Chapter 8 — Defense and publication plan
Lesson map
Lesson 08 published. Map, example, EX045.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Defence posture"]
N2["8.2 Dual-use answers"]
N3["8.3 Publication plan"]
N4["8.4 Next research"]
N5["8.5 Leaving the lab safer"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX045"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Defence posture"]
N2["8.2 Dual-use answers"]
N3["8.3 Publication plan"]
N4["8.4 Next research"]
N5["8.5 Leaving the lab safer"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX045"]
[Learning outcomes]
|
v
[8.1 Defence posture]
|
v
[8.2 Dual-use answers]
|
v
[8.3 Publication plan]
|
v
[8.4 Next research]
|
v
[8.5 Leaving the lab safer]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX045]
Learning outcomes
You will (1) defend methods, ethics and claims under examination; (2) answer dual-use and generalisation challenges; (3) plan publications that help defenders without enabling attackers; (4) map next research; and (5) leave the lab safer than you found it.
8.1 Defence posture
Open with the question, the measure and the primary result with intervals. Expect questions on: authorization; why synthetic labs; independence; what would falsify the claim; how operators might game the checker. Bring the pre-registration and a live demo of the checker on synthetic proposals.
Elena's opening fits in about ninety seconds: machine-checkable predicates versus prose ROE; out-of-scope probes per hour; 0.17 against 0.03 with intervals; synthetic NHUSTL ranges, student operators, twenty engagements per arm. The live demo shows a DENY on 8.8.8.8 before any packet leaves.
8.2 Dual-use answers
"We publish predicates and rates, not exploit chains. All targets were synthetic. Any real issue found on institutional systems went through coordinated disclosure." If pressed for a demo of an attack, refuse and offer a demo of the scope denial instead.
Elena's four-part answer is: refuse the exploit; demo the scope denial; restate the ethics and dual-use rules; note coordinated disclosure for any real issue. A demand for attack detail at a defence is usually a test of judgement. Offer the scope demo immediately, so the refusal is not the end of the answer.
8.3 Publication plan
Target: a measurement/ethics venue for the main result; a short practitioner brief for authorised teams; no "how to bypass" companion. Cite frameworks accurately (NIST SP 800-115, PTES, ATT&CK, WSTG, TIBER-EU, CBEST) with versions and dates.
Elena's plan lists one journal submission on measurement and ethics, with no exploit details, and one open archive release with hashes. Framework citations carry versions and access dates, because ATT&CK and WSTG change. There is no companion paper on how to bypass the checker.
8.4 Next research
External replication on another university lab; enterprise pilot under separate authorization; human-factors study of false stops; comparison with threat-led scenario controls from TIBER-style exercises.
"""ATT&CK-style coverage matrix over synthetic authorized techniques (names only)."""
# Synthetic engagement log: technique_id -> observed (True/False)
PLAN = ["T1046", "T1595", "T1082", "T1083", "T1059", "T1078", "T1021"]
OBSERVED = {"T1046", "T1595", "T1082", "T1083", "T1078"}
LABELS = {
"T1046": "Network Service Discovery",
"T1595": "Active Scanning",
"T1082": "System Information Discovery",
"T1083": "File and Directory Discovery",
"T1059": "Command and Scripting Interpreter",
"T1078": "Valid Accounts",
"T1021": "Remote Services",
}
covered = 0
for tid in PLAN:
hit = tid in OBSERVED
covered += hit
print(f"{tid} {LABELS[tid]:34} {'COVERED' if hit else 'PLANNED-NOT-SEEN'}")
print(f"coverage={covered}/{len(PLAN)} ({100*covered/len(PLAN):.0f}%)")
Expected output:
T1046 Network Service Discovery COVERED
T1595 Active Scanning COVERED
T1082 System Information Discovery COVERED
T1083 File and Directory Discovery COVERED
T1059 Command and Scripting Interpreter PLANNED-NOT-SEEN
T1078 Valid Accounts COVERED
T1021 Remote Services PLANNED-NOT-SEEN
coverage=5/7 (71%)
Elena's next-research page lists these four, each with a one-line authorization note. External replication comes first: another lab running the same checker and measures under its own approval. Enterprise pilots need separate authorization from the lab study, and must not reuse NHUSTL's synthetic-only approval. The human-factors study builds on the pilot's two false stops, asking how checker messages could help operators notice a mistyped in-scope host.
8.5 Leaving the lab safer
Document checker defaults; train the next cohort on stop conditions; remove any temporary exceptions; donate the synthetic topology to teaching. Coverage reporting (the lab) becomes a teaching exercise in humility: planned-not-seen is a prompt for the next authorized study, not a trophy.
Elena pins checker defaults, trains the next cohort on stop conditions, removes temporary exceptions and donates the synthetic topology to teaching. Planned-not-seen techniques from the coverage lab go on the next authorized study plan, with permission, rather than being tested freelance.
8.6 Worked example (synthetic NHUSTL case)
At defence, Elena is asked whether results generalise to CBEST-style assessments. She answers that CBEST is threat-led and regulator-supervised for financial firms; her contribution is a measurement instrument for scope compliance that such programmes could adopt, not a substitute for intelligence-led scenarios. She refuses a request to show a "fun exploit" and demos a DENY on 8.8.8.8 instead. Her publication plan lists one journal submission and one open archive release with hashes.
The CBEST answer is complementary, not substitute: a scope-compliance instrument could support such programmes, but does not replace intelligence-led scenarios or supervisory oversight. The refused exploit demo and the DENY on 8.8.8.8 show the same dual-use discipline as the publication plan.
8.7 Errors and limits
- Overclaiming generalisation to live enterprises.
- Publishing bypass recipes.
- Leaving temporary wide scope rules enabled.
Each error undoes earlier care. Overclaiming generalisation to live enterprises goes beyond synthetic labs and student operators. Publishing bypass recipes turns measurement research into an attack resource. Leaving temporary wide scope rules enabled is a risk to the next cohort. Check the defence and handoff plan for all three. Elena's handoff checklist names each one. Temporary wide scope rules are removed from the checker configuration, and the removal date is recorded on the checklist.
Exercises
- EX045 — Opening. Write a 90-second defence opening. Rubric: 3 = question, measure, result, conditions; 2 = three; 1 = vague; 0 = none.
- EX046 — Dual-use. Answer "show us the exploit" in four sentences. Rubric: 3 = refuse, offer scope demo, ethics, CVD; 2 = three; 1 = shows exploit; 0 = none.
- EX047 — CBEST. Relate your work to CBEST without overclaim. Rubric: 3 = complementary, not substitute; 2 = partial; 1 = "we replace CBEST"; 0 = none.
- EX048 — Pubs. Plan two publications with venues and what is excluded. Rubric: 3 = both with exclusions; 2 = one; 1 = vague; 0 = none.
- EX049 — Coverage lab. How would you use a planned-not-seen technique ethically? Rubric: 3 = next authorized study, no freelance testing; 2 = partial; 1 = just attack it; 0 = none.
- EX050 — Handoff. List five handoff actions to leave the lab safer. Rubric: 3 = five apt; 2 = three; 1 = one; 0 = none.
Synthesis
Defence and publication prove that your contribution is measured, ethical and usable — and that you will not trade integrity for spectacle.
Continue studying — chapter 08 of 08
← Chapter 07 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →