Open-Cybersecurity-Operating-Model - An open cybersecurity operating model connecting b

项目说明

Open Cybersecurity Operating Model

An open-source cybersecurity operating model connecting business risk, information security, security controls, offensi, defensi, purple teaming, architecture, De, incident response, and executi.

🎯 Purpose

This repository is a comprehensi vault and practical playbook for cybersecurity professionals and organizations seeking to:

Align security with business risk and go

Understand controls across all security domains

security through technical assessment and offensi

Detect threats through operational monitoring

Remediate systematically with strategic impro

Core Philosophy:
> Understand the risk. Understand the control. Understand how it can fail. it technically. Detect it operationally. Fix it strategically.

📚 What's Inside

Knowledge Domains (Numbered 00–12)

| Section | Focus | Purpose |
|---------|-------|---------|
| 00 - START HERE | Na & Dashboard | Entry point to the vault |
| 01 - BUSINESS & GO | Risk go, executi | Connect security to business objectives |
| 02 - IT RISK MANAGEMENT | Risk identification, assessment, reporting | Quantify and track security risk |
| 03 - INFORMATION SECURITY | Policies, classification, data go | Define security requirements |
| 04 - SECURITY CONTROLS | Control frameworks (NIST, ISO, CIS) | Map and controls |
| 05 - OFFENSI | Penetration testing, attack techniques | Understand threat actor methods |
| 06 - DEFENSI | Detection, monitoring, SOC operations | Defend and respond |
| 07 - PURPLE TEAM | Ad simulation, red/blue integration | Continuous security |
| 08 - SECURITY ARCHITECTURE | System design, zero-trust, segmentation | Build secure infrastructure |
| 09 - APPLICATION & DE | Secure SDLC, management | Secure the de lifecycle |
| 10 - INCIDENT & RESILIENCE | Incident response, recovery playbooks | Prepare for and recover from incidents |
| 11 - SECURITY PROJECTS | Lab exercises & reference implementations | Hands-on learning |
| 12 - MANAGEMENT & BOARD | Metrics, reporting, communication | Executi |
| 99 - TEMPLATES | Reusable templates for documentation | Accelerate security processes |

Practical Labs & Runbooks

GOAD (Game of Acti) — Intentionally Acti lab for offensi and detection

Mythic C2 — Command & Control infrastructure for red team operations

Operation Cypher-Knife — Complete offensi runbook co the full attack chain from reconnaissance through persistence and cleanup

🚀 Getting Started

Prerequisites

Obsidian (free) — Download from obsidian.md to open this vault with full linking and graph features

Git — To clone this repository

For labs: Docker, , or hypervisor (, Hyper-)

Quick Start

1. Clone the repository:

2. Open in Obsidian:
- Launch Obsidian
- Click "Open folder as vault"
- Select the cloned directory
- Start with Welcome.md → Dashboard

3. Explore the vault:
- Use the sidebar to na numbered sections
- Use the graph view to see topic connections
- Search for security concepts across all domains

Running the Labs

#### GOAD (Game of Acti)

Entry point: 🏰 GOAD — GAME OF ACTI — FULL ASSAULT PLAYBOOK.md

Time to deploy: 30–60 minutes

Requirements:

- 4+ cores, 16GB+ RAM
- ( recommended)
- + Ansible

#### Mythic C2

Entry point: 🎯 MYTHIC C2 — COMPLETE OPERATION CYPHER-KNIFE RUNBOOK.md

Time to deploy: 20–30 minutes

Requirements:

- Docker + Docker Compose
- Linux or WSL2

#### Operation Cypher-Knife

Entry point: OPERATION CYPHER-KNIFE — COMPLETE RUNBOOK.md

Phases: 0–14 (prep through cleanup)

Full chain: Foothold → pri escalation → lateral mo → persistence → exfiltration

Requirements: Access to GOAD lab or similar target

📖 How to Use This Knowledge Base

For Security Architects & Leaders

1. Start with 01 - BUSINESS & GO
2. Review 02 - IT RISK MANAGEMENT to quantify risk
3. Use 04 - SECURITY CONTROLS to map frameworks
4. Reference 12 - MANAGEMENT & BOARD for reporting

For Offensi Professionals

1. Review 05 - OFFENSI for techniques
2. Study Operation Cypher-Knife for complete attack chains
3. Use GOAD and Mythic C2 labs to practice
4. Cross-reference with 04 - SECURITY CONTROLS to understand what you're testing

For Defensi & SOC Teams

1. Study 06 - DEFENSI for detection strategies
2. Use 04 - SECURITY CONTROLS to understand what to monitor
3. Reference 10 - INCIDENT & RESILIENCE for response playbooks
4. Review 07 - PURPLE TEAM for exercises

For De & Application Security

1. Start with 09 - APPLICATION & DE
2. Reference 04 - SECURITY CONTROLS for relevant controls
3. Use templates in 99 - TEMPLATES for documentation

For Learning & Training

1. Beginners: Follow 00 → 01 → 02 → 03 → 04 sequentially
2. Hands-on practice: Deploy GOAD lab, run through techniques in 05
3. Ad: Study Operation Cypher-Knife full runbook and customize for your en

🏗️ Repository Structure

🔗 Interconnected Knowledge Model

This vault uses Obsidian linking to connect concepts across domains:

Business risk informs security controls

Security controls are through offensi testing

Offensi inform defensi rules

Incident response playbooks feed back into architecture impro

Metrics in management reporting track progress across all domains

Use Obsidian's graph view (Ctrl/Cmd + Shift + G) to these connections.

📋 Key Files & Entry Points

| File | Purpose |
|------|---------|
| Welcome.md | Start here — vault o & philosophy |
| OPERATION CYPHER-KNIFE — COMPLETE RUNBOOK.md | Full offensi kill chain (80K+ lines) |
| 🏰 GOAD — GAME OF ACTI — FULL ASSAULT PLAYBOOK.md | GOAD lab setup & exploitation guide |
| 🎯 MYTHIC C2 — COMPLETE OPERATION CYPHER-KNIFE RUNBOOK.md | Mythic C2 deployment & operations |
| 192.168.56.0 24 is the standard FULL GOAD network.md | GOAD network reference |

🛠️ Contributing

This is an open-source project. Contributions are welcome:

1. Fork the repository
2. Create a branch for your changes
3. Submit a pull request with:
- Clear description of changes
- References to relevant sections
- Links to updated/new topics

Contribution Ideas

Additional control frameworks or mappings

New offensi techniques

Lab enhancements or

Translation to other languages

diagrams or flow charts

Additional runbooks for specific scenarios

📄 License

MIT License — See LICENSE file for details.

You are free to use, modify, and distribute this material for personal, commercial, and educational purposes.

🤝 Support & Community

Issues: Report gaps, errors, or missing content Issues

Discussions: Share experiences, ask questions, and discuss security topics

Wiki: Extended documentation and community contributions

🎓 Learning Paths

Path 1: Security Fundamentals (Beginner)

Time: 2–4 weeks

Path 2: Offensi (Intermediate)

Time: 3–6 weeks

Path 3: Defensi & Detection (Intermediate)

Time: 3–6 weeks

Path 4: Architecture & Strategy (Ad)

Time: 4–8 weeks

Path 5: Purple Team & Continuous (Ad)

Time: 6+ weeks

❓ FAQ

Q: Is this for penetration testers only?
A: No. This is designed for the entire security organization—from executives to SOC analysts to system administrators. Each section is relevant to different roles.

Q: Can I use the labs in production?
A: No. GOAD, Mythic, and Cypher-Knife are intentionally and designed for isolated lab en only. Ne in production.

Q: How often is this updated?
A: This is an acti. Check the repository for the latest updates. Contributions and feedback dri.

Q: Can I use this for training my team?
A: Yes. The MIT license allows for educational use. Sections 11 (SECURITY PROJECTS) and 99 (TEMPLATES) are specifically designed for team training.

Q: Do I need to read e?
A: No. Use the learning paths above to select sections relevant to your role and goals.

🔒 Security & Responsible Disclosure

This repository contains offensi techniques and playbooks intended for authorized security testing and training only. Users are responsible for:

Obtaining proper authorization before any security testing

Following applicable laws and regulations in your jurisdiction

Using this material only on systems you own or ha permission to test

Reporting security responsibly to affected organizations

📞 Get in Touch

GitHub: c3m2r4/Open-Cybersecurity-Operating-Model

Issues & Feedback: Use GitHub Issues for bugs, suggestions, or questions

---

Start exploring: Open Welcome.md in Obsidian or visit the 00 - START HERE section to begin.

项目信息

开发语言：Shell

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An open cybersecurity operating model connecting business risk, information security, security controls, offensive security, defensive security, purple teaming, architecture, DevSecOps, incident response, and executive decision-making.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。