Chapter 20 — Authorized offensive security and red team: engineering context
Lesson map
Lesson 20 published. Map, example, EX058.
flowchart TD
N0["Learning outcomes"]
N1["20.1 Discipline map"]
N2["20.2 What we build"]
N3["20.3 Safety boundary"]
N4["20.3b Neighbouring courses"]
N5["20.1b Engineering deliverables vs operator deliverab"]
N6["20.4b Who the engineering team serves"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX058"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["20.1 Discipline map"]
N2["20.2 What we build"]
N3["20.3 Safety boundary"]
N4["20.3b Neighbouring courses"]
N5["20.1b Engineering deliverables vs operator deliverab"]
N6["20.4b Who the engineering team serves"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX058"]
[Learning outcomes]
|
v
[20.1 Discipline map]
|
v
[20.2 What we build]
|
v
[20.3 Safety boundary]
|
v
[20.3b Neighbouring courses]
|
v
[20.1b Engineering deliverables vs operator deliverab]
|
v
[20.4b Who the engineering team serves]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX058]
Learning outcomes
You will (1) place red-team engineering among PTES, NIST SP 800-115 and ATT&CK; (2) define what this degree programme builds; (3) state the safety boundary for all later chapters.
20.1 Discipline map
NIST SP 800-115 frames testing and assessment. PTES sequences pre-engagement through reporting. ATT&CK names techniques for planning and coverage — not as a score of residual risk. TIBER-EU and CBEST add threat-led oversight for certain financial contexts. Engineers build the platforms that make those frameworks operable: scope checkers, finding systems, coverage reporters, evidence stores.
Frameworks describe the engagement lifecycle; ATT&CK labels techniques for planning. The engineering job is making scope checks, findings and coverage reports real systems operators can run. Sam cites the framework version in each ADR that implements a control they require.
20.2 What we build
Riverstone's TrackScope, FindingsDesk and PulseMap are the running example of that platform layer. Graduates should leave able to design, verify and operate such systems under authorization — not to invent exploits.
Design, verification and operation under authorization is the graduate outcome. Exploit invention is out of scope for the degree and for Riverstone's platform team. TrackScope, FindingsDesk and PulseMap show how far that platform layer reaches into daily work. Sam's studio briefs always ask which platform artefact the student will leave behind.
20.3 Safety boundary
No exploit payloads, no unauthorized targets, no live personal data, labs on synthetic local data only. Dual-use requests are refused (Chapter 10). This boundary is a requirement on every design review in Chapters 21–50.
Synthetic case — Riverstone Transit. Leadership asked for "a red team that hacks everything". Sam reframed the charter: "an authorized assessment platform that enforces ROE and measures remediation."
The boundary is enforced in design review, not only in a preface. Dual-use refusals from the ethics chapter apply to every later feature request. Synthetic local labs keep coursework off real networks and real people. Sam rejects studio proposals that need live personal data or unauthorized targets, even as demonstrations.
20.4 Errors and limits
Frameworks evolve; re-check URLs and versions before citing in a thesis. This chapter orients; it does not replace reading the primary sources.
Primary sources move; a thesis that cites a dead URL fails a basic check. This chapter points; it does not summarise every clause of PTES or NIST SP 800-115. Sam bookmarks the versions he used and re-opens them before submission week, and he quotes clause ids rather than paraphrases when a requirement hangs on the text. Paraphrase alone has caused more than one failed viva.
20.3b Neighbouring courses
This engineering book assumes comfort with calculus, probability and software engineering from earlier chapters. The bachelor's RED book is broader and less design-heavy; the technologist book emphasizes implementation drills. Pick artefacts that match the level — a thesis-sized empty score is still empty.
Choosing artefacts that match the level avoids empty thesis scores in a book that demands design evidence. Implementation drills belong in the technologist path; this book wants schemas, tests and ADRs. Sam steers students who arrive from the bachelor's path toward deeper verification of the same tools.
20.1b Engineering deliverables vs operator deliverables
Operators need runbooks and tickets; engineers need schemas, tests and ADRs. Capstone grading looks for both. A beautiful tool without a runbook fails operations; a runbook without fail-closed tests fails engineering.
Graders look for both because either gap fails in the field. Fail-closed tests without a runbook leave night staff guessing; runbooks without tests leave fail-open paths latent. Sam's capstone rubric scores the pair together on each feature. Students who ship only one of the two revise before the defense.
20.4b Who the engineering team serves
The platform team's users are testers and engagement leads; its stakeholders also include the client's system owners, who never see the code but carry the risk if TrackScope fails open. Sam's requirement notes list both groups, so a feature that helps testers move faster but weakens a client safeguard is visible as a trade-off before it is built. When a proposal skipped dual approval on scope widens "to save clicks," the system-owner row on that note is what killed it — Riverstone's signalling hosts sit behind that control, not the testers' convenience.
Exercises
- EX058 — Framework fit. Pair each need with PTES / SP 800-115 / ATT&CK / TIBER-EU. Rubric: 3 = four sensible pairs; 2 = three; 1 = two; 0 = none.
- EX059 — Charter rewrite. Rewrite "hack everything" as an engineering charter sentence. Rubric: 3 = authorization + platform + measurement; 2 = partial; 1 = still attack-centric; 0 = none.
- EX060 — Boundary. Give three concrete "out of scope for this programme" items. Rubric: 3 = three clear (payloads, real targets, PII dumps…); 2 = two; 1 = one; 0 = none.
Synthesis
Engineers enable authorized assessment; they do not replace authorization with cleverness.
Continue studying — chapter 20 of 50
← Chapter 19 (draft) · Course chapter index · Chapter 21 (draft) →