factor authentication (MFA), and enforcing access control policies.
-
-- **Endpoint Health Checks:** NAC solutions continuously monitor the health and compliance of endpoints, such as whether anti-virus software and security patches are up to date. If a device is found to be non-compliant, it can be automatically quarantined or disconnected from the network, thus preventing the spread of threats.
-
-- **Real-Time Visibility and Control:** NAC provides real-time visibility into the devices connected to your network, allowing you to identify and control risks proactively. This includes monitoring for unauthorized devices, unusual behavior, or known security gaps.
-
-- **Device Profiling:** NAC-based hardening can automatically identify and classify devices connected to the network, making it easier to enforce access control policies based on device type and ownership.
-
-- **Policy Enforcement:** NAC solutions enforce granular access policies for users and devices, reducing the attack surface and limiting the potential damage of a security breach. Policies can be based on factors such as user role, device type, and location.
-
-## NAC Best Practices
-
-To get the most out of a NAC-based hardening approach, here are some best practices to consider:
-
-- **Develop a Comprehensive Access Control Policy:** Clearly define the roles, responsibilities, and access permissions within your organization, ensuring that users have the least privilege required to perform their job functions.
-- **Regularly Review and Update Policies:** As your organization evolves, so should your NAC policies. Regularly review and update policies to maintain alignment with organizational changes.
-- **Educate Users:** Educate end-users about the importance of security and their role in maintaining a secure network. Offer training on topics such as password management, avoiding phishing attacks, and identifying social engineering attempts.
-- **Ensure Comprehensive Coverage:** Ensure that your NAC solution covers all entry points to your network, including remote access, wireless networks, and guest access.
-- **Monitor and Respond to NAC Alerts:** NAC solutions generate alerts when suspicious activity is detected, such as an unauthorized device trying to connect to the network. Make sure you have a process in place to respond to these alerts in a timely manner.
-
-By implementing NAC-based hardening in your cybersecurity strategy, you protect your organization from threats and maintain secure access to critical resources.
+- [@video@Network Access Control](https://www.youtube.com/watch?v=hXeFJ05J4pQ)
+- [@article@What is Network Access Control](https://www.fortinet.com/resources/cyberglossary/what-is-network-access-control)

src/data/roadmaps/cyber-security/content/nat@Kkd3f_0OYNCdpDgrJ-_Ju.md

@@ -1,25 +1,8 @@
 # NAT
 
-Network Address Translation (NAT) is a key element in modern network security. It acts as a middleman between devices on your local area network (LAN) and the external internet. NAT helps to conserve IP addresses and improve privacy and security by translating IP addresses within private networks to public IP addresses for communication on the internet.
+**Network Address Translation (NAT)** is a method used to modify IP address information in packet headers while they are in transit across a network. NAT allows multiple devices on a private network to share a single public IP address for accessing external resources, helping conserve the limited number of available public IP addresses. It also enhances security by hiding internal IP addresses from the public internet. Common types of NAT include **Static NAT** (one-to-one mapping), **Dynamic NAT** (many-to-many mapping), and **Port Address Translation (PAT)** or **NAT overload** (many-to-one mapping, commonly used in home routers).
 
-## How NAT works
+Learn more from the following resources:
 
-NAT is implemented on a router, firewall or a similar networking device. When devices in the LAN communicate with external networks, NAT allows these devices to share a single public IP address, which is registered on the internet. This is achieved through the following translation types:
-
-- **Static NAT:** A one-to-one mapping between a private IP address and a public IP address. Each private address is mapped to a unique public address.
-- **Dynamic NAT:** A one-to-one mapping between a private IP address and a public IP address, but the public address is chosen from a pool rather than being pre-assigned.
-- **Port Address Translation (PAT):** Also known as NAT Overload, PAT maps multiple private IP addresses to a single public IP address, using unique source port numbers to differentiate the connections.
-
-## Advantages of NAT
-
-- **Conservation of IP addresses:** NAT helps mitigate the shortage of IPv4 addresses by allowing multiple devices to share a single public IP address, reducing the need for organizations to purchase additional IP addresses.
-- **Security and Privacy:** By hiding internal IP addresses, NAT adds a layer of obscurity, making it harder for attackers to target specific devices within your network.
-- **Flexibility:** NAT enables you to change your internal IP address scheme without having to update the public IP address, reducing time and effort in reconfiguring your network.
-
-## Disadvantages of NAT
-
-- **Compatibility issues:** Certain applications and protocols may encounter issues when operating behind a NAT environment, such as IP-based authentication or peer-to-peer networking.
-- **Performance impact:** The translation process may introduce latency and reduce performance in high-traffic networks.
-- **End-to-End Connectivity:** NAT generally breaks the end-to-end communication model of the internet, which can cause issues in some scenarios.
-
-In summary, NAT plays a crucial role in modern cybersecurity by conserving IP addresses, obscuring internal networks and providing a level of security against external threats. While there are some disadvantages, its benefits make it an essential component in network security.
+- [@article@How NAT Works](https://www.comptia.org/content/guides/what-is-network-address-translation)
+- [@video@NAT explained](https://www.youtube.com/watch?v=FTUV0t6JaDA)

src/data/roadmaps/cyber-security/content/navigating-using-gui-and-cli@MGitS_eJBoY99zOR-W3F4.md

@@ -1,7 +1,5 @@
 # Navigating using GUI and CLI
 
-Graphical User Interface (GUI) and Command Line Interface (CLI) are the two essential methods to navigate through a computer system or a network device. Both these interfaces are crucial for understanding and managing cyber security.
-
 ## Graphical User Interface (GUI)
 
 A Graphical User Interface (GUI) is a type of user interface that allows users to interact with a software program, computer, or network device using images, icons, and visual indicators. The GUI is designed to make the user experience more intuitive, as it enables users to perform tasks using a mouse and a keyboard without having to delve into complex commands. Most modern operating systems (Windows, macOS, and Linux) offer GUIs as the primary means of interaction.
@@ -34,4 +32,3 @@ A Command Line Interface (CLI) is a text-based interface that allows users to in
 
 By understanding how to navigate and use both GUI and CLI, you will be better equipped to manage and secure your computer systems and network devices, as well as perform various cyber security tasks that may require a combination of these interfaces. It is essential to be familiar with both methods, as some tasks may require the precision and control offered by CLI, while others may be more efficiently performed using a GUI.
 
-In the following sections, we will discuss some common CLI tools and their usage, along with how to secure and manage your computer systems and network devices using these interfaces. Stay tuned!

src/data/roadmaps/cyber-security/content/netflow@xXz-SwvXA2cLfdCd-hLtW.md

@@ -0,0 +1,8 @@
+# NetFlow
+
+**NetFlow** is a network protocol developed by Cisco for collecting and analyzing network traffic data. It provides detailed information about network flows, including the source and destination IP addresses, ports, and the amount of data transferred. NetFlow data helps network administrators monitor traffic patterns, assess network performance, and identify potential security threats. By analyzing flow data, organizations can gain insights into bandwidth usage, detect anomalies, and optimize network resources. NetFlow is widely supported across various network devices and often integrated with network management and security tools for enhanced visibility and control.
+
+Learn more from the following resources:
+
+- [@official@Cisco NetFlow Website](https://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-netflow/index.html)
+- [@video@What is NetFlow?](https://www.youtube.com/watch?v=aqTpUmUibB8)

src/data/roadmaps/cyber-security/content/netstat@2M3PRbGzo14agbEPe32ww.md

@@ -1,25 +1,8 @@
 # netstat
 
-Netstat, short for 'network statistics', is a command-line tool that provides valuable information about the network connections, routing tables, and network interface statistics on a computer system. Netstat can help in diagnosing and troubleshooting network-related issues by displaying real-time data about network traffic, connections, routes, and more.
+**netstat** (network statistics) is a command-line tool used to display network connections, routing tables, and network interface statistics. It provides information about active TCP and UDP connections, listening ports, and the status of network interfaces. By using **netstat**, users can monitor network activity, diagnose connectivity issues, and identify open ports and services running on a system. The tool is available on various operating systems, including Windows, macOS, and Linux, and is often employed for network troubleshooting and security assessments.
 
-## Key Features
+Learn more from the following resources:
 
-- **Network Connections:** Netstat can show open and active network connections, including inbound and outbound, as well as display the ports on which your system is currently listening.
-- **Routing Tables:** Netstat provides information about your system's routing tables, which can help you identify the path a packet takes to reach its destination.
-- **Network Interface Statistics:** Netstat displays statistics for network interfaces, covering details such as packets transmitted, packets received, errors, and more.
-
-## Common Netstat Commands
-
-- `netstat -a`: Displays all active connections and listening ports
-- `netstat -n`: Displays active connections without resolving hostnames (faster)
-- `netstat -r`: Displays the routing table
-- `netstat -i`: Displays network interfaces and their statistics
-- `netstat -s`: Displays network protocol statistics (TCP, UDP, ICMP)
-
-## Example Use Cases
-
-- **Identify Open Ports:** You can use netstat to determine which ports are open and listening on your system, helping you identify potential security vulnerabilities.
-- **Monitor Network Connections:** Netstat allows you to monitor active connections to ensure that nothing unauthorized or suspicious is connecting to your system.
-- **Troubleshoot Network Issues:** By displaying routing table information, netstat can help you understand the pathways your system takes to reach various destinations, which can be crucial when diagnosing network problems.
-
-Netstat is a versatile and powerful tool for gaining insights into your system's network behavior. Armed with this knowledge, you'll be better equipped to address potential vulnerabilities and monitor your system's health in the context of cyber security.
+- [@article@netstat command](https://docs.oracle.com/cd/E19504-01/802-5753/6i9g71m3i/index.html)
+- [@video@netstat Command Explained](https://www.youtube.com/watch?v=8UZFpCQeXnM)

src/data/roadmaps/cyber-security/content/networking-knowledge@gSLr-Lc119eX9Ig-kDzJ2.md

@@ -1,21 +1,17 @@
 # Networking Knowledge
 
-In the world of cyber security, having a strong foundation in networking knowledge is crucial. It's important to understand the fundamental concepts and mechanisms that govern how data is transferred, communicated, and secured across digital networks.
+**Networking knowledge** encompasses understanding the principles, technologies, and protocols involved in connecting and managing networks. Key areas include:
 
-## Topics
+- **Network Protocols**: Familiarity with protocols like TCP/IP, DNS, DHCP, and HTTP, which govern data transmission and communication between devices.
+- **Network Topologies**: Knowledge of network architectures such as star, ring, mesh, and hybrid topologies, which influence how devices are interconnected.
+- **IP Addressing and Subnetting**: Understanding IP address allocation, subnetting, and CIDR notation for organizing and managing network addresses.
+- **Network Devices**: Knowledge of routers, switches, firewalls, and access points, and their roles in directing traffic, providing security, and enabling connectivity.
+- **Network Security**: Awareness of security measures like VPNs, firewalls, IDS/IPS, and encryption to protect data and prevent unauthorized access.
+- **Troubleshooting**: Skills in diagnosing and resolving network issues using tools like ping, traceroute, and network analyzers.
 
-- **Network Architecture**: Learn about the different networking models, such as the OSI model and TCP/IP model, which define how data is structured, transmitted, and received in a network.
+This knowledge is essential for designing, implementing, and maintaining effective and secure network infrastructures.
 
-- **Network Protocols**: Familiarize yourself with various network protocols that are essential for effective communication between devices, including HTTP, HTTPS, FTP, and more. These protocols ensure that data is transmitted reliably and securely across networks.
+Learn more from the following resources:
 
-- **IP Addressing and Subnetting**: Gain an understanding of IP addresses (both IPv4 and IPv6), how they are assigned, and how subnetting works to divide networks into smaller segments for better management and security.
-
-- **Routing and Switching**: Learn about the roles of routers and switches in a network, as well as related technologies and protocols like DHCP, NAT, and various routing protocols (such as OSPF and BGP).
-
-- **Wireless Networking**: Delve into the world of wireless networks by studying the different types of wireless technologies like Wi-Fi, Bluetooth, and cellular networks. Understand the security concerns and best practices associated with wireless communication.
-
-- **Network Security**: Explore various techniques and tools used to defend networks from cyber threats, including firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), and VPNs. Learn about security protocols like SSL/TLS, encryption algorithms, and secure access control mechanisms.
-
-- **Network Troubleshooting**: Understand common network issues and how to resolve them, using various network troubleshooting tools and methodologies like ping, traceroute, and Wireshark.
-
-By developing a strong foundation in networking knowledge, you will be well-equipped to tackle various cyber security challenges and protect your digital assets from potential threats. Remember, the ever-evolving landscape of cyber security demands continuous learning and updating of skills to stay ahead in the game.
+- [@article@What are Network Protocols?](https://www.solarwinds.com/resources/it-glossary/network-protocols)
+- [@article@Types of Network Topology](https://www.geeksforgeeks.org/types-of-network-topology/)

src/data/roadmaps/cyber-security/content/nfc@hwAUFLYpc_ftCfXq95dey.md

@@ -1,39 +1,9 @@
 # NFC
 
-**Near Field Communication**, or **NFC**, is a short-range wireless communication technology that enables devices to interact with each other within a close proximity, typically within a few centimeters. It operates at a frequency of 13.56 MHz and can be used for various applications, such as contactless payment systems, secure access control, and data sharing between devices like smartphones, tablets, and other compatible gadgets.
+**Near Field Communication (NFC)** is a short-range wireless technology that allows devices to communicate and exchange data over very short distances, typically up to 4 inches (10 cm). NFC is commonly used for applications such as contactless payments, electronic ticketing, and data transfer between devices. It operates at a frequency of 13.56 MHz and supports various modes, including peer-to-peer communication, card emulation, and reader/writer modes. NFC enables quick and secure interactions with minimal setup, making it convenient for mobile payments, access control, and sharing information.
 
-## How NFC works
-
-When two NFC-enabled devices are brought close to each other, a connection is established, and they can exchange data with each other. This communication is enabled through _NFC Tags_ and _NFC Readers_. NFC Tags are small integrated circuits that store and transmit data, while NFC Readers are devices capable of reading the data stored in NFC Tags.
-
-## NFC Modes
-
-NFC operates primarily in three modes:
-
-- **Reader/Writer Mode**: This mode enables the NFC device to read or write data from or to NFC Tags. For example, you can scan an NFC Tag on a poster to access more information about a product or service.
-- **Peer-to-Peer Mode**: This mode allows two NFC-enabled devices to exchange information directly. Examples include sharing data such as contact information, photos, or connecting devices for multiplayer gaming.
-- **Card Emulation Mode**: This mode allows an NFC device to act like a smart card or access card, enabling contactless payment and secure access control applications.
-
-## Security Concerns
-
-While NFC brings convenience through its numerous applications, it also poses security risks, and it's essential to be aware of these. Some possible concerns include:
-
-- **Eavesdropping**: Attackers can potentially intercept data exchange between NFC devices if they manage to get into the communication range.
-- **Data manipulation**: Attackers might alter or manipulate the data exchanged between the devices.
-- **Unauthorized access**: An attacker can potentially exploit a vulnerability in your device, and gain unauthorized access to sensitive information.
-
-## Security Best Practices
-
-To minimize the risks associated with NFC, follow these best practices:
-
-- Keep your device's firmware and applications updated to minimize known vulnerabilities.
-- Use strong and unique passwords for secure NFC applications and services.
-- Turn off NFC when not in use to prevent unauthorized access.
-- Be cautious when scanning unknown NFC Tags and interacting with unfamiliar devices.
-- Ensure you're using trusted and secure apps to handle your NFC transactions.
-
-In conclusion, understanding the basics of NFC and adhering to security best practices will help ensure that you can safely and effectively use this innovative technology.
+Learn more from the following resources:
 
 - [@article@The Beginner's Guide to NFCs](https://www.spiceworks.com/tech/networking/articles/what-is-near-field-communication/)
 - [@article@NFC Guide: All You Need to Know About Near Field Communication](https://squareup.com/us/en/the-bottom-line/managing-your-finances/nfc)
-- [@video@NFC Explained: What is NFC? How NFC Works? Applications of NFC](https://youtu.be/eWPtt2hLnJk)
+- [@video@NFC Explained: What is NFC? How NFC Works? Applications of NFC](https://youtu.be/eWPtt2hLnJk)

src/data/roadmaps/cyber-security/content/nips@7w9qj16OD4pUzq-ItdxeK.md

@@ -0,0 +1,8 @@
+# NIPS
+
+A **Network Intrusion Prevention System (NIPS)** is a security technology designed to monitor, detect, and prevent malicious activities or policy violations on a network. Unlike intrusion detection systems (IDS), which only alert on potential threats, a NIPS actively blocks or mitigates suspicious traffic in real-time. It analyzes network traffic patterns, inspects packet contents, and uses predefined signatures or behavioral analysis to identify threats. By preventing attacks such as malware, unauthorized access, and denial-of-service (DoS) attacks, a NIPS helps protect network integrity and maintain secure operations.
+
+Learn more from the following resources:
+
+- [@article@What is an Intrusion Prevention System?](https://www.paloaltonetworks.co.uk/cyberpedia/what-is-an-intrusion-prevention-system-ips)
+- [@video@Intrusion Prevention - SY0-601 CompTIA Security+](https://www.youtube.com/watch?v=WPPSsFnWOYg)

src/data/roadmaps/cyber-security/content/nist@SOkJUTd1NUKSwYMIprv4m.md

@@ -1,36 +1,8 @@
 # NIST
 
-[NIST](https://www.nist.gov/) is an agency under the U.S. Department of Commerce that develops and promotes measurement, standards, and technology. One of their primary responsibilities is the development of cyber security standards and guidelines, which help organizations improve their security posture by following the best practices and recommendations laid out by NIST.
+**NIST (National Institute of Standards and Technology)** is a U.S. federal agency that develops and promotes measurement standards, technology, and best practices. In the context of cybersecurity, NIST provides widely recognized guidelines and frameworks, such as the **NIST Cybersecurity Framework (CSF)**, which offers a structured approach to managing and mitigating cybersecurity risks. NIST also publishes the **NIST Special Publication (SP) 800 series**, which includes standards and guidelines for securing information systems, protecting data, and ensuring system integrity. These resources are essential for organizations seeking to enhance their security posture and comply with industry regulations.
 
-Some important NIST publications related to cyber security are:
+Learn more from the following resources:
 
-## NIST Cybersecurity Framework
-
-The [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework) provides a structure for managing cyber risks and helps organizations understand, communicate, and manage their cyber risks. It outlines five core functions:
-
-- Identify – Develop understanding of risks to systems, assets, data, and capabilities
-- Protect – Implement safeguards to ensure delivery of critical infrastructure services
-- Detect – Identify occurrence of a cybersecurity event in a timely manner
-- Respond – Take action on detected cybersecurity events to contain the impact
-- Recover – Maintain plans for resilience and restore capabilities or services impaired due to a cybersecurity event
-
-## NIST Special Publication 800-53 (SP 800-53)
-
-[NIST SP 800-53](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final) provides guidelines for selecting security and privacy controls for federal information systems as well as for systems that process federal information. This publication defines specific security and privacy controls that can be applied to address various risk factors and offers guidance on tailoring these controls for the unique needs of an organization.
-
-## NIST Special Publication 800-171 (SP 800-171)
-
-[NIST SP 800-171](https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final) addresses security requirements for protecting controlled unclassified information (CUI) in non-federal information systems and organizations. It is particularly relevant for entities that work with federal agencies, as they must meet these requirements in order to manage and safeguard CUI effectively.
-
-## NIST Risk Management Framework (RMF)
-
-The [NIST Risk Management Framework](https://csrc.nist.gov/projects/risk-management/) provides a structured process for organizations to manage security and privacy risks using NIST guidelines and standards. This framework consists of six steps:
-
-- Categorize Information Systems
-- Select Security Controls
-- Implement Security Controls
-- Assess Security Controls
-- Authorize Information Systems
-- Monitor Security Controls
-
-By following NIST cyber security standards, organizations can reduce their vulnerability to cyber-attacks and enhance their overall security posture.
+- [@official@NIST Website](https://www.nist.gov/)
+- [@article@What is NIST?](https://www.encryptionconsulting.com/education-center/nist/)

src/data/roadmaps/cyber-security/content/nmap@Hoou7kWyfB2wx_yFHug_H.md

@@ -1,37 +1,9 @@
-# nmap
+# NMAP
 
-## Nmap
+**Nmap** (Network Mapper) is an open-source network scanning tool used to discover hosts and services on a network, identify open ports, and detect vulnerabilities. It provides detailed information about networked devices, including their IP addresses, operating systems, and running services. Nmap supports various scanning techniques such as TCP SYN scan, UDP scan, and service version detection. It's widely used for network security assessments, vulnerability scanning, and network inventory management, helping administrators and security professionals understand and secure their network environments.
 
-Nmap, short for "Network Mapper," is a powerful and widely used open-source tool for network discovery, scanning, and security auditing. Nmap was originally designed to rapidly scan large networks, but it also works well for scanning single hosts. Security professionals, network administrators, and cyber security enthusiasts alike use Nmap to identify available hosts and services on a network, reveal their version information, and explore network infrastructure.
+Learn more from the following resources:
 
-## Key Features
-
-Nmap offers a multitude of features that can help you gather information about your network:
-
-- **Host Discovery** - Locating active devices on a network.
-- **Port Scanning** - Identifying open network ports and associated services.
-- **Version Detection** - Determining the software and version running on network devices.
-- **Operating System Detection** - Identifying the operating systems of scanned devices.
-- **Scriptable Interaction with the Target** - Using Nmap Scripting Engine (NSE) to automate tasks and extend functionality.
-
-## How It Works
-
-Nmap sends specially crafted packets to the target hosts and analyzes the received responses. Based on this information, it detects active hosts, their operating systems, and the services they are running. It can be used to scan for open ports, check for vulnerabilities, and gather valuable information about target devices.
-
-## Example Usage
-
-Nmap is a command-line tool with several command options. Here is an example of a basic scan:
-
-```
-nmap -v -A 192.168.1.1
-```
-
-This command performs a scan on the target IP address `192.168.1.1`, with `-v` for verbose output and `-A` for aggressive scan mode, which includes operating system and version detection, script scanning, and traceroute.
-
-## Getting Started with Nmap
-
-Nmap is available for download on Windows, Linux, and macOS. You can download the appropriate binary or source package from the [official Nmap website](https://nmap.org/download.html). Extensive documentation, including installation instructions, usage guidelines, and specific features, can be found on the [Nmap reference guide](https://nmap.org/book/man.html).
-
-## Conclusion
-
-Understanding and using Nmap is an essential skill for any cyber security professional or network administrator. With its wide range of features and capabilities, it provides invaluable information about your network infrastructure, enabling you to detect vulnerabilities and improve overall security. Regularly monitoring your network with Nmap and other incident response and discovery tools is a critical aspect of maintaining a strong cyber security posture.
+- [@official@NMAP Website](https://nmap.org/)
+- [@article@NMAP Cheat Sheet](https://www.tutorialspoint.com/nmap-cheat-sheet)
+- [@video@Nmap Tutorial to find Network Vulnerabilities]

src/data/roadmaps/cyber-security/content/nmap@xqwIEyGfdZFxk6QqbPswe.md

@@ -1,35 +1,9 @@
-# nmap
+# NMAP
 
-**Nmap** (Network Mapper) is an open-source network scanner that is widely used in cyber security for discovering hosts and services on a computer network. Nmap allows you to efficiently explore and scan networks to identify open ports, running services, and other security vulnerabilities.
+**Nmap** (Network Mapper) is an open-source network scanning tool used to discover hosts and services on a network, identify open ports, and detect vulnerabilities. It provides detailed information about networked devices, including their IP addresses, operating systems, and running services. Nmap supports various scanning techniques such as TCP SYN scan, UDP scan, and service version detection. It's widely used for network security assessments, vulnerability scanning, and network inventory management, helping administrators and security professionals understand and secure their network environments.
 
-## Features of Nmap
+Learn more from the following resources:
 
-- **Host Discovery**: Nmap facilitates finding hosts on the network using various techniques such as ICMP echo requests, TCP SYN/ACK probes, and ARP scans.
-
-- **Port Scanning**: Nmap can identify open ports on target hosts, which can reveal potential security vulnerabilities and provide crucial information during a penetration test.
-
-- **Service and Version Detection**: Nmap can detect the name and version of the services running on target hosts. This information helps to identify software that might be outdated or have known security flaws.
-
-- **Operating System Detection**: Nmap can make intelligent guesses about the operating system of a target host, which can be useful for tuning your attack strategy based on the vulnerabilities of specific systems.
-
-- **Scriptable**: Nmap has a built-in scripting engine (NSE) that allows users to write custom scripts for automating and extending its functionality.
-
-## How to use Nmap
-
-Nmap can be installed on various platforms such as Windows, Linux, and macOS. After installation, Nmap can be used via the command line with different options and flags, depending on the desired scan type.
-
-For example, to perform a simple host and port discovery, the following command can be used:
-
-```bash
-nmap -sn -p 80,443 192.168.0.0/24
-```
-
-This command will perform a "ping scan" (`-sn`) on the specified IP range (`192.168.0.0/24`) and check for open ports 80 and 443.
-
-## Important Notes
-
-- While Nmap is a valuable tool for cyber security professionals, it can also be used by malicious attackers to gather information about potential targets. It is essential to use Nmap responsibly and only on networks and systems that you have permission to scan.
-
-- Scanning large networks can generate considerable traffic and may impact the performance of the target hosts. It is important to configure your scans appropriately and be mindful of potential network disruptions.
-
-For more information and usage examples, refer to the [official Nmap documentation](https://nmap.org/book/man.html).
+- [@official@NMAP Website](https://nmap.org/)
+- [@article@NMAP Cheat Sheet](https://www.tutorialspoint.com/nmap-cheat-sheet)
+- [@video@Nmap Tutorial to find Network Vulnerabilities](https://www.youtube.com/watch?v=4t4kBkMsDbQ)

src/data/roadmaps/cyber-security/content/nslookup@OUarb1oS1-PX_3OXNR0rV.md

@@ -1,44 +1,8 @@
 # nslookup
 
-NSLookup, short for "Name Server Lookup", is a versatile network administration command-line tool used for querying the Domain Name System (DNS) to obtain information associated with domain names and IP addresses. This tool is available natively in most operating systems such as Windows, MacOS, and Linux distributions.
+**nslookup** is a network utility used to query Domain Name System (DNS) servers for information about domain names and IP addresses. It allows users to obtain details such as IP address mappings for a given domain name, reverse lookups to find domain names associated with an IP address, and DNS record types like A, MX, and CNAME records. nslookup helps troubleshoot DNS-related issues, verify DNS configurations, and analyze DNS records. It can be run from the command line in various operating systems, including Windows, macOS, and Linux.
 
-## Using NSLookup
+Learn more from the following resources
 
-To use NSLookup, open the command prompt or terminal on your device and enter the command `nslookup`, followed by the domain name or IP address you want to query. For example:
-
-```
-nslookup example.com
-```
-
-## Features of NSLookup
-
-- **DNS Record Types**: NSLookup supports various DNS record types like A (IPv4 address), AAAA (IPv6 address), MX (Mail Exchange), NS (Name Servers), and more.
-
-- **Reverse DNS Lookup**: You can perform reverse DNS lookups to find the domain name associated with a specific IP address. For example:
-
-  ```
-  nslookup 192.0.2.1
-  ```
-
-- **Non-interactive mode**: NSLookup can execute single queries without entering the interactive mode. To do this, simply execute the command as mentioned earlier.
-
-- **Interactive mode**: Interactive mode allows you to carry out multiple queries during a single session. To enter the interactive mode, type nslookup without any arguments in your terminal.
-
-## Limitations
-
-Despite being a useful tool, NSLookup has some limitations:
-
-- No support for DNSSEC (Domain Name System Security Extensions).
-- Obsolete or not maintained in some Unix-based systems, replaced with more modern utilities like `dig`.
-
-## Alternatives
-
-Some alternatives to NSLookup include:
-
-- **dig**: "Domain Information Groper" is a flexible DNS utility that supports a wide range of DNS record types and provides more detailed information than NSLookup.
-
-- **host**: Another common DNS lookup tool that provides host-related information for both forward and reverse lookups.
-
-## Conclusion
-
-In summary, NSLookup is a handy DNS query tool for network administrators and users alike. It offers the basic functionality for finding associated domain names, IP addresses, and other DNS data while being simple to use. However, for more advanced needs, you should consider using alternatives like dig or host.
+- [@article@nslookup](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup)
+- [@video@What is Nslookup?](https://www.youtube.com/watch?v=n6pT8lbyhog)

src/data/roadmaps/cyber-security/content/nslookup@tk4iG5i1Ml9w9KRO1tGJU.md

@@ -1,39 +1,8 @@
 # nslookup
 
-**Nslookup** is a network administration command-line tool designed for retrieving information about Domain Name System (DNS) records. DNS is responsible for translating domain names into IP addresses, allowing users to access websites and resources by using human-readable names (e.g., www.example.com) instead of numerical IP addresses.
+**nslookup** is a network utility used to query Domain Name System (DNS) servers for information about domain names and IP addresses. It allows users to obtain details such as IP address mappings for a given domain name, reverse lookups to find domain names associated with an IP address, and DNS record types like A, MX, and CNAME records. nslookup helps troubleshoot DNS-related issues, verify DNS configurations, and analyze DNS records. It can be run from the command line in various operating systems, including Windows, macOS, and Linux.
 
-## Uses
+Learn more from the following resources
 
-- Query DNS servers to verify the configuration of domain names
-- Find the IP address of a specific domain name
-- Troubleshoot DNS-related issues and errors
-- Identify the authoritative DNS servers for a domain
-
-## How to Use
-
-- **Open Command Prompt or Terminal**: Press `Windows key + R`, type `cmd`, and press Enter to open Command Prompt on Windows. On macOS or Linux, open Terminal.
-
-- **Running Nslookup**: To start using Nslookup, type `nslookup` and hit Enter. You'll now see the `>` prompt, indicating you are in Nslookup mode.
-
-- **Query DNS Records**: In Nslookup mode, you can query different types of DNS records by typing the record type followed by the domain name. For instance, to find the A (address) record of www.example.com, type `A www.example.com`. To exit Nslookup mode, type `exit`.
-
-## Commonly Used Record Types
-
-Below are some of the most-commonly queried DNS record types:
-
-- **A**: Stands for 'Address'; returns the IPv4 address associated with a domain name
-- **AAAA**: Stands for 'Address', for IPv6; returns the IPv6 address associated with a domain name
-- **NS**: Stands for 'Name Server'; returns the authoritative DNS servers for a specific domain
-- **MX**: Stands for 'Mail Exchange'; returns the mail server(s) responsible for handling email for a specific domain
-- **CNAME**: Stands for 'Canonical Name'; returns the domain name that an alias is pointing to
-- **TXT**: Stands for 'Text'; returns additional text information that can be associated with a domain, like security policies (e.g., SPF)
-
-## Example
-
-If you want to find the A (IPv4) record for example.com, follow these steps:
-
-- Open Command Prompt or Terminal
-- Type `nslookup` and hit Enter
-- Type `A example.com` and hit Enter
-
-This will return the IPv4 address associated with the domain name example.com.
+- [@article@nslookup](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup)
+- [@video@What is Nslookup?](https://www.youtube.com/watch?v=n6pT8lbyhog)

src/data/roadmaps/cyber-security/content/ntp@tf0TymdPHbplDHvuVIIh4.md

@@ -1,25 +1,9 @@
 # NTP
 
-**NTP** (Network Time Protocol) is a crucial aspect of cybersecurity, as it helps in synchronizing the clocks of computer systems and other devices within a network. Proper time synchronization is vital for various functions, including authentication, logging, and ensuring the accuracy of digital signatures. In this section, we will discuss the importance, primary functions, and potential security risks associated with NTP.
+**Network Time Protocol (NTP)** is a protocol used to synchronize the clocks of computers and network devices over a network. It ensures that all systems maintain accurate and consistent time by coordinating with a hierarchy of time sources, such as atomic clocks or GPS, through network communication. NTP operates over UDP port 123 and uses algorithms to account for network delays and adjust for clock drift, providing millisecond-level accuracy. Proper time synchronization is crucial for applications requiring time-sensitive operations, logging events, and maintaining the integrity of security protocols.
 
-## Importance of NTP in Cybersecurity
+Learn more from the following resources:
 
-- **Authentication**: Many security protocols, such as Kerberos, rely on accurate timekeeping for secure authentication. Time discrepancies may lead to authentication failures, causing disruptions in network services and affecting the overall security of the system.
-- **Logging and Auditing**: Accurate timestamps on log files are essential for identifying and investigating security incidents. Inconsistent timing can make it challenging to track malicious activities and correlate events across systems.
-- **Digital Signatures**: Digital signatures often include a timestamp to indicate when a document was signed. Accurate time synchronization is necessary to prevent tampering or repudiation of digital signatures.
+- [@video@Network Time Protocol (NTP)](https://www.youtube.com/watch?v=BAo5C2qbLq8)
+- [@article@What is NTP?](https://www.pubnub.com/learn/glossary/ntp-protocol/)
 
-## Primary Functions of NTP
-
-- **Clock Synchronization**: NTP helps in coordinating the clocks of all devices within a network by synchronizing them with a designated reference time source, usually a central NTP server.
-- **Time Stratum Hierarchy**: NTP uses a hierarchical system of time servers called "stratum" to maintain time accuracy. Servers at a higher stratum provide time to lower stratum servers, which in turn synchronize the clocks of client devices.
-- **Polling**: NTP clients continually poll their configured NTP servers at regular intervals to maintain accurate time synchronization. This process allows for the clients to adjust their clocks based on the information received from the server.
-
-## Security Risks and Best Practices with NTP
-
-While NTP is essential for maintaining accurate time synchronization across a network, it is not without security risks:
-
-- **NTP Reflection/Amplification Attacks**: These are a type of DDoS (Distributed Denial of Service) attack that leverages misconfigured NTP servers to amplify malicious traffic targeted at a victim's system. To mitigate this risk, ensure your NTP server is securely configured to prevent abuse by attackers.
-- **Time Spoofing**: An attacker can manipulate NTP traffic to alter the time on client devices, potentially causing authentication failures or allowing unauthorized access. Use authentication keys with NTP to ensure the integrity of time updates by verifying the server's identity.
-- **Untrusted Servers**: Obtain time from a reliable time source to prevent tampering. Always configure clients to use trusted NTP servers, like pool.ntp.org, which provides access to a global group of well-maintained NTP servers.
-
-By understanding and implementing these crucial aspects of NTP, you can improve the overall security posture of your network by ensuring accurate time synchronization across all systems.

src/data/roadmaps/cyber-security/content/obfuscation@kxlg6rpfqqoBfmMMg3EkJ.md

@@ -1,43 +1,8 @@
 # Obfuscation
 
-Obfuscation is the practice of making something difficult to understand or find by altering or hiding its appearance or content. In the context of cyber security and cryptography, obfuscation refers to the process of making data, code, or communication less readable and harder to interpret or reverse engineer.
+**Obfuscation** is the practice of deliberately making data, code, or communications difficult to understand or analyze, often to protect intellectual property or enhance security. In software development, obfuscation involves transforming code into a complex or less readable form to hinder reverse engineering or unauthorized access. This technique can include renaming variables and functions to meaningless labels, or altering code structure while preserving functionality. In security contexts, obfuscation can also involve disguising malicious payloads to evade detection by antivirus or security systems.
 
-## 5.1 Why Use Obfuscation?
+Learn more from the following resources:
 
-The primary purpose of obfuscation is to enhance security by:
-
-- Concealing sensitive information from unauthorized access or misuse.
-- Protecting intellectual property (such as proprietary algorithms and code).
-- Preventing or impeding reverse engineering, tampering, or analysis of code or data structures.
-
-Obfuscation can complement other security measures such as encryption, authentication, and access control, but it should not be relied upon as the sole line of defense.
-
-## 5.2 Techniques for Obfuscation
-
-There are several techniques for obfuscating data or code, including:
-
-- **Identifier renaming**: This technique involves changing the names of variables, functions, or objects in code to make it harder for an attacker to understand their purpose or behavior.
-
-  _Example: Renaming `processPayment()` to `a1b2c3()`._
-
-- **Control flow alteration**: This involves modifying the structure of code to make it difficult to follow or analyze, without affecting its functionality. This can include techniques such as inserting dummy loops or conditionals, or changing the order of instructions.
-
-  _Example: Changing a straightforward loop into a series of nested loops with added conditional statements._
-
-- **Data encoding**: Transforming or encoding data can make it less legible and harder to extract or manipulate. This can involve encoding strings or data structures, or splitting data across multiple variables or containers.
-
-  _Example: Encoding a string as a series of character codes or a base64-encoded binary string._
-
-- **Code encryption**: Encrypting portions of code or entire programs can prevent reverse engineering, tampering, or analysis. The code is decrypted at runtime, either by an interpreter or within the application itself.
-
-  _Example: Using a cryptographically secure encryption algorithm, such as AES, to encrypt the main logic of a program._
-
-## 5.3 Limitations and Considerations
-
-While obfuscation can be an effective deterrent against casual or unskilled attackers, it's important to recognize its limitations:
-
-- It is not foolproof: Determined and skilled attackers can often reverse-engineer or deobfuscate code or data if they are motivated enough.
-- Obfuscation can impact performance and maintainability: The added complexity and overhead can make code slower to execute and harder to maintain or update.
-- Relying solely on obfuscation is not recommended: It should be used as one layer in a comprehensive security strategy that includes encryption, authentication, and access control.
-
-In conclusion, obfuscation can be a useful tool to improve the security posture of a system, but it should not be relied upon as the only means of protection.
+- [@article@How does Obfuscation work?](https://www.hypr.com/security-encyclopedia/obfuscation)
+- [@video@Obfuscation - CompTIA Security+](https://www.youtube.com/watch?v=LfuTMzZke4g)

src/data/roadmaps/cyber-security/content/onedrive@MWqnhDKm9jXvDDjkeVNxm.md

@@ -1,23 +1,9 @@
 # OneDrive
 
-OneDrive is a popular cloud storage service provided by Microsoft. Part of the Microsoft 365 suite, OneDrive offers a seamless and secure solution for storing and accessing your files from any device, anytime, and anywhere. Below, we'll discuss some of its features and why it's important to consider for your cloud storage needs.
+**OneDrive** is a cloud storage service provided by Microsoft that allows users to store, sync, and share files and folders online. It integrates seamlessly with Windows and Microsoft 365 applications, enabling users to access their data from any device with an internet connection. OneDrive offers features such as real-time collaboration, file versioning, and automatic backup, making it convenient for personal and professional use. It also provides options for sharing files with others and controlling access permissions, enhancing productivity and data management.
 
-## Features
+Learn more from the following resources:
 
-- **Ease of Access**: OneDrive can be accessed through a web browser, or by using its desktop and mobile apps. It comes integrated with Windows 10 and can also be used on Mac, Android, and iOS devices.
+- [@official@OneDrive Website](https://onedrive.live.com)
+- [@video@Microsoft OneDrive Tutorial](https://www.youtube.com/watch?v=qgw01w0iYjA)
 
-- **Storage Space**: OneDrive offers 5GB free storage for new users, and additional storage can be purchased through its subscription plans. Microsoft 365 subscribers receive 1TB of OneDrive storage with their plan.
-
-- **File Syncing**: OneDrive allows you to sync your files across different devices using the same account. This makes it easier to access your files and work on the same document from different locations.
-
-- **Security and Privacy**: Microsoft ensures that your data is encrypted both at rest and in transit. OneDrive also offers security measures such as two-factor authentication and the ability to recover files from the recycle bin.
-
-- **Collaboration**: OneDrive is integrated with Microsoft Office. This enables you to collaborate on Word, Excel, and PowerPoint files in real-time, and also view and edit files using Office Online.
-
-- **Automatic Backup**: OneDrive offers built-in automatic backup features. It can be configured to backup your files, including documents, pictures, and other files on your computer or device.
-
-- **Version History**: OneDrive keeps version history for your files, allowing you to restore previous versions if needed. This is useful, especially when working on collaborative documents, to ensure no work is lost.
-
-## Importance
-
-OneDrive is an excellent cloud storage solution, fitting the needs of individuals and businesses alike. It offers various features, such as syncing across devices, real-time collaboration, and robust security measures. Whether you need a personal or professional cloud storage solution, OneDrive is worth considering for its versatility and integration with Microsoft's suite of productivity tools.

src/data/roadmaps/cyber-security/content/operating-system-hardening@_S25EOGS3P8647zLM5i-g.md

@@ -1,34 +1,8 @@
 # Operating System Hardening
 
-OS hardening, or Operating System hardening, is the process of strengthening your operating system's security settings to prevent unauthorized access, data breaches, and other malicious activities. This step is essential for enhancing the security posture of your device or network and to minimize potential cyber risks.
+**Operating system hardening** involves configuring and securing an OS to reduce vulnerabilities and improve its defense against attacks. This process includes disabling unnecessary services and ports, applying security patches and updates, configuring strong authentication mechanisms, enforcing least privilege principles, and enabling firewalls and intrusion detection systems. Hardening also involves setting up proper file permissions, securing system logs, and regularly auditing the system to ensure compliance with security policies and best practices. The goal is to minimize the attack surface and protect the OS from potential threats and exploits.
 
-## The Importance of OS Hardening
+Learn more from the following resources
 
-In today's world of evolving cyber threats and vulnerabilities, default security configurations provided by operating systems are often insufficient. OS hardening is necessary to:
-
-- **Inhibit unauthorized access**: Limit the potential entry points for attackers.
-- **Close security gaps**: Reduce the risks of exploits and vulnerabilities in your system.
-- **Prevent data breaches**: Safeguard sensitive data from cybercriminals.
-- **Align with compliance requirements**: Ensure your system complies with industry regulations and standards.
-
-## Key Principles of OS Hardening
-
-Here are some fundamental principles that can help strengthen your operating system security:
-
-- **Least Privilege**: Limit user rights and permissions, only providing the minimum access required for essential tasks. Implement stringent access controls and separation of duties.
-- **Disable or remove unnecessary services**: Unnecessary software, programs, and services can introduce vulnerabilities. Turn them off or uninstall them when not needed.
-- **Patch Management**: Keep your system and applications up-to-date with the latest security patches and updates.
-- **Regular Monitoring**: Implement monitoring mechanisms to detect and respond to potential threats promptly.
-- **Authentication and Password Security**: Enforce strong, unique passwords and use Multi-Factor Authentication (MFA) for added protection.
-
-## Steps for OS Hardening
-
-A comprehensive OS hardening process includes the following steps:
-
-- **Create a Standard Operating Environment (SOE)**: Develop a standardized and secure system configuration as a baseline for all company systems.
-- **Inventory**: Identify and track all the devices, software, and services in your environment and their respective configurations.
-- **Assess current security controls**: Evaluate the existing security settings to identify gaps requiring improvement.
-- **Apply required hardening measures**: Implement necessary changes, including applying patches, updating software, and configuring security settings.
-- **Monitor and review**: Continuously monitor your environment and update your hardening measures and policies as needed.
-
-By incorporating OS hardening into your cybersecurity practices, you can significantly reduce the risks associated with cyber threats and protect your business's valuable assets.
+- [@article@OS Hardening: 15 Best Practices](https://perception-point.io/guides/os-isolation/os-hardening-10-best-practices/)
+- [@video@Hardening Techniques](https://www.youtube.com/watch?v=wXoC46Qr_9Q)

src/data/roadmaps/cyber-security/content/operating-systems@UY6xdt_V3YMkZxZ1hZLvW.md

@@ -1,37 +1,8 @@
 # Operating Systems
 
-An **operating system (OS)** is a crucial component of a computer system as it manages and controls both the hardware and software resources. It provides a user-friendly interface and ensures the seamless functioning of the various applications installed on the computer.
+**Operating systems (OS)** are software that manage computer hardware and provide a platform for applications to run. They handle essential functions such as managing memory, processing tasks, controlling input and output devices, and facilitating file management. Key examples include **Windows**, **macOS**, **Linux**, and **Unix**. Each operating system offers different features and interfaces, tailored to specific user needs or system requirements, from desktop computing to server management and embedded systems.
 
-In the context of cybersecurity, selection and proper maintenance of an operating system is paramount. This section will discuss the three major operating systems: Windows, macOS, and Linux, along with security considerations.
+Learn more from the following resources:
 
-## Windows
-
-Microsoft Windows is ubiquitous amongst desktop and laptop users, making it a primary target for cybercriminals. Attackers often focus on finding and exploiting vulnerabilities within Windows due to its extensive user-base. That said, Windows continues to enhance its built-in security features with updates and patches. Key features include:
-
-- Windows Defender: An antivirus program that detects and removes malware.
-- Windows Firewall: Monitors and controls incoming and outgoing network traffic.
-- BitLocker: A full disk encryption feature for securing data.
-
-As a Windows user, keeping your system up-to-date and using additional security tools such as anti-malware software is vital.
-
-## macOS
-
-The macOS, Apple's operating system for Macintosh computers, holds a reputation for strong security. Apple designed macOS with several built-in features to protect user privacy and data:
-
-- Gatekeeper: Ensures downloaded apps originate from trusted sources.
-- FileVault 2: Offers full-disk encryption for data protection.
-- XProtect: An antivirus tool that scans newly installed apps for malware.
-
-Despite macOS's sound security measures, no operating system is completely immune to threats. Running reputable security software and keeping your macOS updated is essential to safeguard against potential cyberattacks.
-
-## Linux
-
-Linux is an open-source operating system considered to be more secure than its commercial counterparts. Linux uses a multi-user environment, mitigating the impact of potential threats by separating user information and privileges. Other notable features include:
-
-- Software Repositories: Official software repositories maintained by Linux distributions provide trusted sources for software installation.
-- SELinux (Security-Enhanced Linux): A security architecture that allows administrators to control system access.
-- System/package updates: Regular updates offered by distributions hold essential security fixes.
-
-Although Linux distributions are less targeted by cybercriminals, it is vital to follow security best practices, such as keeping your system updated and employing security tools like antivirus software and firewalls.
-
-Remember, the security of your operating system relies on timely updates, proper configuration, and the use of appropriate security tools. Stay vigilant and informed to ensure your system remains secure against ever-evolving cyber threats.
+- [@article@What is an operating system?](https://www.geeksforgeeks.org/what-is-an-operating-system/)
+- [@video@What is an operating system as fast as possible](https://www.youtube.com/watch?v=pVzRTmdd9j0)

src/data/roadmaps/cyber-security/content/os-independent-troubleshooting@pJUhQin--BGMuXHPwx3JJ.md

@@ -1,7 +1,5 @@
 # OS-Independent Troubleshooting
 
-OS-independent troubleshooting techniques are essential for every cybersecurity professional since they allow you to effectively diagnose and resolve issues on any operating system (OS). By using these OS-agnostic skills, you can quickly resolve problems and minimize downtime.
-
 ## Understanding Common Symptoms
 
 In order to troubleshoot effectively, it is important to recognize and understand the common symptoms encountered in IT systems. These can range from hardware-related issues, such as overheating or physical damage, to software-related problems, such as slow performance or unresponsiveness.
@@ -40,7 +38,7 @@ Logs are records of system events, application behavior, and user activity, whic
 - **Analyze log content**: Examine events, error messages, or patterns that might shed light on the root cause of the issue.
 - **Leverage log-analysis tools**: Utilize specialized tools or scripts to help parse, filter, and analyze large or complex log files.
 
-In conclusion, developing OS-independent troubleshooting skills allows you to effectively diagnose and resolve issues on any system. By following a structured approach, understanding common symptoms, and utilizing the appropriate tools, you can minimize downtime and maintain the security and efficiency of your organization's IT systems.
+Learn more from the following resources:
 
 - [@article@How to identify 9 signs of Operating System.](https://bro4u.com/blog/how-to-identify-9-signs-of-operating-system)
-- [@article@Trouble shooting guide](https://cdnsm5-ss6.sharpschool.com/userfiles/servers/server_20856499/file/teacher%20pages/lindsay%20dolezal/it%20essentials/5.6.pdf)
+- [@article@Trouble shooting guide](https://cdnsm5-ss6.sharpschool.com/userfiles/servers/server_20856499/file/teacher%20pages/lindsay%20dolezal/it%20essentials/5.6.pdf)

src/data/roadmaps/cyber-security/content/oscp@SwVGVP2bbCFs2uNg9Qtxb.md

@@ -1,36 +1,8 @@
 # OSCP
 
-## Offensive Security Certified Professional (OSCP)
+**OSCP (Offensive Security Certified Professional)** is a widely recognized certification in cybersecurity that focuses on penetration testing and ethical hacking. Offered by Offensive Security, it requires candidates to complete a challenging exam that involves identifying and exploiting vulnerabilities in a controlled environment. The OSCP certification emphasizes hands-on skills, practical experience, and the ability to conduct comprehensive security assessments, making it highly valued by employers for its rigorous approach to real-world penetration testing techniques.
 
-The **Offensive Security Certified Professional (OSCP)** is a highly respected and sought-after certification in the field of cybersecurity. This certification is designed to test your practical knowledge and skills in the identification and exploitation of vulnerabilities in a target environment, as well as your ability to effectively implement offensive security techniques to assess the security posture of networks and systems.
+Learn more from the following resources:
 
-## Key Topics Covered:
-
-- Penetration testing methodologies
-- Advanced information gathering techniques
-- Buffer overflow attacks
-- Web application attacks
-- Various exploitation techniques
-- Privilege escalation
-- Client-side attacks
-- Post-exploitation techniques
-- Basic scripting and automation
-
-## Prerequisites:
-
-There are no strict prerequisites for the OSCP, but it is recommended that candidates have a solid understanding of networking, system administration, and Linux/Unix command-line environments. Familiarity with basic programming concepts, scripting languages (e.g., Python, Bash), and operating system concepts will also be helpful.
-
-## Exam Format:
-
-To obtain the OSCP certification, you must successfully complete the 24-hour hands-on exam, where you are required to attack and penetrate a target network, compromising several machines and completing specific objectives within the given time frame.
-
-Before attempting the exam, candidates must complete the accompanying training course, **Penetration Testing with Kali Linux (PWK)**, which provides the necessary knowledge and practical experience required for the OSCP exam.
-
-## Why Pursue the OSCP Certification?
-
-- **Hands-on Approach:** OSCP emphasizes a practical, hands-on approach, ensuring that certified professionals possess both the theoretical knowledge and practical skills required to succeed in the cybersecurity field.
-- **Industry Recognition:** OSCP is widely recognized and respected within the cybersecurity community as a rigorous and demanding certification that validates a candidate's ability to perform under pressure.
-- **Career Advancement:** With the OSCP certification, you can demonstrate your advanced skills in offensive security techniques, making you a valuable asset to any security team and potentially opening up opportunities for career growth, higher salaries, and challenging roles in the industry.
-- **Continuous Learning:** Pursuing the OSCP certification will help you develop a deeper understanding of underlying vulnerabilities and attack vectors. This knowledge, combined with constantly evolving offensive security techniques, ensures that you stay ahead in the ever-changing cybersecurity landscape.
-
-Obtaining the OSCP certification can be a challenging and rewarding journey that provides you with practical skills and industry recognition, enabling you to stand out as a cybersecurity professional and advance your career in the field.
+- [@article@Offsec OSCP Site](https://www.offsec.com/courses/pen-200/)
+- [@article@How to prepare for the OSCP](https://cybersecurityguide.org/programs/cybersecurity-certifications/oscp/)

src/data/roadmaps/cyber-security/content/paas@PQ_np6O-4PK2V-r5lywQg.md

@@ -1,19 +1,8 @@
 # PaaS
 
-Platform as a Service, or **PaaS**, is a type of cloud computing service that provides a platform for developers to create, deploy, and maintain software applications. PaaS combines the software development platform and the underlying infrastructure, such as servers, storage, and networking resources. This enables developers to focus on writing and managing their applications, without worrying about the underlying infrastructure's setup, maintenance, and scalability.
+Platform as a Service, or **PaaS**, is a type of cloud computing service that provides a platform for developers to create, deploy, and maintain software applications. PaaS combines the software development platform and the underlying infrastructure, such as servers, storage, and networking resources. This enables developers to focus on writing and managing their applications, without worrying about the underlying infrastructure's setup, maintenance, and scalability. PaaS simplifies the application development and deployment process by providing a platform and its associated tools, saving developers time and resources. By leveraging PaaS, organizations can focus on their core competencies and build innovative applications without worrying about infrastructure management.
 
-## Key Features of PaaS
+Learn more from the following resources:
 
-- **Scalability:** PaaS allows for easily scaling applications to handle increased load and demand, without the need for manual intervention.
-- **Development Tools:** PaaS providers offer a collection of integrated development tools, such as programming languages, libraries, and APIs (Application Programming Interfaces) that enable developers to build and deploy applications.
-- **Automated Management:** PaaS platforms automate the management of underlying resources and provide seamless updates to ensure the applications are always running on the latest and most secure software versions.
-- **Cost-Effective:** PaaS can be more cost-effective than managing an on-premises infrastructure, since the provider manages the underlying resources, thus reducing the need for dedicated IT staff.
-
-## Common Use Cases for PaaS
-
-- **Application Development:** Developers can use PaaS platforms to develop, test, and launch applications quickly and efficiently.
-- **Web Hosting:** PaaS platforms often include tools for hosting and managing web applications, reducing the effort needed to configure and maintain web servers.
-- **Data Analytics:** PaaS platforms typically offer data processing and analytics tools, making it easy for organizations to analyze and gain insights from their data.
-- **IoT Development:** PaaS platforms may include IoT (Internet of Things) services, simplifying the development and management of IoT applications and devices.
-
-In conclusion, PaaS simplifies the application development and deployment process by providing a platform and its associated tools, saving developers time and resources. By leveraging PaaS, organizations can focus on their core competencies and build innovative applications without worrying about infrastructure management.
+- [@article@What is PaaS?](https://azure.microsoft.com/en-us/resources/cloud-computing-dictionary/what-is-paas)
+- [@video@PaaS Explained](https://www.youtube.com/watch?v=QAbqJzd0PEE)

src/data/roadmaps/cyber-security/content/packet-captures@TIxEkfBrN6EXQ3IKP1B7u.md

@@ -0,0 +1,8 @@
+# Packet Captures
+
+**Packet captures** involve recording and analyzing network traffic data packets as they travel across a network. This process allows network administrators and security professionals to inspect the content of packets, including headers and payloads, to diagnose network issues, monitor performance, and detect suspicious activities. Packet captures are typically performed using tools like Wireshark or tcpdump, which collect and store packets for later examination. This analysis helps in understanding network behavior, troubleshooting problems, and identifying security threats or vulnerabilities.
+
+Learn more from the following resources:
+
+- [@article@Packet Capture: What is it and What You Need to Know](https://www.varonis.com/blog/packet-capture)
+- [@video@Wireshark Tutorial for Beginners](https://www.youtube.com/watch?v=qTaOZrDnMzQ)

src/data/roadmaps/cyber-security/content/packet-sniffers@k6UX0BJho5arjGD2RWPgH.md

@@ -1,30 +1,10 @@
 # Packet Sniffers
 
-Packet sniffers are essential network troubleshooting tools that capture and inspect data packets passing through a network. They're especially useful for detecting security vulnerabilities, monitoring network traffic, and diagnosing network-related issues.
+**Packet sniffers** are tools used to capture and analyze network traffic by intercepting data packets as they traverse a network. They provide insights into network activity, including protocols, IP addresses, and payload contents, which can be useful for diagnosing network issues, monitoring performance, and detecting unauthorized or malicious activity. Packet sniffers operate in promiscuous mode, allowing them to capture all packets on a network segment, and are commonly used for network troubleshooting, security analysis, and forensic investigations. Examples include Wireshark and tcpdump.
 
-## How Packet Sniffers Work
+Learn more from the following resources:
 
-Packet sniffers work by actively listening to the network traffic and extracting data from the packets transmitted across the network. They can either capture all packets or filter them based on specific criteria, like IP addresses, protocols, or port numbers.
+- [@article@Packet Sniffing Explained](https://www.avast.com/c-packet-sniffing)
+- [@video@What is Packet Sniffing?](https://www.youtube.com/watch?v=5oioSbgBQ8I)
 
-## Common Features
 
-Some of the main features offered by packet sniffers include:
-
-- **Capture and analysis**: Packet sniffers can capture and analyze individual data packets, providing detailed information about the packet's header, payload, and other relevant information.
-- **Filtering**: To make it easier for users to locate specific network traffic, packet sniffers often feature filtering options that can narrow down the data to a single protocol, port number, or IP address.
-- **Packet injection**: Some packet sniffers can inject data packets into the network, which is useful for testing security mechanisms or for simulating traffic in a network environment.
-- **Graphical representation**: Packet sniffers may also provide graphical representations for data, making it easier to visualize network traffic patterns and identify potential congestion points or other issues.
-
-## Popular Packet Sniffers
-
-There are numerous packet sniffers available, both open-source and commercial. Some popular packet sniffers include:
-
-- [@article@Wireshark](https://www.wireshark.org/): A popular open-source packet analyzer with advanced features and support for various platforms.
-- [@article@tcpdump](https://www.tcpdump.org/): A command-line packet sniffer and analyzer primarily used in Unix-based systems.
-- [@article@Npcap](https://nmap.org/npcap/): A packet capture framework for Windows that supports Windows 10 and newer versions.
-
-## Cyber Security & Packet Sniffers
-
-Packet sniffers are valuable tools for cybersecurity professionals. They can help identify unauthorized or malicious network activity, track down the source of specific traffic patterns or attacks, and assist with the development of network security policies. When using packet sniffers, it's important to keep in mind that monitoring other users' network activity without their consent may raise legal and ethical issues.
-
-To sum up, packet sniffers are powerful tools that can provide valuable insights into network traffic and security, ultimately helping to maintain and secure any given network environment.

src/data/roadmaps/cyber-security/content/patching@e-MDyUR3GEv-e4Qsx_5vV.md

@@ -1,29 +1,8 @@
 # Patching
 
-Patching is the process of updating, modifying, or repairing software or systems by applying fixes, also known as patches. Patches are designed to address vulnerabilities, fix bugs, or improve the overall security of a system. Regular patching is an essential component of any cyber security strategy.
+**Patching** refers to the process of updating software or systems with fixes or improvements to address security vulnerabilities, bugs, or performance issues. This involves applying patches—small pieces of code provided by software vendors or developers—to close security gaps, resolve operational problems, and enhance functionality. Regular patching is crucial for maintaining system security and stability, protecting against exploits, and ensuring that systems remain compliant with security standards and best practices.
 
-## Importance of Patching
+Learn more from the following resources:
 
-- **Fix security vulnerabilities** - Attackers are constantly on the lookout for unpatched systems, which makes patching a critical step in securing your environment. Patches help fix any security weaknesses that the software developers have identified.
-
-- **Enhance system stability** - Patches often include improvements to the software's codebase or configuration, enhancing the overall performance and stability of the system.
-
-- **Improve software functionality** - Patches can add new features and update existing ones, ensuring that your software remains up-to-date with the latest technology advancements.
-
-## Patch Management
-
-To make patching effective, organizations need to establish a well-structured patch management process. A good patch management process includes:
-
-- **Inventory** - Maintaining a comprehensive inventory of all devices and software within your organization allows you to detect the need for patches and implement them in a timely manner.
-
-- **Risk assessment** - Evaluate the risk associated with the vulnerabilities addressed by a patch. This will help prioritize which patches should be applied first.
-
-- **Patch testing** - Always test patches in a controlled environment before deploying them to your production systems. This will help identify any potential compatibility or performance issues that the patch might cause.
-
-- **Deployment** - Ensure that patches are deployed across your organization's systems in a timely and consistent manner, following a predefined schedule.
-
-- **Monitoring and reporting** - Establishing a mechanism for monitoring and reporting on the status of patching activities ensures that your organization remains compliant with relevant regulations and best practices.
-
-- **Patch rollback** - In case a patch causes unexpected issues or conflicts, having a plan for rolling back patches is essential. This may include creating backups and having a process for quickly restoring systems to their pre-patch state.
-
-By integrating patching into your organization's cyber security strategy, you can significantly reduce the attack surface and protect your critical assets from cyber threats. Regular patching, combined with other hardening concepts and best practices, ensures a strong and resilient cyber security posture.
+- [@article@What is Patch Management?](https://www.ibm.com/topics/patch-management)
+- [@video@What Is Patch Management, and Why Does Your Company Need It?](https://www.youtube.com/watch?v=O5XXlJear0w)

src/data/roadmaps/cyber-security/content/penetration-testing-rules-of-engagement@NkAAQikwH-A6vrF8fWpuB.md

@@ -1,19 +1,8 @@
 # Penetration Testing Rules of Engagement
 
-Penetration testing, also known as ethical hacking, is an essential component of a strong cybersecurity program. Rules of engagement (RoE) for penetration testing define the scope, boundaries, and guidelines for conducting a successful penetration test. These rules are crucial to ensure lawful, efficient, and safe testing.
+**Penetration Testing Rules of Engagement** define the guidelines and boundaries for conducting a penetration test. They establish the scope, objectives, and constraints, including the systems and networks to be tested, the testing methods allowed, and the times during which testing can occur. These rules ensure that the testing is conducted ethically and legally, minimizing disruptions and protecting sensitive data. They also include communication protocols for reporting findings and any necessary approvals or permissions from stakeholders to ensure that the testing aligns with organizational policies and compliance requirements.
 
-## Key Components
+Learn more from the following resources:
 
-- **Scope**: The primary objective of defining a scope is to reasonably limit the testing areas. It specifies the systems, networks, or applications to be tested (in-scope) and those to be excluded (out-of-scope). Additionally, the scope should indicate testing methodologies, objectives, and timeframes.
-
-- **Authorization**: Penetration testing must be authorized by the organization's management or the system owner. Proper authorization ensures the testing is legitimate, lawful, and compliant with organizational policies. Obtain written permission, detail authorization parameters, and report concerns or issues that may arise during the test.
-
-- **Communication**: Establish a clear communication plan to ensure timely and accurate information exchange between penetration testers and stakeholders. Designate primary contacts and a secondary point of contact for escalations, emergencies or incident handling. Document the preferred communication channels and establish reporting protocols.
-
-- **Testing Approach**: Select an appropriate testing approach, such as black-box, white-box, or grey-box testing, depending on the objectives and available information. Clarify which penetration testing methodologies will be utilized (e.g., OSSTMM, OWASP, PTES) and specify whether automated tools, manual techniques, or both will be used during the test.
-
-- **Legal & Regulatory Compliance**: Comply with applicable laws, regulations, and industry standards (e.g., GDPR, PCI-DSS, HIPAA) to prevent violations and potential penalties. Seek legal advice if necessary and ensure all parties involved are aware of the regulations governing their specific domain.
-
-- **Rules of Engagement Document**: Formalize all rules in a written document and have it signed by all relevant parties (e.g., system owner, penetration tester, legal advisor). This document should include information such as scope, approach, communication guidelines, and restrictions on testing techniques. Keep it as a reference for incident handling and accountability during the test.
-
-In conclusion, robust penetration rules of engagement not only help identify potential security vulnerabilities in your organization but also ensure that the testing process is transparent and compliant. Establishing RoE is necessary to minimize the risk of legal issues, miscommunications, and disruptions to the organization's routine operations.
+- [@article@Why are rules of engagement important to a Penetration Test?](https://www.triaxiomsecurity.com/rules-of-engagement-important-to-penetration-test/)
+- [@video@CompTIA Pentest+ : Rules of Engagement](https://www.youtube.com/watch?v=Rt-4j8k6J2U)

src/data/roadmaps/cyber-security/content/performing-crud-on-files@zRXyoJMap9irOYo3AdHE8.md

@@ -1,62 +1,9 @@
 # Performing CRUD on Files
 
-When working with files in any system or application, understanding and performing CRUD operations (Create, Read, Update, and Delete) is essential for implementing robust cyber security measures.
+Performing CRUD operations on files involves creating new files (using write mode), reading file contents (using read mode), updating files (by appending or overwriting existing content), and deleting files (using commands or functions like `os.remove()` in Python). These basic operations are fundamental for managing file data in various applications.
 
-## File Creation
+Learn more from the following resources:
 
-- **Windows**: You can create new files using the built-in text editor (Notepad) or dedicated file creation software. You can also use PowerShell commands for quicker file creation. The `New-Item` command followed by the file path creates a file.
-
-  ```
-  New-Item -Path "C:\Example\example.txt" -ItemType "file"
-  ```
-
-- **Linux**: Unlike Windows, file creation is usually done through the terminal. The `touch` command helps create a file in the desired directory.
-
-  ```
-  touch /example/example.txt
-  ```
-
-## File Reading
-
-- **Windows**: You can read a file using standard file readers, such as Notepad, Wordpad, etc., or you can utilize PowerShell commands. The `Get-Content` command provides the file content.
-
-  ```
-  Get-Content -Path "C:\Example\example.txt"
-  ```
-
-- **Linux**: The `cat` command is the most common way to read the contents of a file in Linux.
-
-  ```
-  cat /example/example.txt
-  ```
-
-## File Updating
-
-- **Windows**: File updating can be accomplished using the previously mentioned text editors or PowerShell. The `Set-Content` or `Add-Content` commands are useful for updating a file.
-
-  ```
-  Set-Content -Path "C:\Example\example.txt" -Value "Updated content"
-  Add-Content -Path "C:\Example\example.txt" -Value "Appended content"
-  ```
-
-- **Linux**: Linux uses the built-in text editors, such as `nano` or `vim`, to update files. Alternatively, the `echo` command can append content to a file.
-
-  ```
-  echo "Appended content" >> /example/example.txt
-  ```
-
-## File Deletion
-
-- **Windows**: File deletion is performed by right-clicking the file and selecting 'Delete' or using PowerShell commands. The `Remove-Item` command followed by the file path can delete a file.
-
-  ```
-  Remove-Item -Path "C:\Example\example.txt"
-  ```
-
-- **Linux**: The `rm` command allows you to delete a file in Linux.
-
-  ```
-  rm /example/example.txt
-  ```
-
-By mastering these CRUD operations, you can enhance your cyber security knowledge and implement effective incident response and file management strategies.
+- [@article@What is CRUD?](https://www.crowdstrike.com/cybersecurity-101/observability/crud/)
+- [@article@CRUD Operations](https://www.freecodecamp.org/news/crud-operations-explained/)
+- [@video@What is CRUD?](https://www.youtube.com/watch?v=iNkspbIfcic)

src/data/roadmaps/cyber-security/content/perimiter-vs-dmz-vs-segmentation@PUgPgpKio4Npzs86qEXa7.md

@@ -1,29 +1,16 @@
 # Perimiter vs DMZ vs Segmentation
 
-Perimeter and DMZ (Demilitarized Zone) segmentation is a crucial aspect of network security that helps protect internal networks by isolating them from external threats. In this section, we will discuss the concepts of perimeter and DMZ segmentation, and how they can be used to enhance the security of your organization.
+In network security, **perimeter**, **DMZ (Demilitarized Zone)**, and **segmentation** are strategies for organizing and protecting systems:
 
-## Perimeter Segmentation
+1. **Perimeter** security refers to the outer boundary of a network, typically protected by firewalls, intrusion detection systems (IDS), and other security measures. It acts as the first line of defense against external threats, controlling incoming and outgoing traffic to prevent unauthorized access.
 
-Perimeter segmentation is a network security technique that involves isolating an organization's internal networks from the external, untrusted network (typically the internet). The goal is to create a protective barrier to limit the access of external attackers to the internal network, and minimize the risk of data breaches and other security threats.
+2. **DMZ** is a subnet that sits between an internal network and the external internet, hosting public-facing services like web servers and mail servers. The DMZ isolates these services to minimize the risk of attackers gaining access to the internal network by compromising a public-facing server.
 
-To achieve this, perimeter segmentation typically involves the use of network security appliances such as firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS). These devices act as gatekeepers, enforcing security policies and filtering network traffic to protect the internal network from malicious activity.
+3. **Segmentation** divides a network into smaller, isolated sections or zones, each with its own security controls. This limits the spread of attacks, enhances internal security, and enforces access control between different parts of the network, reducing the potential impact of a breach.
 
-## DMZ Segmentation
-
-The DMZ is a specially isolated part of the network situated between the internal network and the untrusted external network. DMZ segmentation involves creating a separate, secure area for hosting public-facing services (such as web servers, mail servers, and application servers) that need to be accessible to external users.
-
-The primary purpose of the DMZ is to provide an additional layer of protection for internal networks. By keeping public-facing services in the DMZ and isolated from the internal network, you can prevent external threats from directly targeting your organization's most sensitive assets.
-
-To implement a DMZ in your network, you can use devices such as firewalls, routers, or dedicated network security appliances. Properly configured security policies and access controls help ensure that only authorized traffic flows between the DMZ and the internal network, while still allowing necessary external access to the DMZ services.
-
-## Key Takeaways
-
-- Perimeter and DMZ segmentation are crucial security techniques that help protect internal networks from external threats.
-- Perimeter segmentation involves isolating an organization's internal networks from the untrusted external network, typically using security appliances such as firewalls, IDS, and IPS.
-- DMZ segmentation involves creating a separate, secure area within the network for hosting public-facing services that need to be accessible to external users while maintaining additional security for internal assets.
-- Implementing proper network segmentation and security policies can significantly reduce the risk of data breaches and other security threats.
+Together, these strategies create a layered defense, protecting sensitive resources by managing traffic flow and access points across the network.
 
 Learn more from the following resources:
 
 - [@opensource@Best practice for network segmentation](https://github.com/sergiomarotco/Network-segmentation-cheat-sheet)
-- [@opensource@OWASP Network segmentation Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Network_Segmentation_Cheat_Sheet.md#network-segmentation-cheat-sheet)
+- [@opensource@OWASP Network segmentation Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Network_Segmentation_Cheat_Sheet.md#network-segmentation-cheat-sheet)

src/data/roadmaps/cyber-security/content/picoctf@pou5xHwnz9Zsy5J6lNlKq.md

@@ -1,17 +1,8 @@
 # picoCTF
 
-[PicoCTF](https://picoctf.org/) is a popular online Capture The Flag (CTF) competition designed for beginners and experienced cyber security enthusiasts alike. It is organized annually by the [Plaid Parliament of Pwning (PPP)](https://ppp.cylab.cmu.edu/) team, a group of cyber security researchers and students from Carnegie Mellon University.
+**picoCTF** is an online cybersecurity competition designed to help students and beginners learn and practice hacking skills through capture-the-flag (CTF) challenges. Developed by Carnegie Mellon University, picoCTF features a series of progressively difficult puzzles that teach concepts such as reverse engineering, cryptography, web exploitation, forensics, and binary exploitation. It's an educational platform that offers hands-on experience in solving real-world cybersecurity problems, making it popular among both students and aspiring cybersecurity professionals for learning and improving their skills in a practical, interactive environment.
 
-## Features
+Learn more from the following resources:
 
-- **Level-based Challenges**: PicoCTF offers a wide range of challenges sorted by difficulty levels. You will find challenges in topics like cryptography, web exploitation, forensics, reverse engineering, binary exploitation, and much more. These challenges are designed to build practical cybersecurity skills and engage in real-world problem-solving.
-
-- **Learning Resources**: The platform includes a collection of learning resources to help participants better understand the topics they are tackling. This allows you to quickly learn the necessary background information to excel in each challenge.
-
-- **Collaborative Environment**: Users can collaborate with a team or join a group to work together and share ideas. Working with others allows for hands-on practice in communication, organization, and critical thinking skills that are vital in the cybersecurity field.
-
-- **Leaderboard and Competitive Spirit**: PicoCTF maintains a growing leaderboard where participants can see their ranking, adding an exciting competitive aspect to the learning experience.
-
-- **Open for All Ages**: The competition is open to individuals of all ages, with a focus on students in middle and high school in order to cultivate the next generation of cybersecurity professionals.
-
-In conclusion, PicoCTF is an excellent platform for beginners to start learning about cybersecurity, as well as for experienced individuals looking to improve their skills and compete. By participating in PicoCTF, you can enhance your knowledge, engage with the cyber security community, and hone your skills in this ever-growing field.
+- [@official@picoCTF Website](https://picoctf.org/)
+- [@video@BEGINNER Capture The Flag - PicoCTF 2021 001 "Obedient Cat"](https://www.youtube.com/watch?v=P07NH5F-t3s)

src/data/roadmaps/cyber-security/content/ping@GuuY-Q6FZzfspB3wrH64r.md

@@ -1,35 +1,8 @@
 # ping
 
-**Ping** is a fundamental networking tool that helps users to check the connectivity between two devices, typically a source computer, and a remote device, such as a server or another computer. The name "ping" comes from the sonar terminology, where a signal is sent out and a response is expected to verify the presence of an object.
+**Ping** is a network utility used to test the reachability and responsiveness of a device on a network. It sends Internet Control Message Protocol (ICMP) echo request packets to a target host and measures the time it takes for an echo reply to be received. Ping is commonly used to diagnose network connectivity issues, determine network latency, and check if a specific server or device is online. A successful ping response indicates that the target device is reachable, while failures or delays may suggest network problems, such as packet loss or routing issues.
 
-The ping command operates by sending Internet Control Message Protocol (ICMP) Echo Request packets to the target host and waiting for an ICMP Echo Reply. By sending multiple requests and calculating the time interval between sending the request and receiving a reply, the tool provides valuable information about the quality and reliability of the network connection.
+Learn more from the following resources:
 
-## Using Ping
-
-To use the ping command, open a command prompt or terminal window, and type `ping` followed by the IP address or hostname of the target device. For example:
-
-```
-ping example.com
-```
-
-## Interpreting Ping Results
-
-The output of the ping command will display the following information:
-
-- **Sent**: The number of packets sent to the target device.
-- **Received**: The number of packets received from the target device (if connectivity is successful).
-- **Lost**: The number of packets that did not reach the target device, indicating a problem in the connection.
-- **Minimum, Maximum, and Average Round Trip Time (RTT)**: Provides an estimate of the time it takes for a single packet to travel from the source device to the destination and back again.
-
-## Troubleshooting with Ping
-
-Ping is particularly useful for diagnosing and troubleshooting network connectivity issues. Some common scenarios in which it can help include:
-
-- Verifying if a remote device is active and responding.
-- Identifying network latency or slow network connections.
-- Troubleshooting routing problems and packet loss.
-- Testing the resolution of domain names to IP addresses.
-
-By understanding and utilizing the ping command, users can diagnose and resolve various network-related issues to ensure a stable and secure online experience.
-
-Remember that some devices or servers may be configured not to respond to ICMP requests, which might result in no response or a "Request timed out" message after using the ping command. This behavior is usually configured to prevent potential security risks or attacks, so don't panic if you encounter this while troubleshooting.
+- [@article@What is ping?](https://www.solarwinds.com/resources/it-glossary/ping)
+- [@video@Ping command explained](https://www.youtube.com/watch?v=7sv5pL-XgSg)

src/data/roadmaps/cyber-security/content/ping@yfTpp-ePuDB931FnvNB-Y.md

@@ -1,21 +1,8 @@
 # ping
 
-Ping is a fundamental network utility that helps users determine the availability and response time of a target device, such as a computer, server, or network device, by sending small packets of data to it. It operates on the Internet Control Message Protocol (ICMP) and forms an essential part of the incident response and discovery toolkit in cyber security.
+**Ping** is a network utility used to test the reachability and responsiveness of a device on a network. It sends Internet Control Message Protocol (ICMP) echo request packets to a target host and measures the time it takes for an echo reply to be received. Ping is commonly used to diagnose network connectivity issues, determine network latency, and check if a specific server or device is online. A successful ping response indicates that the target device is reachable, while failures or delays may suggest network problems, such as packet loss or routing issues.
 
-## How Ping Works
+Learn more from the following resources:
 
-When you issue a Ping command, your device sends out ICMP Echo Request packets to the target device. In response, the target device sends out ICMP Echo Reply packets. The round-trip time (RTT) between the request and reply is measured and reported, which is an indication of the network latency and helps identify network problems.
-
-## Uses of Ping in Cyber Security
-
-- **Availability and Reachability:** Ping helps ensure that the target device is online and reachable in the network. A successful ping indicates that the target is available and responding to network requests.
-- **Response Time Measurements:** Ping provides the RTT measurements, which are useful for identifying network latency issues or bottlenecks. High RTTs indicate potential network congestion or other issues.
-- **Troubleshoot Connectivity Issues:** In case of network issues or cyber attacks, Ping can help isolate the problem by determining whether the issue is with the target device, the network infrastructure, or a security configuration.
-- **Confirming Access Control:** Ping can also be used to ensure that firewalls or intrusion detection systems (IDS) are properly configured by confirming if ICMP requests are allowed or blocked.
-
-## Ping Limitations
-
-- **Blocking ICMP Traffic**: Some devices or firewalls may be configured to block ICMP traffic, making them unresponsive to Ping requests.
-- **False-Negative Results**: A poor network connection or heavy packet loss may result in a false-negative Ping result, incorrectly displaying the target device as unavailable.
-
-Despite these limitations, Ping remains a useful tool in the cyber security world for network diagnostics and incident response. However, it is essential to use Ping in conjunction with other discovery tools and network analysis techniques for comprehensive network assessments.
+- [@article@What is ping?](https://www.solarwinds.com/resources/it-glossary/ping)
+- [@video@Ping command explained](https://www.youtube.com/watch?v=7sv5pL-XgSg)

src/data/roadmaps/cyber-security/content/pki@fxyJxrf3mnFTa3wXk1MCW.md

@@ -1,34 +1,8 @@
 # PKI
 
-Public Key Infrastructure, or PKI, is a system used to manage the distribution and identification of public encryption keys. It provides a framework for the creation, storage, and distribution of digital certificates, allowing users to exchange data securely through the use of a public and private cryptographic key pair provided by a Certificate Authority (CA).
+**Public Key Infrastructure (PKI)** is a framework that manages digital certificates and public-private key pairs, enabling secure communication, authentication, and data encryption over networks. PKI supports various security services such as confidentiality, integrity, and digital signatures. It includes components like **Certificate Authorities (CAs)**, which issue and revoke digital certificates, **Registration Authorities (RAs)**, which verify the identity of certificate requestors, and **certificates** themselves, which bind public keys to individuals or entities. PKI is essential for secure online transactions, encrypted communications, and identity verification in applications like SSL/TLS, email encryption, and code signing.
 
-## Key Components of PKI
+Learn more from the following resources:
 
-- **Certificate Authority (CA):** A trusted third-party organization that issues and manages digital certificates. The CA verifies the identity of entities and issues digital certificates attesting to that identity.
-
-- **Registration Authority (RA):** A subordinate authority that assists the CA in validating entities' identity before issuing digital certificates. The RA may also be involved in revoking certificates or managing key recovery.
-
-- **Digital Certificates:** Electronic documents containing the public key and other identifying information about the entity, along with a digital signature from the CA.
-
-- **Private and Public Key Pair:** Unique cryptographic keys generated together, where the public key is shared with others and the private key is kept secret by the owner. The public key encrypts data, and only the corresponding private key can decrypt it.
-
-## Benefits of PKI
-
-- **Secure Communication:** PKI enables secure communication across networks by encrypting data transmitted between parties, ensuring that only the intended recipient can read it.
-
-- **Authentication:** Digital certificates issued by a CA validate the identity of entities and their public keys, enabling trust between parties.
-
-- **Non-repudiation:** PKI ensures that a sender cannot deny sending a message, as their digital signature is unique and verified by their digital certificate.
-
-- **Integrity:** PKI confirms the integrity of messages by ensuring that they have not been tampered with during transmission.
-
-## Common Uses of PKI
-
-- Secure email communication
-- Secure file transfer
-- Secure remote access and VPNs
-- Secure web browsing (HTTPS)
-- Digital signatures
-- Internet of Things (IoT) security
-
-In summary, PKI plays a crucial role in establishing trust and secure communication between entities in the digital world. By using a system of trusted CAs and digital certificates, PKI provides a secure means of exchanging data, authentication, and maintaining the integrity of digital assets.
+- [@article@What is PKI?](https://cpl.thalesgroup.com/faq/public-key-infrastructure-pki/what-public-key-infrastructure-pki)
+- [@article@Design and build a privately hosted Public Key Infrastructure](Design and build a privately hosted Public Key Infrastructure)

src/data/roadmaps/cyber-security/content/port-blocking@W7bcydXdwlubXF2PHKOuq.md

@@ -2,20 +2,6 @@
 
 Port blocking is an essential practice in hardening the security of your network and devices. It involves restricting, filtering, or entirely denying access to specific network ports to minimize exposure to potential cyber threats. By limiting access to certain ports, you can effectively safeguard your systems against unauthorized access and reduce the likelihood of security breaches.
 
-## Why is Port Blocking Important?
+Learn more from the following resources:
 
-- **Reducing attack surface**: Every open port presents a potential entry point for attackers. By blocking unused or unnecessary ports, you shrink the attack surface of your network.
-- **Securing sensitive data**: Limiting access to specific ports can help protect sensitive data by ensuring that only authorized individuals can access certain network services.
-- **Compliance with regulations**: Various regulations such as PCI DSS, HIPAA, and GDPR require organizations to have a secure data protection infrastructure, which includes controlling access to your network.
-
-## How to Implement Port Blocking
-
-To implement port blocking, consider the following steps:
-
-- **Identifying necessary ports**: Analyze your network to determine which ports need to remain open for key services and functions, and which can be safely blocked.
-- **Creating a port blocking policy**: Develop a policy that defines which ports should be blocked and why, along with the rationale behind permitting access to specific ports.
-- **Using firewall rules**: Configure the firewall on your devices and network infrastructure to block the ports deemed appropriate by your policy.
-- **Testing**: Test your configuration to ensure that only the necessary ports are accessible, and the blocked ports are indeed blocked.
-- **Monitoring and maintaining**: Regularly monitor and review open ports for any possible changes, and update your port blocking policy and configurations as needed.
-
-Remember, implementing port blocking is just one piece of a comprehensive cybersecurity strategy. Be sure to consider additional hardening concepts and best practices to ensure your network remains secure.
+- [@article@What is port blocking with LAN?](https://www.geeksforgeeks.org/what-is-port-blocking-within-lan/)

src/data/roadmaps/cyber-security/content/port-scanners@iJRQHzh5HXADuWpCouwxv.md

@@ -2,35 +2,7 @@
 
 Port scanners are essential tools in the troubleshooting and cybersecurity landscape. They are designed to detect open or closed network ports on a target system. Network ports serve as communication endpoints for various applications and services running on a device, and knowing the status of these ports can help identify potential security vulnerabilities or confirm that specific services are running as intended.
 
-In this section, we will explore the following aspects of port scanners:
+Learn more from the following resources:
 
-- **Why port scanners are important**
-- **Types of port scanners**
-- **Popular port scanning tools**
-
-## Why port scanners are important
-
-Port scanners can help in the following situations:
-
-- **Identifying open ports:** Open ports might expose your system to attacks if they are left unsecured. A port scanner can help you identify which network ports are open and need to be secured.
-- **Detecting unauthorized services:** Scanning for open ports can help you find if any unauthorized applications are running on your network, as these services might open ports that you are not aware of.
-- **Testing firewall rules:** Port scanners can also verify if your firewall rules are effective and configured correctly.
-- **Troubleshooting network issues:** By detecting open and closed ports, port scanners can help you diagnose network problems and ensure your applications and services are running smoothly.
-
-## Types of port scanners
-
-There are three main types of port scanners:
-
-- **TCP Connect:** This scanner initiates a full TCP connection between the scanner and the target device. It goes through the entire process of establishing a TCP connection, including a three-way handshake. This type of scan is accurate but more easily detectable.
-- **TCP SYN or Half-Open scan:** This scanner only sends a SYN packet (a request to start a connection) to the target device. If the target device responds with a SYN/ACK packet, the port is considered open. This type of scan is faster and less detectable, as it doesn't establish a full connection.
-- **UDP Scan:** This scanner targets User Datagram Protocol (UDP) ports, which are typically used for streaming and real-time communication applications. It sends UDP packets to the target device, and if there's no response, the port is considered open. This type of scan can be less accurate, as some devices may not respond to UDP probes.
-
-## Popular port scanning tools
-
-Here are some popular and widely used port scanning tools:
-
-- **Nmap:** Nmap (Network Mapper) is a free, open-source tool that is highly versatile and powerful. It offers various types of scans, including TCP Connect, TCP SYN, and UDP scans.
-- **Masscan:** Masscan is a high-speed port scanner that is typically used for large-scale scanning, thanks to its ability to scan the entire internet within a few minutes.
-- **Angry IP Scanner:** It is a cross-platform port scanner that is very user-friendly and suitable for beginners. It supports both TCP and UDP scanning.
-
-Remember to always use port scanners responsibly and only on your own systems or where you have permission to perform a scan. Unauthorized port scanning can have legal and ethical implications.
+- [@article@Top 5 Best port scanners](https://securitytrails.com/blog/best-port-scanners)
+- [@video@How To Use nmap To Scan For Open Ports](https://www.youtube.com/watch?v=ifbwTt3_oCg)

src/data/roadmaps/cyber-security/content/power-shell@paY9x2VJA98FNGBFGRXp2.md

@@ -1,40 +1,11 @@
 # Power Shell
 
-PowerShell is a powerful command-line shell and scripting language developed by Microsoft primarily for the purpose of automating tasks and managing system configuration. PowerShell is designed specifically for Windows but has been made available for other platforms as well, such as macOS and Linux.
+**PowerShell** is a task automation and configuration management framework from Microsoft, consisting of a command-line shell and an associated scripting language. It is widely used for system administration, enabling administrators to automate tasks, manage systems, and configure services both on-premises and in cloud environments. PowerShell supports complex scripting with its access to .NET libraries, making it powerful for automating processes, managing network configurations, and interacting with APIs. It also plays a critical role in cybersecurity, as attackers can use PowerShell for malicious purposes, while defenders use it for forensic analysis and system management.
 
-## Why PowerShell?
-
-- **Automation:** PowerShell scripts allow users to automate tasks, helping to save time and reduce the likelihood of introducing errors during manual processes.
-
-- **Command discovery:** PowerShell's built-in `Get-Command` cmdlet allows users to easily find and learn about the commands available to them.
-
-- **Consistency:** The consistency of the PowerShell syntax makes it easy to learn and use the scripting language, allowing users to create complex scripts with minimal investment in time and effort.
-
-- **Cross-platform compatibility:** PowerShell is now available across various platforms, making it even more valuable to learn and implement in your daily work.
-
-## Basic Concepts
-
-Here are some essential concepts to understand while working with PowerShell:
-
-- **Cmdlet:** A cmdlet is a lightweight command that performs a specific action, such as creating a new folder or listing the files in a directory. Cmdlets follow the 'Verb-Noun' syntax (e.g., `Get-Process`, `New-Item`).
-
-- **Pipeline:** A pipeline is a method of passing the output of one cmdlet as input to another cmdlet. It's represented using the '|' symbol. (e.g., `Get-Process | Stop-Process`)
-
-- **Aliases:** Aliases are alternate names for cmdlets, created to provide a more intuitive, shorthand way to call the original cmdlet (e.g., `ls` is an alias for `Get-ChildItem`).
-
-- **Variables:** Variables in PowerShell use the `$` symbol for storing values. (e.g., `$myVariable = "Hello, World!"`)
-
-- **Operators:** PowerShell supports various operators, such as arithmetic operators, comparison operators, logical operators, etc., for performing calculations, comparisons, and transformations on variables and values.
-
-- **Scripting:** PowerShell scripts are saved as `.ps1` files and executed using command line or Integrated Scripting Environment (ISE).
-
-## Learning PowerShell
-
-To get started with PowerShell, begin by learning about the available cmdlets, syntax, and features. Useful resources for learning PowerShell include:
+Learn more from the following resources:
 
+- [@official@PowerShell.org](https://powershell.org/)
 - [@article@Microsoft's Official PowerShell Documentation](https://docs.microsoft.com/en-us/powershell/)
+- [@video@PowerShell Course](https://www.youtube.com/watch?v=ZOoCaWyifmI)
 - [@opensource@Learning PowerShell GitHub Repository](https://github.com/PowerShell/PowerShell/tree/master/docs/learning-powershell)
-- [@official@PowerShell.org](https://powershell.org/)
-- Online forums and communities such as [Stack Overflow](https://stackoverflow.com/questions/tagged/powershell) and [Reddit's r/PowerShell](https://www.reddit.com/r/PowerShell/)
 
-In conclusion, PowerShell is an essential tool for anyone working with Windows systems and can greatly benefit those in the cybersecurity field. The ability to automate tasks and manage configurations using PowerShell will provide a significant advantage, allowing for more efficient and accurate work.

src/data/roadmaps/cyber-security/content/preparation@w6V4JOtXKCMPAkKIQxvMg.md

@@ -1,33 +1,8 @@
 # Preparation
 
-The **preparation** stage of the incident response process is crucial to ensure the organization's readiness to effectively deal with any type of security incidents. This stage revolves around establishing and maintaining an incident response plan, creating an incident response team, and providing proper training and awareness sessions for the employees. Below, we'll highlight some key aspects of the preparation stage.
+The **Preparation** phase in incident response involves establishing and maintaining the tools, policies, and procedures necessary to handle security incidents effectively. This includes creating an incident response plan, defining roles and responsibilities, training staff, and ensuring that appropriate technologies, such as monitoring systems and logging tools, are in place to detect and respond to incidents. Preparation also involves conducting regular drills, threat intelligence gathering, and vulnerability assessments to enhance readiness, ensuring the organization is equipped to mitigate potential security threats quickly and efficiently.
 
-## Incident Response Plan
+Learn more from the following resources:
 
-An _Incident Response Plan_ is a documented set of guidelines and procedures for identifying, investigating, and responding to security incidents. It should include the following components:
-
-- **Roles and Responsibilities**: Define the roles within the incident response team and the responsibilities of each member.
-- **Incident Classification**: Establish criteria to classify incidents based on their severity, impact, and type.
-- **Escalation Procedures**: Define a clear path for escalating incidents depending on their classification, involving relevant stakeholders when necessary.
-- **Communication Guidelines**: Set up procedures to communicate about incidents internally within the organization, as well as externally with partners, law enforcement, and the media.
-- **Response Procedures**: Outline the steps to be taken for each incident classification, from identification to resolution.
-
-## Incident Response Team
-
-An _Incident Response Team_ is a group of individuals within an organization that have been appointed to manage security incidents. The team should be comprised of members with diverse skillsets and backgrounds, including but not limited to:
-
-- Security Analysts
-- Network Engineers
-- IT Managers
-- Legal Counsel
-- Public Relations Representatives
-
-## Training and Awareness
-
-Employee training and awareness is a crucial component of the preparation stage. This includes providing regular training sessions on security best practices and the incident response process, as well as conducting simulated incident exercises to evaluate the efficiency of the response plan and the team's readiness.
-
-## Continuous Improvement
-
-The preparation phase is not a one-time activity; it should be regularly revisited, evaluated, and updated based on lessons learned from previous incidents, changes in the organization's structure, and emerging threats in the cybersecurity landscape.
-
-In summary, the preparation stage is the foundation of an effective incident response process. By establishing a comprehensive plan, assembling a skilled team, and ensuring ongoing employee training and awareness, organizations can minimize the potential damage of cybersecurity incidents and respond to them quickly and effectively.
+- [@article@](https://www.microsoft.com/en-gb/security/business/security-101/what-is-incident-response)
+- [@video@](https://www.youtube.com/watch?v=ePZGqlcB1O8)

src/data/roadmaps/cyber-security/content/private-vs-public-keys@7svh9qaaPp0Hz23yinIye.md

@@ -1,34 +1,14 @@
 # Pvt Key vs Pub Key
 
-Cryptography plays a vital role in securing cyber systems from unauthorized access and protecting sensitive information. One of the most popular methods used for ensuring data privacy and authentication is the concept of **Public-Key Cryptography**. This type of cryptography relies on two distinct keys: **Private Key** and **Public Key**. This section provides a brief summary of Private Keys and Public Keys, and highlights the differences between the two.
+**Public keys** and **private keys** are cryptographic components used in asymmetric encryption. 
 
-## Private Key
+- **Public Key:** This key is shared openly and used to encrypt data or verify a digital signature. It can be distributed widely and is used by anyone to send encrypted messages to the key owner or to verify their digital signatures.
 
-A Private Key, also known as a Secret Key, is a confidential cryptographic key that is uniquely associated with an individual or an organization. It should be kept secret and not revealed to anyone, except the authorized person who owns it. The Private Key is used for decrypting data that was encrypted using the corresponding Public Key, or for signing digital documents, proving the identity of the signer.
+- **Private Key:** This key is kept secret by the owner and is used to decrypt data encrypted with the corresponding public key or to create a digital signature. It must be protected rigorously to maintain the security of encrypted communications and authentication.
 
-Key characteristics of Private Keys:
+Together, they enable secure communications and authentication, where the public key encrypts or verifies, and the private key decrypts or signs.
 
-- Confidential and not shared with others
-- Used for decryption or digital signing
-- Loss or theft of Private Key can lead to data breaches and compromise of sensitive information
+Learn more from the following resources:
 
-## Public Key
-
-A Public Key is an openly available cryptographic key that is paired with a Private Key. Anyone can use the Public Key to encrypt data or to verify signatures, but only the person/organization with the corresponding Private Key can decrypt the encrypted data or create signatures. The Public Key can be distributed freely without compromising the security of the underlying cryptographic system.
-
-Key characteristics of Public Keys:
-
-- Publicly available and can be shared with anyone
-- Used for encryption or verifying digital signatures
-- Loss or theft of Public Key does not compromise sensitive information or communication security
-
-## Key Differences
-
-The main differences between Private and Public keys are as follows:
-
-- Ownership: The Private Key is confidential and owned by a specific individual/organization, while the Public Key is owned by the same individual/organization but can be publicly distributed.
-- Accessibility: The Private Key is never shared or revealed to anyone, whereas the Public Key can be shared freely.
-- Purpose: The Private Key is used for decrypting data and creating digital signatures, while the Public Key is used for encrypting data and verifying digital signatures.
-- Security: Loss or theft of the Private Key can lead to serious security breaches while losing a Public Key does not compromise the security of the system.
-
-Understanding the roles and differences between Private and Public Keys is essential for ensuring the effective application of Public-Key Cryptography in securing cyber systems and protecting sensitive information.
+- [@article@SSH Keys Explained](https://www.sectigo.com/resource-library/what-is-an-ssh-key)
+- [@article@Public Key vs Private Key: How are they Different?](https://venafi.com/blog/what-difference-between-public-key-and-private-key/)

src/data/roadmaps/cyber-security/content/private@ecpMKP1cQXXsfKETDUrSf.md

@@ -1,23 +1,8 @@
 # Private
 
-A **Private Cloud** is a cloud computing model that is solely dedicated to a single organization. In this model, the organization's data and applications are hosted and managed either within the organization's premises or in a privately-owned data center. This cloud model provides enhanced security and control, as the resources are not shared with other organizations, ensuring that your data remains private and secure.
+A **private cloud** is a cloud computing environment dedicated to a single organization, offering the same benefits as public clouds, such as scalability and self-service, but with greater control and customization. It is hosted either on-premises or by a third-party provider, and it ensures that the organization's data and applications are isolated from other entities. This setup enhances security and compliance, making it ideal for businesses with specific regulatory requirements or high-security needs.
 
-## Benefits of Private Cloud
+Learn more from the following resources:
 
-- **Enhanced Security:** As the resources and infrastructure are dedicated to one organization, the risk of unauthorized access, data leaks, or security breaches is minimal.
-
-- **Customization and Control:** The organization has complete control over their cloud environment, enabling them to customize their infrastructure and applications according to their specific needs.
-
-- **Compliance:** Private clouds can be tailored to meet strict regulatory and compliance requirements, ensuring that sensitive data is protected.
-
-- **Dedicated Resources:** Organizations have access to dedicated resources, ensuring high performance and availability for their applications.
-
-## Drawbacks of Private Cloud
-
-- **Higher Costs:** Building and maintaining a private cloud can be expensive, as organizations are responsible for purchasing and managing their own hardware, software, and infrastructure.
-
-- **Limited Scalability:** As resources are dedicated to one organization, private clouds may have limited scalability, requiring additional investments in infrastructure upgrades to accommodate growth.
-
-- **Responsibility for Management and Maintenance:** Unlike public clouds, where the cloud provider handles management and maintenance, the organization is responsible for these tasks in a private cloud, which can be time-consuming and resource-intensive.
-
-In summary, a private cloud model is ideal for organizations that require a high level of security, control, and customization. It is especially suitable for organizations with strict compliance requirements or sensitive data to protect. However, this model comes with higher costs and management responsibilities, which should be considered when choosing a cloud model for your organization.
+- [@article@What is a private cloud?](https://aws.amazon.com/what-is/private-cloud/)
+- [@video@Private cloud rules](https://www.youtube.com/watch?v=Tzqy8lW0bk4)

src/data/roadmaps/cyber-security/content/privilege-escalation@cvI8-sxY5i8lpelW9iY_5.md

@@ -1,25 +1,8 @@
 # Privilege escalation / User based Attacks
 
-Privilege escalation attacks occur when an attacker gains unauthorized access to a system and then elevates their privileges to perform actions that they should not have been able to do. There are two main types of privilege escalation:
-
-- **Horizontal Privilege Escalation**: In this type of attack, an attacker gains unauthorized access to a user account with the same privilege level as their own, but is able to perform actions or access data that belongs to another user.
-
-- **Vertical Privilege Escalation**: Also known as "Privilege Elevation," this type of attack involves an attacker gaining unauthorized access to a system and then elevating their privilege level from a regular user to an administrator, system owner, or root user. This provides the attacker with greater control over the system and its resources.
-
-To protect your systems and data from privilege escalation attacks, consider implementing the following best practices:
-
-- **Principle of Least Privilege**: Assign the minimum necessary access and privileges to each user account, and regularly review and update access permissions as required.
-
-- **Regularly Update and Patch Software**: Keep your software and systems up-to-date with the latest security patches to address known vulnerabilities that could be exploited in privilege escalation attacks.
-
-- **Implement Strong Authentication and Authorization**: Use strong authentication methods (e.g., multi-factor authentication) and ensure proper access controls are in place to prevent unauthorized access to sensitive data or system resources.
-
-- **Conduct Security Audits**: Regularly check for any misconfigurations, vulnerabilities or outdated software that could be exploited in privilege escalation attacks.
-
-- **Monitor and Log System Activities**: Implement logging and monitoring systems to detect suspicious account activities or changes in user privileges that may indicate a privilege escalation attack.
-
-By understanding the types of privilege escalation attacks and following these best practices, you can create a more secure environment for your data and systems, and reduce the risk of unauthorized users gaining unrestricted access.
+Privilege escalation is a technique where an attacker increases their access level within a system, moving from lower to higher permissions, such as from a standard user to an administrator. This can be achieved by exploiting system vulnerabilities, misconfigurations, or security weaknesses. It is critical to implement strong access controls, adhere to the principle of least privilege, and regularly update and patch systems to defend against such attacks.
 
 Visit the following resources to learn more:
 
+- [@article@What is privilege escalation?](https://www.crowdstrike.com/cybersecurity-101/privilege-escalation/)
 - [@video@Privilege Escalation](https://www.youtube.com/watch?v=ksjU3Iu195Q)

src/data/roadmaps/cyber-security/content/programming-skills@_RnuQ7952N8GWZfPD60sJ.md

@@ -2,24 +2,10 @@
 
 Programming knowledge is a fundamental skill for professionals in the cybersecurity field, as it enables them to build, assess, and defend computer systems, networks, and applications. Having a strong foundation in programming languages, concepts, and techniques is essential for identifying potential security threats, writing secure code, and implementing robust security measures.
 
-## Key Programming Languages
-
-It's important to learn multiple programming languages relevant to cybersecurity, as different languages cater to different types of tasks and environments. Here are some of the most widely used programming languages in the cybersecurity field:
-
 - **Python**: As an easy-to-learn high-level language, Python is commonly used for tasks like automation, scripting, and data analysis. It also contains a plethora of libraries and frameworks for cybersecurity, making it highly valuable for security professionals.
 - **C/C++**: These two languages are foundational for understanding system and application-level vulnerabilities since most operating systems are written in C and C++. Knowledge of these languages allows cybersecurity experts to analyze source code, identify potential exploits, and create secure software.
 - **Java**: As a popular and versatile programming language, Java is often used in web applications and enterprise environments. Java knowledge equips cybersecurity professionals to understand and mitigate potential security flaws in Java-based applications.
 - **JavaScript**: With its ubiquity in modern web browsers, JavaScript is crucial for understanding and protecting against web security vulnerabilities, such as Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks.
 - **Ruby**: Ruby has a strong foothold in web application development and is utilized for scripting and automation, just like Python. Familiarity with Ruby may give cybersecurity professionals an edge in certain environments.
 
-## Concepts and Techniques
-
-To apply programming knowledge effectively in cybersecurity, you should ground yourself in key concepts and techniques, such as:
-
-- **Cryptography**: Learn about encryption, decryption, encoding, and hashing techniques, as well as fundamental cryptographic algorithms and protocols used to secure data transmission and storage.
-- **Secure coding practices**: Understand concepts like input validation, output encoding, and error handling, which help prevent security vulnerabilities in programs.
-- **Reverse engineering**: Master the art of deconstructing software and analyzing it without access to the original source code, which is crucial for dissecting malware, identifying vulnerabilities, and developing security patches.
-- **Scripting and automation**: Develop skills in writing scripts and automating tasks, as it can save time and enhance efficiency in cybersecurity workflows.
-- **Data analysis**: Learn to analyze and visualize data relevant to cybersecurity, such as network traffic logs, patterns, and trends, to make informed decisions and implement appropriate defense strategies.
-
 Acquiring programming knowledge in cybersecurity can help you stay on top of the latest threats, develop secure software, and implement effective countermeasures. As you progress in your cybersecurity career, you'll find that your programming skills will continually evolve and your understanding of various languages, concepts, and techniques will expand.

src/data/roadmaps/cyber-security/content/protocol-analyzers@K05mEAsjImyPge0hDtsU0.md

@@ -1,31 +1,8 @@
 # Protocol Analyzers
 
-Protocol analyzers, also known as packet analyzers or network analyzers, are tools used to capture and analyze the data packets transmitted across a network. These tools help in monitoring network traffic, identifying security vulnerabilities, troubleshooting network problems, and ensuring that the network is operating efficiently. By analyzing the packets on a network, you can gain insights into the performance of your network infrastructure and the behavior of various devices and applications on it.
+**Protocol analyzers**, also known as network analyzers or packet sniffers, are tools used to capture, inspect, and analyze network traffic. They help diagnose network issues, troubleshoot performance problems, and ensure security by providing detailed insights into the data packets transmitted across a network. Protocol analyzers decode and display various network protocols, such as TCP/IP, HTTP, and DNS, allowing users to understand communication patterns, detect anomalies, and identify potential vulnerabilities. Popular examples include Wireshark and tcpdump.
 
-## Features & Uses of Protocol Analyzers
+Learn more from the following resources:
 
-- **Traffic Monitoring & Analysis**: Protocol analyzers allow you to monitor the traffic on your network in real-time, which helps identify bottlenecks, network congestion, and other performance issues.
-
-- **Security Analysis**: Analyzing network traffic can help identify unusual traffic patterns, potential security threats or breaches, and malicious activities. By studying the data packets, you can detect unauthorized access, malware infections, or other cyber attacks.
-
-- **Protocol Debugging**: These tools enable you to analyze different network protocols (such as HTTP, FTP, and SMTP) and their respective packets, which proves useful in troubleshooting issues related to application performance and communication.
-
-- **Bandwidth Utilization**: Protocol analyzers allow you to analyze the volume of network traffic and how the available bandwidth resources are being used, helping you optimize the network for better performance.
-
-- **Network Troubleshooting**: By capturing and analyzing packet data, you can identify network problems and take corrective measures to improve the overall performance and stability of the network.
-
-## Popular Protocol Analyzers
-
-Here's a list of some widely-used protocol analyzers:
-
-- **Wireshark**: Wireshark is an open-source packet analyzer with support for numerous protocols. It is one of the most popular and widely-used network troubleshooting tools available.
-
-- **TCPDump**: TCPDump is a command-line packet analyzer that allows you to capture network traffic and view it in a human-readable format, making it easy to analyze.
-
-- **Ethereal**: Ethereal is another open-source packet analyzer that provides a graphical user interface for capturing, filtering, and analyzing network traffic.
-
-- **Nmap**: Nmap is a popular network scanning tool that also includes packet capture and analysis capabilities, allowing you to analyze the network for vulnerabilities and other issues.
-
-- **Microsoft Message Analyzer**: Microsoft Message Analyzer is a versatile protocol analyzer developed by Microsoft that provides deep packet inspection and analysis of network traffic, including encrypted traffic.
-
-In conclusion, protocol analyzers are essential tools for network administrators, security professionals, and developers alike to ensure the performance, security, and stability of their networks. By understanding how these tools work and using them effectively, you can take proactive measures to maintain and improve the health of your network.
+- [@article@What is a protocol analyzer?](https://www.geeksforgeeks.org/what-is-protocol-analyzer/)
+- [@video@Protocol Analyzers](https://www.youtube.com/watch?v=hTMhlB-o0Ow)

src/data/roadmaps/cyber-security/content/proxmox@jqX1A5hFF3Qznqup4lfiF.md

@@ -1,25 +1,8 @@
 # proxmox
 
-Proxmox is an open-source platform for enterprise-level virtualization. It is a complete server virtualization management solution that allows system administrators to create and manage virtual machines in a unified environment.
+**Proxmox** is an open-source virtualization management platform that integrates both **Proxmox Virtual Environment (Proxmox VE)** and **Proxmox Mail Gateway**. Proxmox VE combines virtualization technologies, including KVM for virtual machines and LXC for lightweight containers, into a unified web-based interface for managing and deploying virtualized environments. It offers features such as high availability, storage management, and backup solutions. Proxmox Mail Gateway provides email security and anti-spam solutions, protecting email systems from threats. Proxmox is valued for its flexibility, cost-effectiveness, and comprehensive management capabilities.
 
-## Key Features
+Learn more from the following resources:
 
-- **Server Virtualization**: Proxmox enables you to turn your physical server into multiple virtual servers, each running its own operating system, applications, and services. This helps to maximize server usage and reduce operating costs.
-
-- **High Availability**: Proxmox VE supports high availability and failover. In case of hardware or software failure, automatic migration of virtual machines can prevent downtime for critical applications and services.
-
-- **Storage**: Proxmox offers a variety of storage solution options, including local (LVM, ZFS, directories), network (iSCSI, NFS, GlusterFS, Ceph), and distributed storage (Ceph RBD).
-
-- **Live Migration**: Live migration is a crucial feature that allows you to move running virtual machines from one host to another with minimal downtime.
-
-- **Operating System Support**: Proxmox VE supports a wide range of guest operating systems, including Linux, Windows, BSD, and others.
-
-- **Web Interface**: Proxmox offers a powerful and user-friendly web interface for managing your virtual environment. This allows you to create, start, stop or delete virtual machines, monitor their performance, manage their storage, and more from any web browser.
-
-- **Role-based Access Control**: Proxmox VE provides a role-based access control system, allowing you to create users with specific permissions and assign them to different parts of the Proxmox system.
-
-- **Backup and Restore**: Proxmox offers built-in backup and restore functionality, allowing you to easily create full, incremental, or differential backups of your virtual machines and easily restore them when needed.
-
-## Conclusion
-
-As a powerful and feature-rich virtualization solution, Proxmox Virtual Environment enables administrators to manage their virtual infrastructure more efficiently and reliably. Boasting an easy-to-use web interface, comprehensive storage options, and support for multiple operating systems, Proxmox VE is an excellent choice for managing your virtual environment.
+- [@video@What is Proxmox virtualization?](https://www.youtube.com/watch?v=GMAvmHEWAMU)
+- [@article@Proxmox Website](https://www.proxmox.com/en/)

src/data/roadmaps/cyber-security/content/public-vs-private-ip-addresses@2nQfhnvBjJg1uDZ28aE4v.md

@@ -1,37 +1,8 @@
 # Public vs Private IP Addresses
 
-When it comes to IP addresses, they are categorized in two major types: Public IP Addresses and Private IP Addresses. Both play a key role in network communication; however, they serve different purposes. Let's examine them more closely:
+Public addresses are IP addresses assigned to devices directly accessible over the internet, allowing them to communicate with external networks and services. In contrast, private addresses are used within local networks and are not routable over the internet, providing a way for devices within a private network to communicate with each other while conserving public IP address space. Public addresses are unique across the internet, whereas private addresses are reused across different local networks and are typically managed by network address translation (NAT) to interface with public networks.
 
-## Public IP Addresses
+Learn more from the following resources:
 
-A public IP address is a globally unique IP address that is assigned to a device or a network. This type of IP address is reachable over the Internet and enables devices to communicate with other devices, servers, and networks located anywhere in the world.
-
-Here are some key features of public IP addresses:
-
-- Routable over the Internet.
-- Assigned by the Internet Assigned Numbers Authority (IANA).
-- Usually assigned to an organization or Internet Service Provider (ISP).
-- Can be either static (permanent) or dynamic (changes periodically).
-
-Example: `72.14.207.99`
-
-## Private IP Addresses
-
-Private IP addresses, on the other hand, are used within local area networks (LANs) and are not visible on the Internet. These addresses are reserved for internal use within an organization, home, or local network. They are often assigned by a router or a network administrator for devices within the same network, such as your computer, printer, or smartphone.
-
-Here are some key features of private IP addresses:
-
-- Not routable over the Internet (requires Network Address Translator (NAT) to communicate with public IP addresses).
-- Assigned by local network devices, such as routers or network administrators.
-- Reusable in different private networks (as they are not globally unique).
-- Static or dynamic (depending on the network's configuration).
-
-Private IP address ranges:
-
-- `10.0.0.0` to `10.255.255.255` (Class A)
-- `172.16.0.0` to `172.31.255.255` (Class B)
-- `192.168.0.0` to `192.168.255.255` (Class C)
-
-Example: `192.168.1.100`
-
-In summary, public IP addresses are used for communication over the Internet, whereas private IP addresses are used within local networks. Understanding the difference between these two types of IP addresses is essential for grasping the basics of network connectivity and cyber security.
+- [@article@Public vs Private IP Addresses](https://www.avast.com/c-ip-address-public-vs-private)
+- [@video@What is the difference between public and private ip?](https://www.youtube.com/watch?v=R6Czae6Iow4&t=1s)

src/data/roadmaps/cyber-security/content/public@ZDj7KBuyZsKyEMZViMoXW.md

@@ -1,26 +1,9 @@
 # Public
 
-A **public cloud** is a cloud service that is available for use by the general public. In this cloud model, a cloud service provider owns and manages the cloud infrastructure, which is shared among multiple users or organizations. These users can access the cloud services via the internet and pay as they use, taking advantage of economies of scale.
+A **public cloud** is a computing service offered by third-party providers over the internet, where resources such as servers, storage, and applications are shared among multiple users or organizations. It is typically managed by the cloud service provider and offers scalability, cost-effectiveness, and ease of access, with users paying only for the resources they consume. Public clouds are ideal for businesses and individuals who need flexible, on-demand computing resources without the overhead of managing physical infrastructure. Popular examples include Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP).
 
-## Key Features
+Learn more from the following resources:
 
-- **Shared Infrastructure**: The public cloud is built on a shared infrastructure, where multiple users or organizations leverage the same hardware and resources to store their data or run their applications.
-- **Scalability**: Public clouds offer greater scalability than private clouds, as they can quickly allocate additional resources to users who need them.
-- **Cost-effective**: Since public clouds operate on a pay-as-you-go model, users only pay for the resources they consume, making it more cost-effective for organizations with fluctuating resource requirements.
+- [@video@What is a public cloud?](https://www.youtube.com/watch?v=KaCyfQ7luVY)
+- [@article@What is a public cloud? Microsoft](https://azure.microsoft.com/en-gb/resources/cloud-computing-dictionary/what-is-a-public-cloud)
 
-## Benefits of Public Cloud
-
-- **Lower costs**: There is no need to invest in on-premises hardware, and ongoing costs are usually lower due to economies of scale and the pay-as-you-go model.
-- **Ease of access**: Users can access the cloud services from anywhere using an internet connection.
-- **Updates and maintenance**: The cloud service provider is responsible for maintaining and updating the cloud infrastructure, ensuring that the latest security patches and features are applied.
-- **Reliability**: Public cloud providers have multiple data centers and robust redundancy measures, which can lead to improved service reliability and uptime.
-
-## Drawback and Concerns
-
-- **Security**: Since public clouds are shared by multiple users, there is an increased risk of threats and vulnerabilities, especially if the cloud provider does not have stringent security measures in place.
-- **Privacy and Compliance**: Organizations with strict data privacy and regulatory compliance requirements may find it difficult to use public cloud services, as data may be shared or stored in locations based on the provider's data center locations.
-- **Control**: Users have less direct control over the management and configuration of the cloud infrastructure compared to a private cloud.
-
-Despite these concerns, many businesses and organizations successfully use public clouds to host non-sensitive data or run applications that do not require stringent compliance requirements.
-
-Examples of popular public cloud service providers include Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP).

src/data/roadmaps/cyber-security/content/python@XiHvGy--OkPFfJeKA6-LP.md

@@ -1,29 +1,10 @@
 # Python
 
-Python is a versatile, high-level programming language that is widely used in various fields, such as web development, data analysis, artificial intelligence, and cyber security. It is known for its simplicity, readability, and extensive library support, making it a popular choice for beginners as well as experts.
+**Python** is a high-level, interpreted programming language known for its readability, simplicity, and versatility. It supports multiple programming paradigms, including procedural, object-oriented, and functional programming. Python's extensive standard library and a rich ecosystem of third-party packages make it suitable for a wide range of applications, from web development and data analysis to machine learning and automation. Its straightforward syntax and dynamic typing facilitate rapid development and prototyping, making it popular among beginners and experienced developers alike.
 
-## Key Features:
+Learn more from the following resources:
 
-- **Easy to learn and read**: Python features a clean and simple syntax, which makes it easy for beginners to start coding quickly and minimizes the chance of errors.
-- **Platform independent**: Python can run on any platform, including Windows, Linux, and macOS, making it suitable for cross-platform development.
-- **Large ecosystem**: Python has a vast ecosystem of libraries and frameworks, including popular ones like Django, Flask, and Scikit-learn, which can help speed up the development process.
-- **Strong community support**: Python has a large and active community, which provides a wealth of resources, such as tutorials, sample code, and expert assistance when needed.
+- [@roadmap@Python Roadmap](https://roadmap.sh/python)
+- [@course@Python Full Course 2024](https://www.youtube.com/watch?v=ix9cRaBkVe0)
+- [@video@Python in 100 Seconds](https://www.youtube.com/watch?v=x7X9w_GIm1s)
 
-## Python in Cyber Security:
-
-Python is particularly valuable in the field of cyber security for several reasons:
-
-- **Scripting and Automation**: Python is excellent for creating scripts and automating tasks, which is useful for managing security tasks such as log analysis, scanning networks, and penetration testing.
-- **Exploit Development**: Python's readability and simplicity make it suitable for developing exploits and writing proof-of-concept code, essential tasks in cyber security.
-- **Analysis and Visualization**: With powerful libraries like Pandas, NumPy, and Matplotlib, Python can help security analysts process, analyze, and visualize large data sets, making it easier to identify patterns and detect security threats.
-
-## Learning Python:
-
-To start learning Python, here are some useful resources:
-
-- [@official@Python.org](https://www.python.org/) - The official website offers extensive documentation and tutorials for beginners as well as advanced users.
-- [@article@Real Python](https://realpython.com/) - Offers a variety of Python tutorials, articles, and courses that cater to different experience levels.
-- [@article@Automate the Boring Stuff with Python](https://automatetheboringstuff.com/) - A beginner-friendly book that teaches Python by guiding you through practical tasks and automation examples.
-- [@feed@Explore top posts about Python](https://app.daily.dev/tags/python?ref=roadmapsh)
-
-Remember, practice is key, and the more you work with Python, the more you'll appreciate its utility in the world of cyber security.

src/data/roadmaps/cyber-security/content/radius@tH3RLnJseqOzRIbZMklHD.md

@@ -1,31 +1,8 @@
 # RADIUS
 
-**RADIUS** (Remote Authentication Dial-In User Service) is a widely used client-server protocol that offers centralized authentication, authorization, and accounting (AAA) management for users connecting to a network. Developed in 1991, RADIUS allows the transfer of user authentication and configuration information between devices and servers on a network.
+**Remote Authentication Dial-In User Service (RADIUS)** is a network protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for users who connect to and use a network service. It is commonly used for managing access to network resources such as VPNs, Wi-Fi, and dial-up services. RADIUS servers validate user credentials, enforce access policies, and log user activities. It operates over UDP ports 1812 (authentication) and 1813 (accounting), and supports encryption for securely transmitting user credentials and data.
 
-## How RADIUS Works
+Learn more from the following resources:
 
-RADIUS uses the User Datagram Protocol (UDP) for communication between the client and the server. When a user attempts to connect to a network, the client (like a VPN server or wireless access point) forwards the authentication request to the RADIUS server. The server then checks the user's credentials against its user database or forwards the request to another authentication server.
-
-Upon successful authentication, the RADIUS server sends back an **Access-Accept** message, as well as user-specific access policies (such as VLAN assignments or firewall rules). If the authentication fails, the server sends an **Access-Reject** message. Additionally, RADIUS tracks and reports user activity, making it responsible for the accounting aspect of AAA.
-
-## Benefits of RADIUS
-
-- **Centralized Management**: RADIUS allows administrators to manage user authentication and policies from a central location. This significantly simplifies the management of large and diverse networks.
-
-- **Scalability**: RADIUS servers can manage authentication for thousands of users and devices, making it well-suited for large organizations.
-
-- **Flexibility**: Being a widely adopted standard, RADIUS is compatible with various devices, such as routers, switches, VPN gateways, and wireless access points. It also allows for integration with other authentication services, like LDAP or Active Directory.
-
-- **Security**: RADIUS encrypts passwords during transmission, minimizing risks associated with data breaches. Additionally, it can enforce various access policies to further strengthen network security.
-
-## RADIUS vs. TACACS+
-
-Another popular AAA protocol is Terminal Access Controller Access-Control System Plus (TACACS+). While both RADIUS and TACACS+ provide similar functionality, there are notable differences:
-
-- RADIUS combines authentication and authorization, while TACACS+ separates them, allowing for greater flexibility and more granular control.
-- RADIUS uses UDP for communication, whereas TACACS+ uses TCP, ensuring reliable and ordered delivery of packets.
-- TACACS+ encrypts the entire payload, while RADIUS only encrypts the password.
-
-Organizations may choose between RADIUS and TACACS+ based on their specific requirements, network setup, and device compatibility.
-
-In conclusion, RADIUS plays a crucial role in implementing a robust and efficient AAA framework, simplifying network administration while ensuring security and compliance.
+- [@article@RADIUS (Remote Authentication Dial-In User Service)](https://www.techtarget.com/searchsecurity/definition/RADIUS)
+- [@video@How RADIUS Authentication Works](https://www.youtube.com/watch?v=LLrb3em-_po)

src/data/roadmaps/cyber-security/content/rdp@Ia6M1FKPNpqLDiWx7CwDh.md

@@ -1,32 +1,8 @@
 # RDP
 
-**Remote Desktop Protocol (RDP)**, developed by Microsoft, is a proprietary protocol that enables users to connect to a remote computer over a network, and access and control its resources, as if they were using the computer locally. This is useful for users who need to work remotely, manage servers or troubleshoot issues on another computer.
+**Remote Desktop Protocol (RDP)** is a Microsoft-developed protocol that enables users to remotely access and control a computer over a network. It allows users to interact with a remote desktop environment as if they were sitting in front of the computer, providing access to applications, files, and network resources. RDP is commonly used for remote administration, technical support, and remote work. It operates over TCP port 3389 and supports encryption for secure data transmission, though proper security measures, like strong passwords and multi-factor authentication, are essential to prevent unauthorized access.
 
-## How RDP Works
+Learn more from the following resources:
 
-RDP uses a client-server architecture, where the remote computer being accessed acts as the server and the user's computer acts as the client. The client establishes a connection with the server to access its resources, such as display, keyboard, mouse, and other peripherals.
-
-The protocol primarily operates on standard Transmission Control Protocol (TCP) port 3389 (although it can be customized) and uses the User Datagram Protocol (UDP) to provide a more robust and fault-tolerant communication channel.
-
-## Features of RDP
-
-- **Multi-platform support:** Although developed by Microsoft, RDP clients are available for various platforms, including Windows, macOS, Linux, and even mobile devices like Android and iOS.
-- **Secure connection:** RDP can provide encryption and authentication to secure the connection between client and server, ensuring that data transmitted over the network remains confidential and protected from unauthorized access.
-- **Dynamic resolution adjustment:** RDP can adapt the remote computer's screen resolution to fit the client's screen, providing a better user experience.
-- **Clipboard sharing:** RDP allows users to copy and paste content between the local and remote computers.
-- **Printer and file sharing:** Users can access and print files from their local computer to the remote one, and vice versa.
-
-## Security Considerations
-
-Though RDP is popular and useful, it does come with its share of security concerns. Some common risks include:
-
-- Unauthorized access: If an attacker successfully gains access to an RDP session, they may be able to compromise and control the remote computer.
-- Brute force attacks: Attackers may use brute force techniques to guess login credentials, especially if the server has a weak password policy.
-- Vulnerabilities: As a proprietary protocol, RDP can be susceptible to vulnerabilities that could lead to system breaches.
-
-To mitigate these risks, you should:
-
-- Use strong, unique passwords for RDP accounts and consider implementing two-factor authentication.
-- Limit RDP access to specific IP addresses or Virtual Private Networks (VPNs) to reduce exposure.
-- Apply security patches regularly to keep RDP up-to-date and minimize the risk of exploits.
-- Employ network-level authentication (NLA) to offer an additional layer of security.
+- [@video@What is RDP and how to use it?](https://www.youtube.com/watch?v=flPnBSz-lqw)
+- [@article@What is the Remote Desktop Protocol (RDP)?](https://www.cloudflare.com/en-gb/learning/access-management/what-is-the-remote-desktop-protocol/)

src/data/roadmaps/cyber-security/content/recovery@vFjbZAJq8OfLb3_tsc7oT.md

@@ -1,45 +1,8 @@
 # Recovery
 
-The recovery phase of the incident response process is a critical step in regaining normalcy after a cyber security incident. This phase focuses on restoring the affected systems and data, implementing necessary improvements to prevent future occurrences, and getting back to normal operations. In this section, we will discuss the key components and best practices for the recovery phase.
+The recovery phase of incident response focuses on restoring affected systems and services to normal operation, which involves repairing systems, recovering data from backups, validating functionality, and communicating with stakeholders. This phase also includes conducting a post-incident review to document lessons learned and update response plans to improve future preparedness. The aim is to minimize downtime, ensure data integrity, and return to normal operations efficiently.
 
-## Restoring Systems and Data
+Learn more from the following resources:
 
-The primary objective of the recovery phase is to restore affected systems and data to their pre-incident status. This process may involve:
-
-- Cleaning and repairing infected systems
-- Restoring data from backups
-- Reinstalling compromised software and applications
-- Updating system configurations and patching vulnerabilities
-
-## Post-Incident Analysis
-
-Once systems are back in operation, it is vital to analyze the incident thoroughly to understand the root cause, impact, and lessons learned. This analysis will assess the effectiveness of your incident response process and identify areas for improvement. Post-incident analysis may include:
-
-- Reviewing logs, incident reports, and other evidence collected during the investigation
-- Interviewing staff involved in the response
-- Examining the attacker's tools, tactics, and procedures
-- Evaluating any potential legal or regulatory implications of the incident
-
-## Implementing Improvements
-
-Based on the findings of the post-incident analysis, take proactive measures to strengthen your security posture and harden your defenses. These improvements may involve:
-
-- Updating policies, procedures, and security controls
-- Enhancing monitoring and detection capabilities
-- Conducting security training and awareness programs for employees
-- Engaging external cyber security experts for consultation and guidance
-
-## Documenting and Communicating
-
-Thorough documentation of the incident, response actions, and post-incident analysis is essential for internal and external communication, legal and regulatory compliance, and continued improvement. Documentation should be concise, accurate, and easily accessible. It may include:
-
-- Incident response reports and action items
-- Updated policies, procedures, and guidelines
-- Security awareness materials for employees
-- Executive summaries for senior management
-
-## Continuous Review and Improvement
-
-Lastly, it is important to never consider the recovery process as "finished." Just as the threat landscape evolves, your organization should maintain a proactive approach to cyber security by regularly reviewing, updating, and enhancing your incident response process.
-
-In summary, the recovery phase of the incident response process involves the restoration of affected systems and data, post-incident analysis, implementing improvements, documenting the incident, and maintaining a continuous improvement mindset. By following these steps, you will be better equipped to handle and recover from future cyber security incidents.
+- [@article@Incident Response Plan: Framework and Steps](https://www.crowdstrike.com/cybersecurity-101/incident-response/incident-response-steps/)
+- [@video@Incident Response Process](https://www.youtube.com/watch?v=fU_w8Ou9RVg)

src/data/roadmaps/cyber-security/content/ring@9vEUVJ8NTh0wKyIE6-diY.md

@@ -1,17 +1,8 @@
 # Ring
 
-Ring topology is a type of network configuration where each device is connected to two other devices, forming a circular layout or ring. In this topology, data packets travel from one device to another in a unidirectional manner until they reach the intended recipient or return to the sender, indicating that the recipient was not found in the network.
+In a ring topology, each network device is connected in a circular fashion, where data travels through each node in one direction (or both in a bidirectional setup) until it reaches its destination. This structure simplifies wiring and ensures a predictable data path, but a failure in any single node or connection can disrupt the entire network unless redundant paths are used. Ring topology is known for its straightforward installation but is less common today due to its vulnerability to network interruptions.
 
-## Advantages of Ring Topology
+Learn more from the following resources:
 
-- **Easy to Install and Configure:** Ring topology is relatively simpler to set up and maintain as it involves connecting each device to the two adjacent devices only.
-- **Predictable Data Transfer Time:** As data packets move in a circular pattern, it becomes easier to predict the maximum time required for a packet to reach its destination.
-- **Minimal Network Congestion:** The unidirectional flow of packets can significantly reduce the chances of network congestion, as the collision of data packets is less likely.
-
-## Disadvantages of Ring Topology
-
-- **Dependency on All Devices:** The malfunctioning of a single device or cable can interrupt the entire network, making it difficult to isolate the cause of the issue.
-- **Limited Scalability:** Adding or removing devices in a ring topology can temporarily disrupt the network as the circular pattern needs to be re-established.
-- **Slower Data Transfer:** Since data packets must pass through multiple devices before reaching the destination, the overall speed of data transfer can be slower compared to other topologies.
-
-Despite its drawbacks, ring topology can be a suitable option for small networks with a predictable data transfer pattern that require minimal maintenance and setup effort. However, for larger and more complex networks, other topologies like star, mesh, or hybrid configurations may provide better flexibility, reliability, and performance.
+- [@article@What is ring topology?](https://www.lenovo.com/gb/en/glossary/what-is-ring-topology/)
+- [@video@Network Topologies - Ring](https://www.youtube.com/watch?v=hjeDN2xnc50)

src/data/roadmaps/cyber-security/content/rmf@fjEdufrZAfW4Rl6yDU8Hk.md

@@ -1,24 +1,18 @@
 # RMF
 
-The **Risk Management Framework (RMF)** is a comprehensive, flexible approach for managing cybersecurity risks in an organization. It provides a structured process to identify, assess, and manage risks associated with IT systems, networks, and data. Developed by the National Institute of Standards and Technology (NIST), the RMF is widely adopted by various government and private sector organizations.
+A **Risk Management Framework (RMF)** is a structured approach that organizations use to identify, assess, manage, and mitigate risks. It provides a systematic process to ensure that risks are effectively controlled and aligned with the organization's objectives. Key components include:
 
-## Key Components
+1. **Risk Identification:** Identifying potential internal and external risks that could impact the organization.
+2. **Risk Assessment:** Evaluating the likelihood and impact of identified risks.
+3. **Risk Mitigation:** Developing strategies to reduce or eliminate risks, such as controls, policies, and contingency plans.
+4. **Risk Monitoring:** Continuously tracking risks and the effectiveness of mitigation measures.
+5. **Communication and Reporting:** Regularly updating stakeholders on the risk status and actions taken.
+6. **Review and Improvement:** Periodically reassessing the framework and adapting to changes in the business or regulatory environment.
 
-The RMF consists of six steps, which are continuously repeated to ensure the continuous monitoring and improvement of an organization's cybersecurity posture:
+The RMF ensures that risks are managed proactively and consistently across the organization, helping to safeguard assets and support strategic decision-making.
 
-- **Categorize** - Classify the information system and its information based on their impact levels (e.g., low, moderate, or high).
-- **Select** - Choose appropriate security controls from the NIST SP 800-53 catalog based on the system's categorization.
-- **Implement** - Apply the chosen security controls to the IT system and document the configuration settings and implementation methods.
-- **Assess** - Determine the effectiveness of the implemented security controls by testing and reviewing their performance against established baselines.
-- **Authorize** - Grant authorization to operate the IT system, based on the residual risks identified during the assessment phase, and document the accepted risks.
-- **Monitor** - Regularly review and update the security controls to address any changes in the IT system or environment or to respond to newly identified threats.
+Learn more from the following resources:
 
-## Benefits of RMF
+- [@article@What is the Risk Management Framework?](https://www.techtarget.com/searchcio/definition/Risk-Management-Framework-RMF)
+- [@video@RMF explained in 5 minutes](https://www.youtube.com/watch?v=X5yqPFp__rc)
 
-- **Clear and consistent process**: RMF provides a systematic and repeatable process for managing cybersecurity risks.
-- **Flexibility**: It can be tailored to an organization's unique requirements and risk tolerance levels.
-- **Standardization**: RMF facilitates the adoption of standardized security controls and risk management practices across the organization.
-- **Accountability**: It promotes transparency and clear assignment of responsibilities for managing risks.
-- **Continuous improvement**: By monitoring and revisiting the risks and security controls, organizations can ensure that their cybersecurity posture remains effective and up-to-date.
-
-In summary, the Risk Management Framework (RMF) is a vital component of an organization's cybersecurity strategy. By following the structured and continuous process outlined in the RMF, organizations can effectively manage the cybersecurity risks they face and maintain a robust and resilient cybersecurity posture.

src/data/roadmaps/cyber-security/content/roles-of-compliance-and-auditors@kqT0FRLt9Ak9P8PhHldO-.md

@@ -1,22 +1,7 @@
 # Roles of Compliance and Auditors
 
-Compliance and auditors play a crucial role in maintaining the security and integrity of any organization's digital infrastructure. They ensure that organizations follow industry-specific regulations, international standards, and defined security policies to reduce the risk of security breaches and protect sensitive data.
+Compliance officers ensure that an organization adheres to legal, regulatory, and internal policies by proactively implementing controls, training employees, and mitigating risks. Auditors, both internal and external, assess the effectiveness of these controls and the accuracy of financial reporting through periodic evaluations, providing independent assurance to management and stakeholders. While compliance focuses on prevention and day-to-day adherence, auditors focus on verifying and evaluating past performance to ensure integrity and identify areas for improvement. Both roles work together to manage risk and maintain organizational accountability.
 
-## Compliance
+Learn more from the following resources:
 
-Compliance refers to adhering to a set of rules, regulations, and best practices defined by industry standards, government regulations, or an organization's internal security policies. These may include:
-
-- **Industry Standards**: Security standards specific to an industry, e.g., _Payment Card Industry Data Security Standard (PCI DSS)_ for companies handling credit card transactions.
-- **Government Regulations**: Rules defined at a national or regional level to ensure the protection of sensitive information, e.g., _General Data Protection Regulation (GDPR)_ in the European Union.
-- **Internal Security Policies**: Guidelines and procedures created by an organization to manage its digital infrastructure and data securely.
-
-## Auditors
-
-Auditors, specifically cybersecurity auditors or information system auditors, are responsible for evaluating and verifying an organization's compliance with relevant regulations and standards. They perform rigorous assessments, suggest corrective actions, and prepare detailed reports highlighting discrepancies and vulnerabilities in the organization's information systems. Some key responsibilities of auditors include:
-
-- **Assessment**: Conduct comprehensive reviews of security policies, procedures, and controls in place. This may involve evaluating the effectiveness of firewalls, security software, and network configurations.
-- **Risk Management**: Identify and evaluate potential risks and vulnerabilities to an organization's digital infrastructure, such as data breaches, cyber-attacks, or human errors.
-- **Documentation**: Prepare detailed reports highlighting findings, recommendations, and corrective actions. This may include a list of vulnerabilities, compliance gaps, and improvement suggestions.
-- **Consultation**: Provide expert advice and technical guidance to management and IT teams to help organizations meet compliance requirements and improve their overall security posture.
-
-To summarize, compliance and auditors are essential in maintaining an organization's cybersecurity stance. Effective coordination between security professionals, management, and IT teams is needed to ensure the safety and protection of sensitive data and systems from evolving cyber threats.
+- [@article@What is a compliance audit?](https://www.auditboard.com/blog/compliance-audit/)

src/data/roadmaps/cyber-security/content/route@xFuWk7M-Vctk_xb7bHbWs.md

@@ -1,59 +1,7 @@
 # route
 
-`route` is a command-line utility that allows you to view and manipulate the IP routing table in your computer. The primary function of the routing table is to determine the best path for sending IP packets to their destination. Properly managing this table is crucial for network administrators, as it plays a direct role in your computer's ability to communicate with other devices on the network effectively.
+The `route` command is a network utility used to view and manipulate the IP routing table on Unix-like and Windows systems. It allows users to display the current routes that data packets take, as well as add, modify, or delete routes for network traffic. This command is often used in network troubleshooting and configuration to control how data flows between different networks and subnets. By specifying routes manually, administrators can define specific paths for network traffic, bypassing default routes and optimizing performance or security.
 
-## Using the Route Command
+Learn more from the following resources:
 
-The syntax for the route command is as follows:
-
-```
-route [COMMAND] [OPTIONS]
-```
-
-Here are some basic commands that you can use with `route`:
-
-- **route add** - Adds a new route to the table
-- **route delete** - Removes a route from the table
-- **route change** - Modifies a specific route in the table
-- **route get** - Retrieves information about a specific route
-- **route show** - Displays the entire routing table
-
-Please note that, to modify the routing table, administrative privileges may be needed.
-
-## Examples of Route Usage
-
-- **View the routing table**
-
-```
-route -n
-```
-
-This command will display the current routing table in a numerical format, which includes the destination, gateway, and interface.
-
-- **Add a new route**
-
-```
-sudo route add -net 192.168.2.0 netmask 255.255.255.0 gw 192.168.1.1
-```
-
-This command adds a new route to the destination network 192.168.2.0 with a netmask of 255.255.255.0 and a gateway of 192.168.1.1.
-
-- **Delete a route**
-
-```
-sudo route delete -net 192.168.2.0 netmask 255.255.255.0
-```
-
-This command removes the route to the destination network 192.168.2.0 with a netmask of 255.255.255.0.
-
-- **Change an existing route**
-
-```
-sudo route change -net 192.168.2.0 netmask 255.255.255.0 gw 192.168.1.2
-```
-
-This command modifies the existing route to the destination network 192.168.2.0 with a new gateway of 192.168.1.2.
-
-## Conclusion
-
-The `route` command is an essential tool for network administrators and anyone involved in cyber security. Understanding and being able to manipulate the IP routing table can help ensure that your computer is able to communicate effectively with other devices on the network, thus contributing to a more secure and efficient network environment.
+- [@article@How to check the routing table in Linux](https://www.geeksforgeeks.org/route-command-in-linux-with-examples/)

src/data/roadmaps/cyber-security/content/router@lwSFIbIX-xOZ0QK2sGFb1.md

@@ -1,33 +1,9 @@
 # Router
 
-A **router** is a networking device responsible for forwarding data packets between computer networks. It acts as a traffic coordinator, choosing the best possible path for data transmission, thus ensuring smooth communication between networks. Routers are an integral part of the internet, helping to establish and maintain connections between different networks and devices.
+Amazon Simple Storage Service (S3) is a scalable, object-based cloud storage service provided by AWS. It allows users to store and retrieve large amounts of data, such as files, backups, or media content, with high durability and availability. S3 is designed for flexibility, enabling users to access data from anywhere via the internet while offering security features like encryption and access controls. It is widely used for data storage, content distribution, disaster recovery, and big data analytics, providing cost-effective, scalable storage for a variety of applications.
 
-## Functionality of Routers
+Learn more from the following resources:
 
-- **Routing Decisions**: Routers analyze incoming data packets and make decisions on which path to forward the data based on destination IP addresses and network conditions.
+- [@article@What is a Router](https://www.cloudflare.com/en-gb/learning/network-layer/what-is-a-router/)
+- [@video@What is a router and how does it work?](https://www.youtube.com/watch?v=UIJzHLpG9bM)
 
-- **Connecting Networks**: Routers are essential in connecting different networks together. They enable communication between your home network and the broader internet, as well as between different networks within an organization.
-
-- **Managing Traffic**: Routers manage the flow of data to ensure optimal performance and avoid network congestion. They can prioritize certain types of data, such as video streaming, to ensure a better user experience.
-
-## Types of Routers
-
-- **Wired Routers**: Utilize Ethernet cables to connect devices to the network. They typically come with multiple ethernet ports for devices such as computers, gaming consoles, and smart TVs.
-
-- **Wireless Routers**: Provide network access without needing physical cables. Wireless routers use Wi-Fi to transmit data between devices and are the most common type of router found in homes and offices.
-
-- **Core Routers**: Operate within the backbone of the internet, directing data packets between major networks (such as ISPs). These routers are high-performance devices capable of handling massive amounts of data traffic.
-
-## Router Security
-
-As routers are a critical gateway between your network and the internet, it's essential to keep them secure. Some common router security practices include:
-
-- Changing default passwords and usernames: Manufacturers often set simple default passwords, which can be easily guessed or discovered by attackers. It's important to set a strong, unique password for your router.
-
-- Regular firmware updates: Router manufacturers release updates to address security vulnerabilities and improve performance. Keep your router's software up to date.
-
-- Disable remote management: Some routers have a feature that allows remote access, which can be exploited by hackers. If you don't need this feature, disable it.
-
-- Create a guest network: If your router supports it, create a separate network for guests to use. This isolates them from your primary network, ensuring that they cannot access your devices or data.
-
-By understanding routers and their role in cybersecurity, you can take the necessary steps to secure your network and protect your data.

src/data/roadmaps/cyber-security/content/s3@2jsTgT7k8MeaDtx6RJhOP.md

@@ -1,29 +1,8 @@
 # S3
 
-Amazon Simple Storage Service (S3) is a scalable, high-speed, low-latency object storage service designed and managed by Amazon Web Services (AWS). It offers a simple web service interface that allows developers and businesses to store and retrieve almost any amount or type of data, from anywhere on the internet.
+Amazon Simple Storage Service (S3) is a scalable, object-based cloud storage service provided by AWS. It allows users to store and retrieve large amounts of data, such as files, backups, or media content, with high durability and availability. S3 is designed for flexibility, enabling users to access data from anywhere via the internet while offering security features like encryption and access controls. It is widely used for data storage, content distribution, disaster recovery, and big data analytics, providing cost-effective, scalable storage for a variety of applications.
 
-## Key Features
+Learn more from the following resources:
 
-- **Scalable Storage**: Amazon S3 offers virtually unlimited storage capacity, making it perfect for applications that require large amounts of data storage or rapid scaling.
-
-- **High Durability**: S3 automatically stores your data redundantly across multiple devices in multiple geographically dispersed data centers, ensuring 99.999999999% durability of your data.
-
-- **Easy Data Management**: With S3's simple web interface, you can easily create, delete, and manage buckets (storage containers) and objects (files). You can also configure fine-tuned access controls to grant specific permissions to users or groups.
-
-- **Data Transfer**: Amazon S3 supports seamless data transfer using various methods like the AWS Management Console, AWS SDKs, and the REST API. You can also enable data transfers between S3 and other AWS services.
-
-- **Object Versioning**: S3 supports versioning of objects, allowing you to preserve, retrieve, and restore every version of an object in a bucket.
-
-- **Security**: S3 provides secure access to your data by integrating with AWS Identity and Access Management (IAM) and supporting encryption in transit and at rest.
-
-## Use cases
-
-- _Backup and Archiving_: Amazon S3 is an ideal solution for backing up and archiving your critical data, ensuring it's durably stored and immediately available when needed.
-
-- _Big Data Analytics_: With its scalable and data-agnostic design, S3 can support big data applications by consistently delivering low latency and high throughput access to vast amounts of data.
-
-- _Content Distribution_: S3 can be easily integrated with Amazon CloudFront, a content delivery network (CDN), to distribute large files, like videos or software packages, quickly and efficiently.
-
-- _Static Website Hosting_: You can host an entire static website on Amazon S3 by simply enabling the website hosting feature on your bucket and uploading the static files.
-
-In summary, Amazon S3 is an essential component of the AWS ecosystem that offers a reliable, scalable, and secure storage solution for businesses and applications of all sizes. By leveraging its powerful features and integrations, you can implement a robust cybersecurity strategy for your cloud storage needs.
+- [@article@AWS S3 Website](https://aws.amazon.com/pm/serv-s3/?gclid=Cj0KCQjwrp-3BhDgARIsAEWJ6SyhAtgc3NJbsxaAXVbWEOW5gG-XFH51jIc8SxahYSxNJ501l9soUA0aAnEjEALw_wcB&trk=777b3ec4-de01-41fb-aa63-cde3d034a89e&sc_channel=ps&ef_id=Cj0KCQjwrp-3BhDgARIsAEWJ6SyhAtgc3NJbsxaAXVbWEOW5gG-XFH51jIc8SxahYSxNJ501l9soUA0aAnEjEALw_wcB:G:s&s_kwcid=AL!4422!3!638364429346!e!!g!!aws%20s3!19096959014!142655567183)
+- [@video@Getting started with AWS S3](https://www.youtube.com/watch?v=e6w9LwZJFIA)

src/data/roadmaps/cyber-security/content/saas@sVw5KVNxPEatBRKb2ZbS_.md

@@ -1,33 +1,9 @@
 # SaaS
 
-**Software as a Service**, often abbreviated as **SaaS**, is a cloud-based software delivery model where applications are provided over the internet. Instead of installing and maintaining software locally on individual computers or servers, users can access the software and its features through a web browser.
+Software as a Service (SaaS) is a cloud-based model where software applications are delivered to users over the internet, eliminating the need for local installation or maintenance. SaaS providers manage infrastructure, security, and updates, allowing users to access the software on a subscription basis from any device with an internet connection. This model offers scalability, reduced upfront costs, and easy integration with other cloud services, making it a popular choice for businesses looking for flexibility and efficiency in software deployment.
 
-## Features
+Learn more from the following resources:
 
-SaaS offers various benefits and features that make it an attractive option for individuals and businesses alike. Some key features include:
+- [@article@iWhat is SaaS? Microsoft](https://azure.microsoft.com/en-us/resources/cloud-computing-dictionary/what-is-saas)
+- [@video@What is SaaS?](https://www.youtube.com/watch?v=UEHdYNXiIUU)
 
-- **Accessibility**: SaaS applications can be accessed from anywhere with an internet connection.
-- **Lower Costs**: As a user, you only pay for what you use, reducing upfront costs such as licences and infrastructure investments.
-- **Automatic Updates**: The SaaS provider is responsible for software updates, bug fixes, and patches. This means the latest version of the software is available to users without any manual intervention.
-- **Scalability**: SaaS applications can easily scale to accommodate a growing user base, making it an ideal choice for businesses of all sizes.
-- **Customization**: SaaS applications often come with various modules or add-ons that offer additional functionality and professional services for customization.
-
-## Security Considerations
-
-While SaaS offers numerous benefits, there are some potential concerns related to data security and privacy. Here are some key security considerations:
-
-- **Data Storage**: In a SaaS environment, your data is stored in the cloud, which means you need to trust the provider to properly secure it. Make sure the provider complies with relevant industry standards and regulations.
-- **Data Transmission**: It is crucial to verify that your data is encrypted when transmitted between your systems and the SaaS application. This can help protect your information from unauthorized access during transmission.
-- **Access Control**: Establish strong access control policies and procedures to ensure that only authorized users can access sensitive data within the SaaS application.
-- **Service Availability**: In case of a SaaS provider experiencing downtime or going out of business, make sure to have contingency plans in place, such as regular data backups and alternative software options.
-
-## Choosing a SaaS Provider
-
-Before committing to a SaaS provider, it is essential to undertake a thorough evaluation to ensure that it can meet your security and business requirements. Some aspects to consider include:
-
-- **Compliance**: Check if the provider adheres to legal and regulatory requirements in your industry.
-- **Service Level Agreements (SLAs)**: Review the provider's SLAs to understand their uptime guarantees, performance standards and penalties in case of SLA breaches.
-- **Data Management**: Make sure the provider offers tools and features to manage your data, such as importing, exporting, and data backup/restoration capabilities.
-- **Support**: Verify if the provider offers adequate support resources, like a 24/7 help desk and comprehensive documentation.
-
-By keeping these aspects in mind, you can make an informed decision about whether SaaS is the right solution for your business, and select the best SaaS provider to meet your unique needs.

src/data/roadmaps/cyber-security/content/salting@jqWhR6oTyX6yolUBv71VC.md

@@ -1,3 +1,8 @@
 # Salting
 
 Salting is a crucial concept within the realm of cryptography. It is a technique employed to enhance the security of passwords or equivalent sensitive data by adding an extra layer of protection to safeguard them against hacking attempts, such as brute-force attacks or dictionary attacks.
+
+Learn more from the following resources:
+
+- [@article@What is salting?](https://www.techtarget.com/searchsecurity/definition/salt)
+- [@video@](https://www.youtube.com/watch?v=PsIO0gxJF3g)

src/data/roadmaps/cyber-security/content/sandboxing@SLKwuLHHpC7D1FqrpPRAe.md

@@ -4,4 +4,5 @@ Sandboxing is a security technique where a program or code is isolated in a cont
 
 Visit the following resources to learn more:
 
-- [@article@What is Sandboxing?](https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-sandboxing/)
+- [@article@What is Sandboxing?](https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-sandboxing/)
+- [@video@Sandboxing in under 4 minutes](https://www.youtube.com/watch?v=kn32PHG2wcU)

src/data/roadmaps/cyber-security/content/sans-holiday-hack-challenge@WCeJrvWl837m1BIjuA1Mu.md

@@ -1,38 +1,8 @@
 # SANS Holiday Hack Challenge
 
-The **SANs Holiday Hack Challenge** is a popular and engaging annual cybersecurity event that features a unique blend of digital forensics, offensive security, defensive security, and other cybersecurity topics. It is hosted by the SANS Institute, one of the largest and most trusted sources for information security training, certification, and research worldwide.
+The SANS Holiday Hack Challenge is an annual cybersecurity event that offers participants the opportunity to solve a series of themed cybersecurity puzzles and challenges. Designed to engage both beginners and experienced professionals, the challenge covers a wide range of topics including network forensics, penetration testing, reverse engineering, and more. It provides a fun, gamified learning experience that encourages participants to enhance their skills while collaborating with the global cybersecurity community. The event often features real-world security scenarios, creative storytelling, and interactive, hands-on tasks.
 
-## Overview
+Learn more from the following resources:
 
-The SANs Holiday Hack Challenge incorporates a series of challenging and entertaining cybersecurity puzzles, with a festive holiday theme, for participants of all skill levels. The event typically takes place during the December holiday season, and participants have around a month to complete the challenges. It is free to participate, making the event accessible to a wide range of cybersecurity enthusiasts, from beginners to seasoned professionals.
-
-## Format
-
-The SANs Holiday Hack Challenge presents a compelling storyline where participants assume the role of a security practitioner tasked with solving various security issues and puzzles. Details of the challenges are weaved into the storyline, which may contain videos, images, and other forms of multimedia. Solving the challenges requires creative problem-solving and the application of various cybersecurity skills, including:
-
-- Digital Forensics
-- Penetration Testing
-- Reverse Engineering
-- Web Application Security
-- Cryptography
-- Defensive Security Techniques
-
-Each year, the Holiday Hack Challenge presents a new storyline and set of challenges aimed at providing real-world learning opportunities for those looking to improve their cybersecurity skills.
-
-## Prizes
-
-Participants have a chance to win prestigious recognition for their performance in the challenge. By successfully solving the holiday-themed cybersecurity puzzles, participants may be awarded prizes, SANS training courses, certifications, or other recognition in the cybersecurity community.
-
-## Why Participate
-
-The SANs Holiday Hack Challenge is a valuable experience for people with an interest in cybersecurity, offering an entertaining and educational challenge. Reasons to participate include:
-
-- **Skill Development**: The challenge provides an opportunity to sharpen your technical skills in various cybersecurity domains.
-- **Networking**: Work with like-minded security enthusiasts to solve problems, share knowledge, and build connections in the industry.
-- **Recognition**: Achieve recognition for your skills and contribution to tackling real-world cybersecurity issues.
-- **Fun**: Experience the thrill of solving complex security problems while enjoying the festive theme and engaging storyline.
-
-In conclusion, the SANs Holiday Hack Challenge offers a unique opportunity to develop your cybersecurity skills in a fun and challenging environment. Whether you are new to the field or an industry veteran, participating in this event will help you grow professionally and make valuable connections in the cybersecurity community. Don't miss the next SANs Holiday Hack Challenge!
-
-- [@official@SANS Holiday Hack Challenge](https://www.sans.org/holidayhack)
-- [@feed@Explore top posts about Security](https://app.daily.dev/tags/security?ref=roadmapsh)
+- [@official@SANS Holiday Hack Website](https://www.sans.org/mlp/holiday-hack-challenge-2023/)
+- [@video@Official SANS Holiday Hack Challenge Video](https://www.youtube.com/watch?v=zfhhLi8jZzI)

src/data/roadmaps/cyber-security/content/sftp@YEy6o-clTBKZp1yOkLwNb.md

@@ -1,27 +1,8 @@
 # SFTP
 
-**SFTP** (Secure File Transfer Protocol) is a network protocol designed to securely transfer files over an encrypted connection, usually via SSH (Secure Shell). SFTP provides file access, file transfer, and file management functionalities, making it a popular choice for secure file transfers between a client and a server.
+SFTP (SSH File Transfer Protocol) is a secure file transfer protocol that provides file access, transfer, and management over a reliable data stream. It runs over the SSH protocol, typically on port 22, ensuring encrypted file transfers. SFTP offers stronger security than traditional FTP by encrypting both commands and data in transit, preventing unauthorized interception. It supports features like resuming interrupted transfers, directory listings, and remote file system operations. SFTP is widely used for secure file transfers in various environments, from web hosting to enterprise data management, offering a more secure alternative to FTP while maintaining similar functionality. Its integration with SSH makes it a preferred choice for secure, authenticated file transfers in many network configurations.
 
-## Key features of SFTP
+Learn more from the following resources:
 
-- **Security**: SFTP automatically encrypts data before it is sent, ensuring that your files and sensitive data are protected from unauthorized access while in transit.
-
-- **Authentication**: SFTP relies on SSH for user authentication, allowing you to use password-based, public key, or host-based authentication methods.
-
-- **File Integrity**: SFTP uses checksums to verify that transferred files have maintained their integrity during transport, allowing you to confirm that files received are identical to those sent.
-
-- **Resume Capability**: SFTP offers support for resuming interrupted file transfers, making it an ideal choice for transferring large files or transferring files over potentially unreliable connections.
-
-## How SFTP works
-
-SFTP operates over an established SSH connection between the client and server. Upon successful SSH authentication, the client can issue commands to the server, such as to list, upload, or download files. The data transferred between the client and server is encrypted, ensuring that sensitive information is not exposed during the transfer process.
-
-## When to use SFTP
-
-SFTP is an ideal choice whenever you need to securely transfer files between a client and a server. Examples of when you might want to use SFTP instead of other protocols include:
-
-- Transferring sensitive data such as customer information, financial records, or intellectual property.
-- Uploading or downloading files to/from a remote server in a secure manner, especially when dealing with confidential data.
-- Managing files on a remote server, which may involve creating, renaming, or deleting files and directories.
-
-Overall, SFTP provides a secure and reliable way of transferring files over the internet, making it an essential tool for maintaining the integrity and confidentiality of your data in today's cyber security landscape.
+- [@article@What is SFTP?](https://www.precisely.com/glossary/sftp)
+- [@video@How to use SFTP Commands to Copy Files to/from a Server](https://www.youtube.com/watch?v=22lBJIfO9qQ&t=4s)

src/data/roadmaps/cyber-security/content/shoulder-surfing@FD0bkmxNpPXiUB_NevEUf.md

@@ -4,7 +4,6 @@ In a Shoulder Surfing Attack, an attacker tries to get information when you are
 
 Visit the following resources to learn more:
 
-- [@article@What is Shoulder Surfing](https://www.geeksforgeeks.org/what-is-shoulder-surfing-in-cyber-security/)
 - [@article@What is shoulder surfing, and how can you avoid it?](https://nordvpn.com/blog/shoulder-surfing/?srsltid=AfmBOorl5NPpW_Tnhas9gB2HiblorqwXyK0NJae7uaketrnDwbjJmiYV)
 - [@article@What is Shoulder Surfing?](https://www.mcafee.com/learn/what-is-shoulder-surfing/)
 - [@article@What is Shoulder Surfing? 9 ways to protect yourself](https://www.bigrock.in/blog/products/security/what-is-shoulder-surfing-9-ways-to-protect-yourself-from-shoulder-surfing/)

src/data/roadmaps/cyber-security/content/siem@c2kY3wZVFKZYxMARhLIwO.md

@@ -1,11 +1,7 @@
 # SIEM
 
 SIEM, short for Security Information and Event Manager, is a term used to describe tools that greatly increases visibility into a network or system. 
-It does this by monitoring, filtering, collecting, normalizing, and correlating vast amounts of data such as logs, and neatly presents it via an interface/dashboard. 
-
-Organizations leverage SIEMs to monitor and thus identify, protect, and respond to potential threats in their environment. 
-
-For hands-on experience, you should consider setting up a SIEM in your own environment. There are some commercial tools that you can try out for free, and there are also open source alternatives, such as Wazuh or LevelBlue OSSIM (AlienVault).
+It does this by monitoring, filtering, collecting, normalizing, and correlating vast amounts of data such as logs, and neatly presents it via an interface/dashboard.  Organizations leverage SIEMs to monitor and thus identify, protect, and respond to potential threats in their environment. For hands-on experience, you should consider setting up a SIEM in your own environment. There are some commercial tools that you can try out for free, and there are also open source alternatives, such as Wazuh or LevelBlue OSSIM (AlienVault).
 
 Visit the following resources to learn more:
 

src/data/roadmaps/cyber-security/content/sinkholes@oFgyQYL3Ws-l7B5AF-bTR.md

@@ -1,34 +1,7 @@
 # Sinkholes
 
-A **sinkhole** is a security mechanism employed in cybersecurity to redirect and isolate malicious traffic, primarily aimed at protecting networks from Distributed Denial of Service (DDoS) attacks and botnets. The main principle behind sinkholes is to create a "black hole" where malicious traffic is directed and monitored, allowing other network operations to run unaffected.
+A sinkhole in cybersecurity is a method used to redirect malicious Internet traffic away from its intended destination to a designated server or IP address controlled by a security team or researcher. This technique is often employed to combat botnets, malware, and other cyber threats. By redirecting traffic to a sinkhole, analysts can monitor and analyze malicious activities, prevent further spread of threats, and gather intelligence on attack patterns. Sinkholes are particularly useful in disrupting command and control communications of botnets, effectively neutralizing their ability to receive instructions or exfiltrate data. This approach is a critical tool in large-scale threat mitigation and cyber defense strategies.
 
-## How Sinkholes Work
+Learn more from the following resources:
 
-- **Network redirection:** When an attacker attempts to target a network, they often rely on multiple sources of traffic or requests. Sinkholes work by redirecting this incoming malicious traffic to a separate, isolated server or IP address, known as the sinkhole server.
-
-- **Traffic analysis:** Once the malicious traffic has been redirected, the sinkhole provides an opportunity for cybersecurity professionals to analyze the incoming data. This analysis can help determine the nature of the attack and potentially trace it back to its origin.
-
-- **Prevention and mitigation:** By redirecting malicious traffic away from the original target, sinkholes prevent or minimize the effects of DDoS attacks or botnet activities on a network. Additionally, information gathered from the sinkhole can aid in the development of new security measures to prevent future attacks.
-
-## Types of Sinkholes
-
-There are mainly two types of sinkholes used in cybersecurity: Passive Sinkholes and Active Sinkholes.
-
-- **Passive Sinkholes:** In a passive sinkhole, the sinkhole server is configured to passively intercept and log any malicious traffic directed towards it. This allows for analysis of attack patterns, data payloads, and other useful information without taking any direct action.
-
-- **Active Sinkholes:** An active sinkhole, on the other hand, goes one step further by not only intercepting and logging malicious traffic but also responding to the source, potentially disrupting the attacker's operations.
-
-## Benefits of Sinkholes
-
-- **DDoS prevention:** By redirecting and isolating malicious traffic, sinkholes can effectively prevent or reduce the impact of DDoS attacks on a network.
-- **Attack analysis:** The isolated environment provided by sinkholes enables security professionals to study attack patterns and develop strategies to counter them.
-- **Botnet disruption:** Sinkholes can disrupt the communication between botnets and their command and control (C&C) servers, limiting their ability to carry out coordinated attacks.
-
-## Limitations of Sinkholes
-
-- **Resource-intensive:** Sinkhole servers require dedicated resources to handle the influx of traffic and may need regular updating and maintenance.
-- **Possibility of collateral damage:** In some cases, sinkhole servers may inadvertently redirect or block legitimate traffic, leading to disruptions in network operations.
-
-## Conclusion
-
-Sinkholes are valuable tools in the cybersecurity arsenal, helping to prevent and mitigate the effects of DDoS attacks and botnets. By isolating malicious traffic, they not only minimize the impact of attacks on networks but also provide valuable insights into attack patterns, contributing to the development of more robust cybersecurity measures.
+- [@article@DNS Sinkholes: What is it and how to start using](https://www.threatintelligence.com/blog/dns-sinkhole)

src/data/roadmaps/cyber-security/content/smime@9rmDvycXFcsGOq3v-_ziD.md

@@ -1,19 +1,8 @@
 # S/MIME
 
-**S/MIME** stands for Secure/Multipurpose Internet Mail Extensions, and it is a cryptographic protocol that enhances the security of business emails through encryption and digital signatures. It allows users to encrypt emails and digitally sign them to verify the sender’s identity.
+S/MIME (Secure/Multipurpose Internet Mail Extensions) is a protocol for sending digitally signed and encrypted messages. It provides end-to-end encryption and authentication for email communications. S/MIME uses public key cryptography to ensure message confidentiality, integrity, and non-repudiation. It allows users to verify the sender's identity and ensures that the message hasn't been tampered with during transmission. S/MIME is widely supported by major email clients and is commonly used in corporate environments to secure sensitive communications. While it offers strong security, its adoption can be limited by the need for certificate management and the complexity of key exchange processes.
 
-## Advantages of S/MIME
+Learn more from the following resources:
 
-- **Verification**: Confirms the sender’s identity.
-
-- **Confidentiality**: Protects the content from unauthorized access.
-
-- **Integrity**: Ensures the message has not been altered.
-
-- **Secure Data Transfer**: Safely transmits files like images, audio, videos, and documents.
-
-- **Non-repudiation**: Prevents the sender from denying the origin of the message.
-
-## How S/MIME Works
-
-S/MIME enables the transmission of non-ASCII data via the Secure Mail Transfer Protocol (SMTP). It securely sends various data files, including music, video, and images, using encryption. Data encrypted with a public key can only be decrypted by the recipient’s private key, ensuring secure end-to-end communication.
+- [@article@S/MIME for message signing and encryption in Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/smime-exo/smime-exo)
+- [@video@S/MIME - Secure MIME protocol - Functions, Services](https://www.youtube.com/watch?v=0hzmoB7yYfw)

src/data/roadmaps/cyber-security/content/smishing@d4U6Jq-CUB1nNN2OCFoum.md

@@ -1,3 +1,8 @@
 # Smishing
 
-SMS-phishing, or "smishing", is a type of social-engineering attack based on SMS, or text messages, to trick a victim into doing something to the benefit of the attacker, such as clicking on a malicious link or providing sensitive information.
+Smishing, a portmanteau of "SMS" and "phishing," is a form of cyber attack that uses text messages (SMS) to deceive recipients into divulging sensitive information or taking harmful actions. Attackers typically impersonate trusted entities like banks, government agencies, or popular services, urging victims to click on malicious links, download harmful apps, or provide personal data. These messages often create a sense of urgency or offer enticing rewards to manipulate recipients. Smishing exploits the trust people place in mobile communications and the limited security features of SMS. As mobile device usage increases, smishing has become a significant threat, requiring user awareness and caution when interacting with unsolicited text messages.
+
+Learn more from the following:
+
+- [@article@What is smishing (SMS phishing)?](https://www.ibm.com/topics/smishing)
+- [@video@What is smishing? How phishing via text message works](https://www.youtube.com/watch?v=ZOZGQeG8avQ)

src/data/roadmaps/cyber-security/content/soar@i0ulrA-GJrNhIVmzdWDrn.md

@@ -0,0 +1,8 @@
+# SOAR
+
+SOAR (Security Orchestration, Automation, and Response) is a set of software solutions and tools that enable organizations to streamline security operations. It combines three key capabilities: orchestration of security tools, automation of repetitive tasks, and intelligent incident response. SOAR platforms integrate with existing security tools, automate workflow processes, and provide case management features. They help security teams respond faster to incidents, reduce manual workload, standardize response procedures, and improve overall incident management efficiency. SOAR solutions are particularly valuable in managing the high volume of security alerts in modern environments, helping prioritize threats and coordinate responses across multiple tools and teams.
+
+Learn more from the following resources:
+
+- [@article@What is SOAR?](https://www.paloaltonetworks.co.uk/cyberpedia/what-is-soar)
+- [@video@What is SOAR (Security, Orchestration, Automation & Response)](https://www.youtube.com/watch?v=k7ju95jDxFA)

src/data/roadmaps/cyber-security/content/social-engineering@O1VceThdxRlgQ6DcGyY7Y.md

@@ -5,3 +5,4 @@ Social Engineering is a manipulation technique that exploits human psychology to
 Visit the following resources to learn more:
 
 - [@article@What Is Social Engineering?](https://www.cisco.com/c/en/us/products/security/what-is-social-engineering.html)
+- [@video@Social Engineering Explained](https://www.youtube.com/shorts/DdCSraNCxhs)

src/data/roadmaps/cyber-security/content/spam-vs-spim@cbEMUyg_btIPjdx-XqIM5.md

@@ -1,9 +1,8 @@
 # Spam vs. Spim
 
-Spam refers to unsolicited and often irrelevant messages sent over email, typically to a large number of recipients, with the purpose of advertising, phishing, spreading malware, or other malicious activities. Spam emails are usually sent by automated bots and are characterized by their bulk nature.
-
-Spim is a type of spam that specifically targets instant messaging (IM) platforms rather than email. Spim messages are unsolicited and typically used for advertising, phishing, or spreading malware. As instant messaging apps have grown in popularity, so too has the prevalence of Spim.
+Spam refers to unsolicited and often irrelevant messages sent over email, typically to a large number of recipients, with the purpose of advertising, phishing, spreading malware, or other malicious activities. Spam emails are usually sent by automated bots and are characterized by their bulk nature. Spim is a type of spam that specifically targets instant messaging (IM) platforms rather than email. Spim messages are unsolicited and typically used for advertising, phishing, or spreading malware. As instant messaging apps have grown in popularity, so too has the prevalence of Spim.
 
 Visit the following resources to learn more:
 
 - [@article@What Is Spam?](https://www.proofpoint.com/us/threat-reference/spam)
+- [@article@What Is Spim?](https://www.brosix.com/blog/what-is-spim/)

src/data/roadmaps/cyber-security/content/spoofing@LteSouUtAj3JWWOzcjQPl.md

@@ -4,4 +4,5 @@ Spoofing is a form of deception where someone or something pretends to be anothe
 
 Visit the following resources to learn more:
 
-- [@article@Definition and Explanation of Spoofing](https://www.kaspersky.com/resource-center/definitions/spoofing)
+- [@article@Definition and Explanation of Spoofing](https://www.kaspersky.com/resource-center/definitions/spoofing)
+- [@video@What is spoofing?](https://www.youtube.com/watch?v=jIS9XUC4TB4)

src/data/roadmaps/cyber-security/content/sql-injection@P-Am25WJV8cFd_KsX7cdj.md

@@ -5,3 +5,4 @@
 Visit the following resources to learn more:
 
 - [@article@PortSwigger - SQL Injection](https://portswigger.net/web-security/sql-injection)
+- [@video@SQL Injections are scary](https://www.youtube.com/watch?v=2OPVViV-GQk)

src/data/roadmaps/cyber-security/content/srtp@_9lQSG6fn69Yd9rs1pQdL.md

@@ -0,0 +1,7 @@
+# SRTP
+
+SRTP (Secure Real-time Transport Protocol) is a security-enhanced version of the Real-time Transport Protocol (RTP) used for voice and video communication over IP networks. It provides encryption, message authentication, and integrity for RTP data in unicast and multicast applications. SRTP is designed to ensure the confidentiality of media streams and protect against eavesdropping, tampering, and replay attacks in Voice over IP (VoIP) and video conferencing systems. It uses AES encryption for confidentiality and HMAC-SHA1 for authentication. SRTP is widely used in secure communication applications, including SIP-based VoIP systems and WebRTC, to protect sensitive audio and video transmissions across potentially untrusted networks.
+
+Learn more from the following resources:
+
+- [@article@SRTP (Secure RTP)](https://developer.mozilla.org/en-US/docs/Glossary/RTP)

src/data/roadmaps/cyber-security/content/ssh@8Mog890Lj-gVBpWa05EzT.md

@@ -1,33 +1,8 @@
 # SSH
 
-SSH, or Secure Shell, is a cryptographic network protocol that provides a secure and encrypted method for managing network devices and accessing remote servers. SSH is widely used by administrators and developers to enable secure remote access, file transfers, and remote command execution over unsecured networks, such as the internet.
+SSH (Secure Shell) is a cryptographic network protocol used for secure remote login and other secure network services over an unsecured network. It provides a secure channel over an unsecured network by using strong encryption to protect the connection against eavesdropping, tampering, and man-in-the-middle attacks. SSH is commonly used for remote command-line login, remote command execution, and secure file transfers. It typically runs on TCP port 22 and replaces older, less secure protocols like Telnet. SSH uses public-key cryptography for authentication and supports various authentication methods, including passwords and key-based authentication. It's a fundamental tool for system administrators, developers, and anyone requiring secure remote access to systems.
 
-## Key Features
+Learn more from the following resources:
 
-- **Encryption**: SSH uses a variety of encryption algorithms to ensure the confidentiality and integrity of data transmitted between the client and server.
-
-- **Authentication**: SSH supports multiple authentication methods, including password-based, public key, and host-based authentication, providing flexibility in securely verifying the identities of communicating parties.
-
-- **Port Forwarding**: SSH allows forwarding of network ports, enabling users to tunnel other protocols securely, such as HTTP or FTP, through an encrypted connection.
-
-- **Secure File Transfer**: SSH provides two file transfer protocols, SCP (Secure Copy Protocol) and SFTP (SSH File Transfer Protocol), to securely transfer files between a local client and remote server.
-
-## Common Use Cases
-
-- **Remote System Administration**: Administrators can securely access and manage remote systems, such as servers and network devices, using SSH to execute commands and configure settings.
-
-- **Secure File Transfers**: Developers and administrators can transfer files securely between systems using SCP or SFTP, protecting sensitive data from eavesdropping.
-
-- **Remote Application Access**: Users can securely access remote applications by creating an SSH tunnel, allowing them to connect to services that would otherwise be inaccessible due to firewalls or other network restrictions.
-
-## Tips for Secure SSH Usage
-
-- **Disable root login**: To reduce the risk of unauthorized access, it is recommended to disable direct root login and use a standard user account with sudo privileges for administration tasks.
-
-- **Use Key-Based Authentication**: To further enhance security, disallow password-based authentication and use public key authentication instead, making it more difficult for attackers to gain access through brute-force attacks.
-
-- **Limit SSH Access**: Restrict SSH access to specific IP addresses or networks, minimizing the potential attack surface.
-
-- **Keep SSH Software Updated**: Regularly update your SSH client and server software to ensure you have the latest security patches and features.
-
-In summary, SSH is a vital protocol for ensuring secure communication, remote access, and file transfers. By understanding its key features, use cases, and best practices, users can leverage the security benefits of SSH to protect their sensitive data and systems.
+- [@article@What is SSH? | Secure Shell (SSH) protocol](https://www.cloudflare.com/en-gb/learning/access-management/what-is-ssh/)
+- [@video@How does SSH work](https://www.youtube.com/watch?v=5JvLV2-ngCI)

src/data/roadmaps/cyber-security/content/ssl--tls@LKK1A5-xawA7yCIAWHS8P.md

@@ -1,37 +1,8 @@
-# SSL / TLS
+# SSL vs TLS
 
-**Secure Socket Layer (SSL)** and **Transport Layer Security (TLS)** are cryptographic protocols designed to provide security and data integrity for communications over networks. These protocols are commonly used for securing web traffic and ensuring that sensitive information, such as credit card numbers and login credentials, are transmitted securely between clients (e.g., web browsers) and servers.
-
-## SSL
-
-SSL was developed by Netscape in the mid-1990s and has gone through several iterations. The last version, SSLv3, was released in 1996. SSL was deprecated in 2015 due to security concerns, and it is not recommended for use in modern applications.
-
-## TLS
-
-TLS is the successor to SSL and is continually evolving with new versions and updates. The most recent version, TLS 1.3, was released in 2018. TLS is widely used and considered the standard for securing web traffic.
-
-## How SSL/TLS Works
-
-SSL/TLS operates by encrypting the data transmitted between a client and a server, ensuring that the data cannot be easily intercepted or tampered with. The encryption is achieved using a combination of cryptographic algorithms, key exchanges, and digital certificates.
-
-Here are the key steps in setting up an SSL/TLS connection:
-
-- **Handshake:** The client and server will engage in a process called a "handshake" to establish a secure connection. During this process, the client and server agree on which version of SSL/TLS to use, and choose the cipher suites and cryptographic algorithms they will use to secure the communication.
-
-- **Key Exchange:** The client and server will perform a key exchange, a process by which they generate and securely share encryption keys. These keys will be used to encrypt and decrypt the data being transmitted between them.
-
-- **Certificate Verification:** The server will provide a digital certificate, which contains its public key and information about the server. The client checks the validity of the certificate by confirming that it was issued by a trusted Certificate Authority (CA) and has not expired.
-
-- **Secure Communication:** Once the handshake, key exchange, and certificate verification are complete, the client and server can begin securely transmitting data using the encryption keys they have shared.
-
-## Advantages of SSL/TLS
-
-- **Secure communication:** SSL/TLS provides a secure, encrypted tunnel for data to be transmitted between clients and servers, protecting sensitive information from eavesdropping, interception, and tampering.
-
-- **Authentication:** SSL/TLS uses digital certificates to authenticate the server and sometimes the client. This helps to ensure that the parties involved in the communication are who they claim to be.
-
-- **Data integrity:** SSL/TLS includes mechanisms to confirm that the data received has not been tampered with during transmission, maintaining the integrity of the information being sent.
+Single Sign-On (SSO) is an authentication method that allows users to access multiple applications or systems with one set of login credentials. It enables users to log in once and gain access to various connected systems without re-entering credentials. SSO enhances user experience by reducing password fatigue, streamlines access management for IT departments, and can improve security by centralizing authentication controls. It typically uses protocols like SAML, OAuth, or OpenID Connect to securely share authentication information across different domains. While SSO offers convenience and can strengthen security when implemented correctly, it also presents a single point of failure if compromised, making robust security measures for the SSO system critical.
 
 Learn more from the following resources:
 
-- [@video@SSL, TLS, HTTPS Explained](https://www.youtube.com/watch?v=j9QmMEWmcfo)
+- [@article@What’s the Difference Between SSL and TLS?](https://aws.amazon.com/compare/the-difference-between-ssl-and-tls/)
+- [@video@TLS vs SSL - What's the Difference?](https://www.youtube.com/watch?v=J7fI_jH7L84)

src/data/roadmaps/cyber-security/content/ssl-and-tls-basics@dJ0NUsODFhk52W2zZxoPh.md

@@ -1,33 +1,8 @@
-# SSL and TLS Basics
+# SSL vs TLS
 
-Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are cryptographic protocols designed to provide secure communication over a computer network. They play a vital role in protecting sensitive information transmitted online, such as login credentials, financial information, and private user data.
-
-## Secure Sockets Layer (SSL)
-
-SSL is the predecessor to TLS and was first introduced in the 1990s. It creates an encrypted connection between a client (typically a web browser) and a server to ensure that any data transmitted remains private and secure. SSL uses a combination of symmetric and asymmetric encryption methods, as well as digital certificates, to establish and maintain secure communication.
-
-## Transport Layer Security (TLS)
-
-TLS is an improved and more secure version of SSL, with TLS 1.0 being released as an upgrade to SSL 3.0. The current version, as of this guide, is TLS 1.3. TLS provides a more robust and flexible security framework, addressing many of the vulnerabilities present in SSL. While many people still refer to SSL when discussing secure web communication, it's important to note that SSL has been deprecated, and TLS is the best-practice standard for secure communication.
-
-## Key Components
-
-- **Encryption**: SSL and TLS use powerful algorithms to protect data through encryption, ensuring it's unreadable by anyone without the proper decryption keys.
-- **Authentication**: SSL/TLS digital certificates verify the identities of clients and servers, providing trust and authenticity.
-- **Integrity**: These security protocols use message authentication codes to ensure that the data sent between clients and servers has not been tampered with during transmission.
-
-## Handshake Process
-
-SSL and TLS follow a series of steps, known as the "handshake process," to create a secure connection:
-
-- **Client hello**: The client initiates the handshake process by sending a message with supported cryptographic algorithms, random numbers, and session information.
-- **Server hello**: The server responds with its chosen cryptographic algorithms, random numbers, and its digital certificate. Optionally, the server can request the client's certificate for mutual authentication.
-- **Client verification**: The client verifies the server's certificate and may send its own if requested. It then creates a pre-master secret, encrypts it with the server's public key, and sends it to the server.
-- **Key generation and exchange**: Both the client and server generate the master secret and session keys using the pre-master secret and shared random numbers. These keys are used for encrypting and decrypting the data transmitted.
-- **Secured connection**: Once the keys are exchanged, the client and server can now communicate securely using the established encryption and keys.
-
-Secure communication is critical for any organization handling sensitive data. SSL and TLS serve as the backbone for protecting data in transit and play a significant role in ensuring the confidentiality, integrity, and authenticity of online communications.
+Single Sign-On (SSO) is an authentication method that allows users to access multiple applications or systems with one set of login credentials. It enables users to log in once and gain access to various connected systems without re-entering credentials. SSO enhances user experience by reducing password fatigue, streamlines access management for IT departments, and can improve security by centralizing authentication controls. It typically uses protocols like SAML, OAuth, or OpenID Connect to securely share authentication information across different domains. While SSO offers convenience and can strengthen security when implemented correctly, it also presents a single point of failure if compromised, making robust security measures for the SSO system critical.
 
 Learn more from the following resources:
 
-- [@video@SSH vs TLS vs SSL](https://www.youtube.com/watch?v=k3rFFLmQCuY)
+- [@article@What’s the Difference Between SSL and TLS?](https://aws.amazon.com/compare/the-difference-between-ssl-and-tls/)
+- [@video@TLS vs SSL - What's the Difference?](https://www.youtube.com/watch?v=J7fI_jH7L84)