# Bridging the Gap: A Survey and Classification of Research-Informed Ethical Hacking Tools
## 4 Cybersecurity Frameworks Used for Tools Classification
### NCSC CyBOK  
The _Cyber Security Body of Knowledge_ (CyBOK) [11] is a project developed by the United Kingdom's National Cyber Security Centre (NCSC), a child agency of the Government Communications Headquarters (GCHQ), in collaboration with academia, industry, and government partners. CyBOK aims to provide a comprehensive and authoritative reference  
Figure 4: Mitre ATT&CK framework: phases and tactics (inspired by [1]). for the knowledge, skills, and competencies on which various educational programmes and job descriptions may be aligned. The CyBOK is divided into 21 top-level _Knowledge Areas_ (KAs) and five broad categories, along with the introductory concepts, as shown in Figure 5. These categories, while orthogonal, are not entirely separate from each other, reflecting the interdisciplinary nature of cyber security. In summary, the Knowledge Areas in CyBOK version 1.1 [43] are organised as follows:  
1. Introductory Concepts: _Introduction to CyBOK_. 2. Human, Organisational and Regulatory Aspects: (a) _Risk Management and Governance_, (b) _Law and Regulation_, (c) _Human Factors_ and (d) _Privacy and Online Rights_. 3. Attacks and Defences: (a) _Malware and Attack Technologies_, (b) _Adversarial Behaviours_, (c) _Security Operations and Incident Management_ and (d) _Forensics_. 4. Systems Security: (a) _Cryptography_, (b) _Operating Systems and Virtualisation Security_, (c) _Distributed Systems Security_, (d) _Formal Methods for Security_ and (e) _Authentication, Authorisation, and Accountability_. 5. Software and Platform Security: (a) _Software Security_, (b) _Web and Mobile Security_ and (c) _Secure Software Lifecycle_. 6. Infrastructure Security: (a) _Applied Cryptography_, (b) _Network Security_, (c) _Hardware Security_, (d) _Cyber Physical Systems_ and (e) _Physical Layer and Telecommunications Security_. 7. Introductory Concepts: _Introduction to CyBOK_. 8. Human, Organisational and Regulatory Aspects 1. _Risk Management and Governance_: Asset assessment, identification and management. 2. _Law and Regulation_: Regulatory Compliance with national and international legislation. 3. _Human Factors_: Physical and Digital Social Engineering techniques targeting the human state vulnerability characteristics and exploiting these in a cybersecurity context. 4. _Privacy and Online Rights_: Purpose limitation, data transparency, and minimisation. Figure 5: Cyber Security Body Of Knowledge (CyBOK) Knowledge Areas. Attacks and Defences 1. _Malware and Attack Technologies_: Attack techniques, analysis, and detection of malware, including response using evasive countermeasures and disruption of malware operations. 2. _Adversarial Behaviours_: Characterising cybercriminals based on their motivation (e.g., financial, political, etc. ), types of cyber offences (cyber-enabled and cyber-dependent crimes), and the activities performed in a cyber attacks. 3. _Security Operations and Incident Management_: The management of secure systems, including the setup, operation, maintenance, incident response, and using threat intelligence for detection and security measures. 4. _Forensics_: Data acquisition, file system and block device analysis, as well as data recovery and file content carving, including SaaS. 4. Systems Security 1. _Cryptography_: Techniques for securing data and communications: encryption algorithms, cryptographic protocols, key management, and others. 2. _Operating Systems and Virtualisation Security_: Authentication and identification, Access Control Lists (ACL), memory protection and address spaces, and physical access and secure deletion. 3. _Distributed Systems Security_: Access and identity management, data transportation, resource management and coordination of services, and data security. 4. _Formal Methods for Security_: Analysis and verification of security properties of systems using formal specification languages and mathematical models. 5.