Chapter 29 — Operations
Lesson map
Lesson 29 published. Map, example, EX085.
flowchart TD
N0["Learning outcomes"]
N1["29.1 Kickoff"]
N2["29.2 Logging"]
N3["29.3 SOC"]
N4["29.4 Handover"]
N5["29.5 End"]
N6["29.6 On-call hygiene"]
N7["29.7 Cable-pull hard stop"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX085"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["29.1 Kickoff"]
N2["29.2 Logging"]
N3["29.3 SOC"]
N4["29.4 Handover"]
N5["29.5 End"]
N6["29.6 On-call hygiene"]
N7["29.7 Cable-pull hard stop"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX085"]
[Learning outcomes]
|
v
[29.1 Kickoff]
|
v
[29.2 Logging]
|
v
[29.3 SOC]
|
v
[29.4 Handover]
|
v
[29.5 End]
|
v
[29.6 On-call hygiene]
|
v
[29.7 Cable-pull hard stop]
|
v
[Worked example] --> [Exercise EX085]
Learning outcomes
You will (1) run day-of workflow; (2) coordinate SOC; (3) hand over between shifts.
29.1 Kickoff
Confirm ROE, contacts, window.
Kickoff is a short, boring meeting that confirms the rules of engagement, the named contacts and the exact time window before anyone touches a keyboard. Sam treats boredom as a feature: surprises belong in findings, not in authorisation. Each participant says aloud the stop conditions and the SOC channel they will use. If a contact is on leave, the backup is named before the window opens. A kickoff that skips confirmation is how overtime arguments and out-of-scope hops begin.
29.2 Logging
Contemporaneous activity log.
Operators write what they did while they did it, not from memory the next morning. The activity log sits beside the method card and takes timestamps from the same clock the SOC uses. Sam has watched reconstructed logs invent confidence that the raw session never earned. Contemporaneous notes also protect the operator when an alert looks worse than the action taken. The log is part of the evidence pack, so slang and jokes stay out of it.
29.3 SOC
Start/stop messages; expect alert noise coordination.
The SOC receives a start message when the window opens and a stop message when it closes, even if the session was quiet. Alert noise is expected; coordination is how trust survives a noisy evening. Sam pastes the engagement id into both messages so analysts can filter without guessing. Mid-window surprises still get a ping, not a silent hope that nobody notices. Teams that skip stop messages leave the SOC watching ghosts after the work is done.
29.4 Handover
Log + vault beats verbal notes.
Shift handovers use the written activity log and the vault paths, not a hallway summary. Verbal notes evaporate and mutate. Sam's five-line paste template forces the outgoing operator to name unfinished cards, open approvals and the next safe action. The incoming operator should be productive within a few minutes. Handovers that need a novel usually hid a mess that should have been a stop. The incoming operator at TRB opens the vault path from the handover before touching any card, so a wrong or empty path surfaces before work resumes rather than at the next retest.
29.5 End
Hard stop at window end.
When the window ends, work ends. Unfinished cards move to the next authorised window; they do not earn five more minutes. Sam practices a cable-pull drill on the jump host so muscle memory beats negotiation. Arguments about needing overtime belong in the next ROE discussion, not in the last minutes of this one. Hard stops keep the calendar honest for the SOC and for the people who sleep after the shift. The SOC should never have to guess whether the noisy session is still authorised.
29.6 On-call hygiene
Sleep and spare credentials matter on multi-day tests.
Multi-day engagements fail in ordinary ways: exhausted operators, expired tokens and a laptop that will not unlock. Sam packs spare credentials in the vault, not on sticky notes, and protects sleep as an operational control. A tired operator who keeps going is a risk amplifier, not a hero. On-call hygiene also means knowing who covers if someone falls ill mid-window. The programme grades sustainability alongside technical skill. Burned-out operators produce findings that later need embarrassing corrections.
29.7 Cable-pull hard stop
Hard-stop drills include pulling the network cable on the jump host at T-minus zero. Sam's muscle memory is to stop typing before arguing for five more minutes. Arguments happen in the next ROE, not in overtime.
The drill feels theatrical until the first time someone reaches for "just one more request" and the cable is already out. Sam wants the hands to stop before the debate starts. Overtime negotiations are recorded as ROE change requests with signatures, which kills casual extensions. Operators who hate the drill usually admit later that it saved them from a messy morning report. Theatre that enforces a real boundary is still useful theatre.
29.8 Channel etiquette
Engagement chat forbids joke screenshots of customer data. Sam moderates with a pinned rule and one warning.
Humor leaks into chat when people are tired, and customer data does not belong in jokes. The pinned rule is blunt and the first warning is the last warning. Sam removes offending posts and files a note if needed. The rule protects the bank, the programme and the operator who would otherwise become a cautionary tale. Channels that tolerate "harmless" screenshots eventually produce a screenshot that is not harmless.
29.9 Hours counter
A bot announces hours worked in-window. Crossing the max posts a stop reminder.
The hours bot is a dull accountant that does not care about momentum. At the configured maximum it posts a stop reminder into the engagement channel where everyone can see it. Sam treats the reminder as authoritative, not advisory. Hidden overtime becomes impossible when the clock speaks publicly. People who disable the bot lose the privilege of running unsupervised windows. Public clocks beat private promises when fatigue starts editing judgment.
29.10 Unfinished card at 16:55
At 16:55 Sam's unfinished card is written as "next window". At 17:00 the cable-pull drill begins. He has already hit save. The drill is boring when preparation is good.
The interesting part of the scene is the five minutes before the drill, when Sam chooses to write the unfinished card instead of racing the clock. Boring drills are the goal; drama means someone waited too long. Juniors watching learn that save-and-stop is a skill. The next window inherits a clear card rather than a mystery. Preparation turns a hard stop from a cliff into a curb.
29.11 Wind-down posts
Hours counter at 9.5 hours posts "wind down". At 10 it posts "hard stop approaching". Sam winds down. Machismo is out of policy.
The early wind-down post exists so people can finish notes and close sessions without a panic stop. Sam uses that half hour to park work cleanly. Operators who ignore wind-down and sprint into the hard stop create messy handovers. Machismo about lasting longest is coached out of the culture. The programme would rather lose a half hour of testing than gain an hour of cleanup and distrust.
29.12 Wind-down template link
Wind-down posts include a link to the unfinished-card template.
A reminder without a tool still leaves people improvising under time pressure. The unfinished-card template is one click from the bot message, so the path of least resistance is the correct path. Sam reviews whether operators actually used the template when handovers look thin. Links in operational alerts are part of designing for tired humans. If the link breaks, fixing it is an ops ticket, not a shrug. Tired people follow the nearest link; put the right one nearest.
29.13 ROE id on unfinished cards
Unfinished-card template includes ROE id so next window inherits authorization context.
An unfinished card without its ROE identifier is a puzzle for the next operator and a risk if the wrong window picks it up. The template field is required and validated. Sam has rejected cards that said "continue yesterday's thing" with no id. Authorization context must travel with the work. Inheritance without identity is how scope drift returns through the side door. Clear lineage from ROE to card is how multi-day tests stay defensible.
29.14 Five-line handover paste
Shift handovers use a five-line paste template. Sam rejects freeform novels. The next operator should be productive in three minutes, not thirty.
Long prose handovers hide uncertainty inside paragraphs. Five lines force choices: what is open, what is blocked, what is next, where the vault is, who to call. Sam returns novels with a polite request to use the template. New contractors sometimes feel the template is cold; they warm to it after the first clean takeover. Brevity here is respect for the incoming shift.
29.15 Thank early stops
Hard-stop culture includes thanking people who stop early with unfinished work. Sam's retrospective shout-outs name the unfinished cards that respected the clock. Overtime heroes are coached, not praised. The difference shows up in fewer emergency change tickets after test weeks and in SOC analysts who still trust the engagement calendar.
Praise teaches the room what to repeat. Thanking clean stops makes unfinished work socially safe. Praising overtime heroes teaches people to hide the clock. Sam's retrospectives make the distinction audible every time. Trust from the SOC is a lagging indicator that the culture is working, and it is worth protecting with awkward thank-yous.
29.16 Newsletter shout-outs
Shout-outs for early stops appear in the monthly ops newsletter.
Public recognition outside the team channel shows leadership that restraint is valued. Sam sends one or two names with the unfinished-card titles, never with customer detail. People who only hear about dramatic late saves start to believe drama is the job. The newsletter item is short on purpose. Culture that never leaves the jump room dies when the jump room changes. Quiet professionalism deserves ink as much as loud saves do.
Worked example (synthetic TRB)
Sam's stop at 17:00 leaves an unfinished card scheduled for the next authorized window only.
Synthetic case — Riverstone Transit Bank (TRB). The bank, Sam Ito, TrackScope/FindingsDesk/PulseMap and all figures are invented for teaching.
Errors and limits
This book grants no authority to test real banks or payment systems. Labs use documentation-range addresses and synthetic data only; exploit code is never provided.
Exercises
- EX085 — Start message. Name four facts in a start message. Rubric: 3 = id, scope, window, contact; 2 = three; 1 = one; 0 = none.
- EX086 — Hard stop. What if work remains at window end? Rubric: 3 = stop; reschedule authorized window; 2 = stop; 1 = overrun; 0 = none.
- EX087 — Handover medium. What two artifacts make a safe shift handover? Rubric: 3 = activity log and vaulted evidence; 2 = one; 1 = verbal only; 0 = none.
Synthesis
Operations are kickoff, logged work, SOC visibility and hard stops.
Continue studying — chapter 29 of 40
← Chapter 28 (draft) · Course chapter index · Chapter 30 (draft) →