Initial commit - 611 cybersecurity skills across all subdomains

2026-07-29 23:46:53 +03:00 · 2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
@@ -0,0 +1,29 @@
+# Standards and References - Rapid7 InsightVM
+
+## Official Documentation
+- InsightVM Product Page: https://www.rapid7.com/products/insightvm/
+- InsightVM Quick Start Guide: https://docs.rapid7.com/insightvm/insightvm-quick-start-guide/
+- InsightVM System Requirements: https://docs.rapid7.com/insightvm/system-requirements/
+- InsightVM API v3 Documentation: https://help.rapid7.com/insightvm/en-us/api/index.html
+- Insight Agent Documentation: https://docs.rapid7.com/insightvm/using-the-insight-agent-with-insightvm/
+
+## Scan Configuration References
+- Scan Templates: https://docs.rapid7.com/insightvm/selecting-vulnerability-checks/
+- Credential Configuration: https://docs.rapid7.com/insightvm/configuring-scan-credentials/
+- Scan Scheduling: https://docs.rapid7.com/insightvm/configuring-scan-schedules/
+
+## Industry Standards
+- **NIST SP 800-115**: Technical Guide to Information Security Testing and Assessment
+- **NIST SP 800-40 Rev 4**: Guide to Enterprise Patch Management Planning
+- **PCI DSS v4.0 Req 11.3**: External and internal vulnerability scanning
+- **CIS Controls v8.1 Control 7**: Continuous Vulnerability Management
+- **ISO 27001:2022 A.8.8**: Management of technical vulnerabilities
+
+## Compliance Scan Templates
+| Standard | InsightVM Template | Frequency |
+|----------|-------------------|-----------|
+| PCI DSS | PCI ASV External Audit | Quarterly |
+| HIPAA | HIPAA Compliance | Quarterly |
+| CIS Benchmarks | CIS Policy Compliance | Monthly |
+| DISA STIG | DISA STIG Compliance | Monthly |
+| NIST 800-53 | Full Audit Enhanced | Quarterly |
@@ -0,0 +1,80 @@
+# Workflows - Rapid7 InsightVM Deployment
+
+## Workflow 1: InsightVM Deployment Pipeline
+
+```
+┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐
+│ Install Security │────>│ Deploy Scan      │────>│ Pair Engines     │
+│ Console          │     │ Engines          │     │ with Console     │
+└──────────────────┘     └──────────────────┘     └──────────────────┘
+                                                          │
+        ┌────────────────────────────────────────────────┘
+        v
+┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐
+│ Configure Scan   │────>│ Set Up Credential│────>│ Create Sites &   │
+│ Templates        │     │ Store            │     │ Asset Groups     │
+└──────────────────┘     └──────────────────┘     └──────────────────┘
+        │
+        v
+┌──────────────────┐     ┌──────────────────┐     ┌──────────────────┐
+│ Schedule Scans   │────>│ Deploy Insight   │────>│ Configure        │
+│                  │     │ Agents           │     │ Reports & Alerts │
+└──────────────────┘     └──────────────────┘     └──────────────────┘
+```
+
+## Workflow 2: Scan Execution Cycle
+
+```
+For each scheduled scan:
+    1. Console dispatches scan job to assigned Scan Engine
+    2. Engine performs host discovery (ARP, ICMP, TCP SYN)
+    3. Engine fingerprints OS and services on discovered hosts
+    4. Engine selects vulnerability checks based on fingerprint
+    5. If credentials configured: authenticate and perform local checks
+    6. Engine reports findings back to Console database
+    7. Console correlates with previous scan data (new/fixed/unchanged)
+    8. Console updates risk scores and remediation projects
+    9. Notifications sent for new critical/high findings
+   10. Dashboard and reports refreshed automatically
+```
+
+## Workflow 3: Hybrid Scanning Strategy
+
+```
+┌─────────────────────────────────────────────────────┐
+│                 Enterprise Network                    │
+├─────────────────────────────────────────────────────┤
+│                                                       │
+│  ┌──────────────┐  Engine Scan   ┌────────────────┐ │
+│  │ Data Center  │ <───────────── │ DC Scan Engine │ │
+│  │ Servers      │                └────────────────┘ │
+│  └──────────────┘                                    │
+│                                                       │
+│  ┌──────────────┐  Engine Scan   ┌────────────────┐ │
+│  │ DMZ Servers  │ <───────────── │ DMZ Scan Engine│ │
+│  └──────────────┘                └────────────────┘ │
+│                                                       │
+│  ┌──────────────┐  Agent-Based   ┌────────────────┐ │
+│  │ Laptops /    │ <───────────── │ Insight Agent  │ │
+│  │ Remote Users │                │ (on endpoint)  │ │
+│  └──────────────┘                └────────────────┘ │
+│                                                       │
+│  ┌──────────────┐  Agent-Based   ┌────────────────┐ │
+│  │ Cloud VMs    │ <───────────── │ Insight Agent  │ │
+│  │ (AWS/Azure)  │                │ (on instance)  │ │
+│  └──────────────┘                └────────────────┘ │
+│                                                       │
+│           All results ──> Security Console            │
+│                        ──> Insight Platform (Cloud)   │
+└─────────────────────────────────────────────────────┘
+```
+
+## Workflow 4: Remediation Tracking
+
+| Phase | Action | Owner | Timeline |
+|-------|--------|-------|----------|
+| Discovery | Scan identifies vulnerability | InsightVM | Automated |
+| Triage | Severity confirmed, assigned to team | Security Ops | 24 hours |
+| Remediation | Patch/config change applied | IT Operations | Per SLA |
+| Validation | Re-scan confirms fix | InsightVM | Next scan cycle |
+| Closure | Remediation project updated | Security Ops | Automated |