Chapter 1 — Mathematical reasoning
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Sets for scope"]
N2["1.2 Logic of authorization"]
N3["1.3 Counting coverage"]
N4["1.4 Invalid leaps"]
N5["1.5 Practice"]
N6["1.6 Why maths here"]
N7["1.7 Applied note"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Sets for scope"]
N2["1.2 Logic of authorization"]
N3["1.3 Counting coverage"]
N4["1.4 Invalid leaps"]
N5["1.5 Practice"]
N6["1.6 Why maths here"]
N7["1.7 Applied note"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Sets for scope]
|
v
[1.2 Logic of authorization]
|
v
[1.3 Counting coverage]
|
v
[1.4 Invalid leaps]
|
v
[1.5 Practice]
|
v
[1.6 Why maths here]
|
v
[1.7 Applied note]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) use sets and logic to describe scope; (2) apply counting to coverage; (3) spot invalid inferences in a security argument.
1.1 Sets for scope
A written authorization is a set of systems. Membership is binary for each target: in scope or not. Unions of ranges and exclusions (subtracted sets) are how Riverstone Transit Bank (TRB) writes its ROE. If SWIFT sits in the same /26 as a web host, exclusion is set difference, not a vague note. Writing the scope this way also makes it testable: Sam can feed any proposed address to a membership function and get a yes or no. A note saying 'avoid SWIFT' cannot be tested; the set {/26} minus {SWIFT host} can.
1.2 Logic of authorization
Permission is necessary for testing; it is not sufficient for every method. "In scope" and "method allowed" must both be true. Confusing the two leads to unauthorized techniques on authorized hosts. At TRB, a host can sit inside the signed /26 while the ROE still forbids password spraying or denial-of-service checks against it. Sam therefore keeps two lists in TrackScope, one of hosts and one of permitted methods, and a test runs only when the pair appears in both. A request to spray credentials against an in-scope web host fails on the second list, and the rejection message names the clause that forbids it.
1.3 Counting coverage
If 40 hosts are in scope and 28 were touched by method cards, coverage is 28/40. Percentages without denominators mislead examiners and boards. Written as 28/40, the figure tells a reader that twelve in-scope hosts received no method card at all. Written as 70%, it invites the question 'of what?', and a board member may read it as 70% safe. Sam's reports therefore always show the numerator and denominator together, and list the twelve untouched hosts by owner so they can be scheduled for the next authorized window instead of silently dropped from the story.
1.4 Invalid leaps
"The scanner found nothing, so we are safe" confuses absence of evidence with evidence of absence. Wilson intervals in Chapter 12 make small-sample humility numerical. A clean scan over 28 of 40 hosts says nothing about the twelve that were never touched, and little about techniques the scanner cannot see. Sam rewrites such claims as bounded statements: 'no findings of the checked types on the 28 hosts tested in this window'. The bounded version is less comforting, but it is the only one the evidence supports, and it tells the reader exactly where the next test should look.
1.5 Practice
Sam Ito, engineering intern on TRB's authorized assessment platform team, translates every ROE sentence into sets before any tool runs. In practice that means each ROE sentence becomes a line in his notebook: the set it names, the exclusions it subtracts and the methods it allows. The /26 minus the SWIFT host at .20 is one such line. Only when every sentence has been translated, and the translation checked against the signed document by a second person, does he load anything into TrackScope. Ambiguous sentences go back to the ROE owner as questions, not guesses.
1.6 Why maths here
Later chapters on probability, architecture and evaluation reuse the same careful language. Sloppy scope language produces sloppy tests. The coverage fraction from 1.3 returns as a proportion with an interval in Chapter 12, and the set expression from 1.1 becomes the TrackScope membership function in the labs. Learning the vocabulary once, carefully, means each later tool has a precise specification behind it rather than a habit. Sam's notebook from this chapter is the first artefact his mentor reviews. A vague definition costs little to fix in the notebook, but the same vagueness in TrackScope could put a SWIFT host in scope.
1.7 Applied note
Sam practices translating ROE paragraphs into membership tests on paper before opening TrackScope. When a sentence says "web VLAN except payment gateways", he writes the set expression and lists every known gateway address from the asset register. Only then does he load the scope file. Contractors who skip the paper step regularly propose hosts that sit beside SWIFT "because the ping worked". The paper step is slower and prevents newspaper incidents. The asset register list doubles as evidence afterwards. Auditors can match each scope-file load to the signed register list, so any host added later stands out.
1.8 Worked set arithmetic
Given VLAN V and exclusions E, Sam computes V\E and then intersects with the day's proposed list P. Only P∩(V\E) may be loaded. He unit-tests the calculator with SWIFT inside V and confirms it never appears in output. A second test puts an address outside V into P and confirms it is rejected too. Together the two tests cover the two ways scope fails: excluded hosts leaking back in, and out-of-range hosts arriving in a friendly spreadsheet. The calculator's output is saved with the date so the day's loaded list can be reproduced later.
1.9 Filtering a branch spreadsheet
On Monday Sam receives a spreadsheet of "interesting hosts" from a branch IT lead. He does not import it. He rebuilds scope from the signed ROE: the /26, minus SWIFT at .20, intersected with hosts that have owners in the asset register. Three spreadsheet rows vanish as out of scope; one vanishes as excluded. He sends the filtered list back with the set expression in the email. The branch lead is annoyed for ten minutes and grateful when a fourth row is recognised as a mis-typed payment console. Paper set arithmetic scales better than trust.
Worked example (synthetic TRB)
Sam writes SCOPE = 198.51.100.0/26 minus {198.51.100.20}. A proposed host 198.51.100.70 fails membership; he rejects it before the kickoff call.
Synthetic case — Riverstone Transit Bank (TRB). The bank, Sam Ito, TrackScope/FindingsDesk/PulseMap and all figures are invented for teaching.
Errors and limits
This book grants no authority to test real banks or payment systems. Labs use documentation-range addresses and synthetic data only; exploit code is never provided.
Exercises
- EX001 — Set difference. Express TRB's web VLAN scope with SWIFT excluded as a set operation. Rubric: 3 = VLAN set minus {SWIFT}; 2 = partial; 1 = union; 0 = none.
- EX002 — Necessary vs sufficient. Why is "host in scope" not enough to run password spraying? Rubric: 3 = method must also be allowed; spraying may be forbidden; 2 = partial; 1 = it is enough; 0 = none.
- EX003 — Coverage fraction. 28 of 40 hosts touched — write the coverage and one misuse of "70%". Rubric: 3 = 28/40=0.7; misuse e.g. implying safety; 2 = fraction only; 1 = wrong; 0 = none.
Synthesis
Scope is set membership; methods need their own truth; coverage needs denominators.