Organization

1. person or group of people that has its own functions with responsibilities, authorities and relationships to achieve its objectives.
   ~ ISO 14017:2022, Environmental management — Requirements with guidance for verification and validation of water statements
2. group of people and facilities with an arrangement of responsibilities, authorities, and relationships
   ~ ISO/IEC 33001:2015, Information technology — Process assessment — Concepts and terminology
3. company, firm, enterprise, association or other legal entity, whether incorporated or not, or public body
   ~ ISO 10845-1:2020, Construction procurement — Part 1: Processes, methods and procedures

Policy

1. intentions and direction of an organization as formally expressed by its top management.
   ~ ISO 14298:2021, Graphic technology — Management of security printing processes
2. set of rules related to a particular purpose
   Note 1 to entry: A rule can be expressed as an obligation, an authorization, a permission or a prohibition.
   ~ ISO/TS 21089:2018, Health informatics — Trusted end-to-end information flows
3. clear and measurable statement of preferred direction and behavior to condition the decisions made within an organization
   ~ ISO/IEC/IEEE 15289:2019, Systems and software engineering — Content of life-cycle information items (documentation)

Requirement

1. provision that conveys criteria to be fulfilled
   ~ ISO/IEC 11404:2007, Information technology — General-Purpose Datatypes (GPD)
2. need or expectation that is stated, generally implied or obligatory
   ~ ISO 20468-1:2018, Guidelines for performance evaluation of treatment technologies for water reuse systems — Part 1: General
3. need or expectation, stated or generally implied, whose fulfillment is obligatory
   ~ SO 17566:2011, Space systems — General test documentation
4. statement which translates or expresses a need and its associated constraints and conditions
   ~ ISO/IEC/IEEE 15288:2023, Systems and software engineering — System life cycle processes

Principle

1. fundamental truth, proposition or assumption that serves as foundation for a set of beliefs or behaviours or for a chain of reasoning.
   ~ ISO 37000:2021, Governance of organizations — Guidance
2. fundamental, primary assumption and quality which constitutes a source of action determining particular objectives or results
   Note 1 to entry: A principle is usually enforced by rules that affect its boundaries.
   Note 2 to entry: A principle is usually supported through one or more rules.
   Note 3 to entry: A principle is usually part of a set of principles which together form a unified whole.
   EXAMPLE:Within a jurisdictional domain, examples of a set of principles include a charter, a constitution, etc.
   ~ ISO/IEC 15944-17:2024, Information technology — Business operational view — Part 17: Fundamental principles and rules governing Privacy-by-Design (PbD) requirements in an EDI and collaboration space context

Quality

1. degree to which a set of inherent characteristics fulfils requirements.
   Note 1 to entry: The term “quality” can be used with adjectives such as poor, good, or excellent.
   Note 2 to entry: “Inherent”, as opposed to “assigned”, means existing in something, especially as a permanent characteristic.
   ~ ISO 19101-1:2014: Geographic information — Reference model — Part 1: Fundamentals

Assurance

1. grounds for justified confidence that a claim has been or will be achieved
   ~ ISO/IEC TR 15443-1:2012, Information technology — Security techniques — Security assurance framework — Part 1: Introduction and concepts
2. planned and systematic activities implemented, and demonstrated as needed, to provide adequate confidence that an entity fulfils its requirements
   ~ ISO 10795:2019, Space systems — Programme management and quality — Vocabulary

Framework

1. logical structure for classifying and organizing complex information
   ~ ISO/TS 19150-1:2012, Geographic information — Ontology — Part 1: Framework
2. particular set of beliefs, or ideas referred to in order to describe a scenario or solve a problem
   ~ ISO 15638-20:2020, Intelligent transport systems — Framework for cooperative telematics applications for regulated commercial freight vehicles (TARV) — Part 20: Weigh-in-motion monitoring
3. structure of processes and specifications designed to support the accomplishment of a specific task
   ~ ISO/IEC 21823-1:2019, Internet of things (IoT) — Interoperability for internet of things systems — Part 1: Framework
4. documented set of guidelines to create a common understanding of the ways of working
   ~ ISO 37500:2014, Guidance on outsourcing
5. description of a system at a high organizational or conceptual level that provides neutral ground upon which a community of stakeholders can discuss issues and concerns related to a large, complex system
   ~ ISO/IEC TR 15067-3-8:2020, Information technology — Home Electronic System (HES) application model — Part 3-8: GridWise transactive energy framework

Structure

1. set of interrelated parts of any complex thing, and the relationships between them
   ~ ISO 10303-235:2019, Industrial automation systems and integration — Product data representation and exchange — Part 235: Application protocol: Engineering properties and materials information
2. combination of a set of elements, a set of functions, and sets of tuples for each relation
   ~ ISO 18629-1:2004, Industrial automation systems and integration — Process specification language — Part 1: Overview and basic principles
3. organization of relations among objects of a system describing constituency relations (consist-of/is-a-part-of)
   ~ ISO 81346-12:2018, Industrial systems, installations and equipment and industrial products — Structuring principles and reference designations — Part 12: Construction works and building services

Architecture

1. conceptual structure of a system
   Note 1 to entry: A system may consist of several interacting subsystems, each with its own architecture.
   ~ ISO/IEC TR 29108:2013, Information technology — Terminology for intelligent homes
2. conceptual structure of systems that are to communicate with each other
   ~ ISO/IEC TR 15044:2000, Information technology — Terminology for the Home Electronic System (HES)
3. structure and means by which components and devices of a system are connected to intercommunication
   ~ ISO 16484-2:2004, Building automation and control systems (BACS) — Part 2: Hardware
4. representation of the structure of the item or element that allows identification of building blocks, their boundaries and interfaces, and includes the allocation of requirements to these building blocks
   ~ ISO 26262-1:2018, Road vehicles — Functional safety — Part 1: Vocabulary

The core concept of security is about protection. To be specific, security in discussion has to consider 1) what to protect, 2) why to protect, 3) how to protect, and 4) to what extent. Given the key points above, I define security as follows:

The intended outcome is the goal of security. Assets are anything of value worthy of protection. Information is one of the most critical assets in cybersecurity. Confidentiality, integrity, and availability are the objectives of information security. Implementing protective services aims to manage risk by applying security controls to achieve security objectives.

Performance

• Measurable result
  ~ ISO 14050:2020 Environmental management — Vocabulary
• Carrying out or execution
  ~ ISO/IEC 21000-5:2004 Information technology — Multimedia framework (MPEG-21) — Part 5: Rights Expression Language
• Achievements of an activity, a process or an organization
  ~ ISO 50007:2017 Energy services — Guidelines for the assessment and improvement of the energy service to users
• In the context of an operation, the carrying out of the operation by an object (the performer).
  ~ ISO 23103:2020 Space link extension — Cross support transfer service — Specification framework

Objective

• Result to be achieved
  Note 1 to entry: An objective can be strategic, tactical, or operational.
  Note 2 to entry: Objectives can relate to different disciplines (such as finance, health and safety, and environment). They can be, for example, organization-wide or specific to a project, product or process.
  Note 3 to entry: An objective can be expressed in other ways, e.g. as an intended result, as a purpose, as an operational criterion, as an AI objective or by the use of other words with similar meaning (e.g. aim, goal, or target).
  Note 4 to entry: In the context of AI management systems, AI objectives are set by the organization, consistent with the AI policy, to achieve specific results.
  ~ ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system
• statement of preference about possible and achievable future situations that influences the choices within some behaviour
  ~ ISO 19439:2006 Enterprise integration — Framework for enterprise modelling

Goal

• Intended outcome
  Note 1 to entry: A goal is stated independently of the functionality used to achieve it.
  ~ ISO 20282-1:2006 Ease of operation of everyday products — Part 1: Design requirements for context of use and user characteristics

Outcome

• change resulting from the use of the output from a project
  ~ ISO 21502:2020 Project, programme and portfolio management — Guidance on project management
• Observable result of the successful achievement of the process purpose
  ~ ISO/IEC 24668:2022 Information technology — Artificial intelligence — Process management framework for big data analytics
• Final result or consequence of the output
  Note 1 to entry: The outputs and outcomes can affect each other through a circular process.
  Output is the end product or service of a process. The outputs and outcomes can affect each other through a circular process.
  ~ ISO 41011:2024 Facility management — Vocabulary

Result

• An output from performing project management processes and activities. Results include outcomes (e.g., integrated systems, revised process, restructured organization, tests, trained personnel, etc.) and documents (e.g., policies, plans, studies, procedures, specifications, reports, etc.)
  ~ A Guide to the Project Management Body of Knowledge (PMBOK® Guide) — Fifth Edition
• Determination after having carried out a process
  ~ ISO 22932-1:2020 Mining — Vocabulary — Part 1: Planning and surveying
• Entity produced by the performance of an operation
  ~ ISO/IEC 2382:2015 Information technology — Vocabulary

Benefit

• Created advantage, value or other positive effect
  ~ ISO 21500:2021 Project, programme and portfolio management — Context and concepts
• helpful or good effect, or something intended to help
  ~ ISO 4980:2023 Benefit-risk assessment for sports and recreational facilities, activities and equipment
• Positive outcome that is voluntarily or involuntarily created by a system or process.
  Note 1 to entry: Benefits correspond to one or more underlying desired values.
  ~ ISO/IEC/IEEE 24748-7000:2022 Systems and software engineering — Life cycle management — Part 7000: Standard model process for addressing ethical concerns during system design

• Performance is the measurable result of carrying out or executing activities to achieve an objective.
• An objective refers to the result to be achieved from performing activities.
• A goal is the intended outcome of achieving constituent objectives. The outcome is a good result of performance.

Nmap 7.94SVN ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}

TARGET SPECIFICATION:

  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iL <inputfilename>: Input from list of hosts/networks
  -iR <num hosts>: Choose random targets
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file

HOST DISCOVERY:

  -sL: List Scan - simply list targets to scan
  -sn: Ping Scan - disable port scan
  -Pn: Treat all hosts as online -- skip host discovery
  -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -PO[protocol list]: IP Protocol Ping
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]
  --dns-servers <serv1[,serv2],...>: Specify custom DNS servers
  --system-dns: Use OS's DNS resolver
  --traceroute: Trace hop path to each host

SCAN TECHNIQUES:

  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  -sU: UDP Scan
  -sN/sF/sX: TCP Null, FIN, and Xmas scans
  --scanflags <flags>: Customize TCP scan flags
  -sI <zombie host[:probeport]>: Idle scan
  -sY/sZ: SCTP INIT/COOKIE-ECHO scans
  -sO: IP protocol scan
  -b <FTP relay host>: FTP bounce scan

PORT SPECIFICATION AND SCAN ORDER:

  -p <port ranges>: Only scan specified ports
    Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
  --exclude-ports <port ranges>: Exclude the specified ports from scanning
  -F: Fast mode - Scan fewer ports than the default scan
  -r: Scan ports sequentially - don't randomize
  --top-ports <number>: Scan <number> most common ports
  --port-ratio <ratio>: Scan ports more common than <ratio>

SERVICE/VERSION DETECTION:

  -sV: Probe open ports to determine service/version info
  --version-intensity <level>: Set from 0 (light) to 9 (try all probes)
  --version-light: Limit to most likely probes (intensity 2)
  --version-all: Try every single probe (intensity 9)
  --version-trace: Show detailed version scan activity (for debugging)

SCRIPT SCAN:

  -sC: equivalent to --script=default
  --script=<Lua scripts>: <Lua scripts> is a comma separated list of
           directories, script-files or script-categories
  --script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
  --script-args-file=filename: provide NSE script args in a file
  --script-trace: Show all data sent and received
  --script-updatedb: Update the script database.
  --script-help=<Lua scripts>: Show help about scripts.
           <Lua scripts> is a comma-separated list of script-files or
           script-categories.

OS DETECTION:

  -O: Enable OS detection
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively

TIMING AND PERFORMANCE:

  Options which take <time> are in seconds, or append 'ms' (milliseconds),
  's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  -T<0-5>: Set timing template (higher is faster)
  --min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
  --min-parallelism/max-parallelism <numprobes>: Probe parallelization
  --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
      probe round trip time.
  --max-retries <tries>: Caps number of port scan probe retransmissions.
  --host-timeout <time>: Give up on target after this long
  --scan-delay/--max-scan-delay <time>: Adjust delay between probes
  --min-rate <number>: Send packets no slower than <number> per second
  --max-rate <number>: Send packets no faster than <number> per second

FIREWALL/IDS EVASION AND SPOOFING:

  -f; --mtu <val>: fragment packets (optionally w/given MTU)
  -D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
  -S <IP_Address>: Spoof source address
  -e <iface>: Use specified interface
  -g/--source-port <portnum>: Use given port number
  --proxies <url1,[url2],...>: Relay connections through HTTP/SOCKS4 proxies
  --data <hex string>: Append a custom payload to sent packets
  --data-string <string>: Append a custom ASCII string to sent packets
  --data-length <num>: Append random data to sent packets
  --ip-options <options>: Send packets with specified ip options
  --ttl <val>: Set IP time-to-live field
  --spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
  --badsum: Send packets with a bogus TCP/UDP/SCTP checksum

OUTPUT:

  -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
     and Grepable format, respectively, to the given filename.
  -oA <basename>: Output in the three major formats at once
  -v: Increase verbosity level (use -vv or more for greater effect)
  -d: Increase debugging level (use -dd or more for greater effect)
  --reason: Display the reason a port is in a particular state
  --open: Only show open (or possibly open) ports
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --append-output: Append to rather than clobber specified output files
  --resume <filename>: Resume an aborted scan
  --noninteractive: Disable runtime interactions via keyboard
  --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
  --webxml: Reference stylesheet from Nmap.Org for more portable XML
  --no-stylesheet: Prevent associating of XSL stylesheet w/XML output

MISC:

  -6: Enable IPv6 scanning
  -A: Enable OS detection, version detection, script scanning, and traceroute
  --datadir <dirname>: Specify custom Nmap data file location
  --send-eth/--send-ip: Send using raw ethernet frames or IP packets
  --privileged: Assume that the user is fully privileged
  --unprivileged: Assume the user lacks raw socket privileges
  -V: Print version number
  -h: Print this help summary page.

EXAMPLES:

  nmap -v -A scanme.nmap.org
  nmap -v -sn 192.168.0.0/16 10.0.0.0/8
  nmap -v -iR 10000 -Pn -p 80

SEE THE MAN PAGE (https://nmap.org/book/man.html) FOR MORE OPTIONS AND EXAMPLES

Finding Stuff

• locate: searching the entire file system.
• whereis: searching the binaries and man page
• which: searching binaries in the PATH variable
• find: searching with specific pattherns