Chapter 37 — Authorized offensive security and red team: operations
Lesson map
Lesson 37 published. Map, example, EX109.
flowchart TD
N0["Learning outcomes"]
N1["37.1 Runbook contents"]
N2["37.2 Handover"]
N3["37.3 Close-out"]
N4["37.2b On-call hygiene"]
N5["37.3b Calendar integration"]
N6["37.1b Spare consumables"]
N7["Practice note"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX109"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["37.1 Runbook contents"]
N2["37.2 Handover"]
N3["37.3 Close-out"]
N4["37.2b On-call hygiene"]
N5["37.3b Calendar integration"]
N6["37.1b Spare consumables"]
N7["Practice note"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX109"]
[Learning outcomes]
|
v
[37.1 Runbook contents]
|
v
[37.2 Handover]
|
v
[37.3 Close-out]
|
v
[37.2b On-call hygiene]
|
v
[37.3b Calendar integration]
|
v
[37.1b Spare consumables]
|
v
[Practice note]
|
v
[Worked example] --> [Exercise EX109]
Learning outcomes
You will (1) write an engagement runbook; (2) hand over between shifts; (3) manage secrets rotation at close.
37.1 Runbook contents
Contacts, ROE pointer, tool versions, stop conditions, escalation tree, evidence paths. Keep it short enough to use under stress.
Under stress, people open one short page or none. Contacts, ROE pointer, tool versions, stops, escalation and evidence paths are the minimum that still works when SSO is slow. Sam prints that page for the jump-host binder and diffs it against the wiki whenever either changes. The binder page carries the wiki revision hash so a stale print is obvious at kickoff.
37.2 Handover
Shift log: open findings, last event ids, pending approvals, kill-switch state. Verbal handover plus the log.
Verbal handover without the log loses event ids and kill-switch state at shift change. The log's pending-approvals line is what stops a tired engineer from widening scope that was already refused. Sam requires both the spoken brief and the pasted log before the outgoing lead leaves the channel. A shift that skipped the pasted log once left a pending widen approval invisible until the client asked why testing had stopped.
37.3 Close-out
Disable accounts, rotate secrets, seal evidence, export metrics, schedule retrospective. A checklist beats memory.
"""Age synthetic findings against remediation SLAs by priority."""
SLA = {"critical": 7, "high": 30, "medium": 90, "low": 180}
findings = [
("SYN-001", "critical", 3, False),
("SYN-005", "critical", 12, False),
("SYN-003", "high", 25, False),
("SYN-004", "medium", 95, False),
("SYN-002", "medium", 40, True),
("SYN-006", "low", 200, False),
]
breaches = 0
for fid, pr, age, closed in findings:
status = "closed" if closed else ("BREACH" if age > SLA[pr] else "open")
breaches += status == "BREACH"
print(f"{fid} priority={pr:8} age_days={age:3} sla={SLA[pr]:3} status={status}")
open_n = sum(1 for f in findings if not f[3])
print(f"open={open_n} sla_breaches={breaches}")
Expected output:
SYN-001 priority=critical age_days= 3 sla= 7 status=open
SYN-005 priority=critical age_days= 12 sla= 7 status=BREACH
SYN-003 priority=high age_days= 25 sla= 30 status=open
SYN-004 priority=medium age_days= 95 sla= 90 status=BREACH
SYN-002 priority=medium age_days= 40 sla= 90 status=closed
SYN-006 priority=low age_days=200 sla=180 status=BREACH
open=5 sla_breaches=3
Synthetic case — Riverstone Transit. Close-out caught SYN-005 still BREACH past SLA — escalated before the retro.
Memory misses open accounts and unrotated secrets. The checklist that caught SYN-005 still in BREACH past SLA is the argument for never skipping close-out to "make the retro." Sam will not mark the engagement sealed until every checkbox has a UTC time and an actor. SYN-005's escalation before the retro is filed under the close-out checklist id, not under a hallway conversation.
37.4 Errors and limits
Runbooks in wikis nobody can access from the jump host fail; keep an offline copy.
A wiki that the jump host cannot reach is a runbook that does not exist during a stop. The offline copy in the ops kit is exercised in the tabletop when SSO is simulated down. Sam's close-out includes verifying the binder page matches the hashed wiki revision. A mismatch fails kickoff the same way a wrong TrackScope SHA does. Sam once found a binder page two revisions behind after a weekend wiki edit; kickoff stopped until the print was replaced.
37.2b On-call hygiene
On-call for assessment tools is not a license to widen scope. Pages are about tool safety and ROE enforcement; client asset incidents route to the client's IR path. Keep the escalations separate in the runbook so tired engineers do not merge them.
Mixing tool pages with client IR pages is how a scope question becomes an unplanned incident bridge. Assessment on-call fixes TrackScope and ROE enforcement; asset incidents go to Riverstone's own path. Sam's runbook puts the two trees on separate pages with different phone numbers.
37.3b Calendar integration
Engagement windows belong on a shared calendar with ROE version in the description. Accidental overlap of two noisy methods on the same CIDR is an operations failure, not a clever parallelization.
Two noisy methods on one CIDR without a calendar entry look clever until the depot uplink saturates. The shared calendar carries the ROE version in the description so overlap review is mechanical. Sam's scheduler refuses to start a noisy method that lacks a calendar block for its window. Overlap review runs automatically when two blocks share a CIDR and either is marked noisy.
37.1b Spare consumables
Ops kits include spare jump-host images, printed contact cards, and offline ROE copies.
When SSO dies, the engagement still needs a stop path that does not depend on the identity provider. Sam checks the kit the morning of the window, not after the first failed login. The kit checklist is a close-out item too, so borrowed images are restored before the next client. Printed contact cards list the client's stop contact and the engagement lead, with phone numbers that do not depend on the corporate directory. Offline ROE copies carry the same version number as the signed PDF, so nobody works from an older scope. Spare images are rebuilt from the golden image at the start of each term.
Practice note
Operations metrics include pages per window, mean time to acknowledge stops, and close-out checklist completion. Vanity metrics like hosts touched stay off the ops dashboard. What you measure weekly is what tired engineers will optimize when the client is watching.
Store the close-out checklist result hash in FindingsDesk so incomplete close-outs cannot be marked done quietly.
Handover includes reading the last ten TrackScope denies aloud to the incoming lead.
37.4b Measuring the runbook
After each engagement the lead notes which runbook steps were skipped, unclear or out of date. Sam tallies these over a quarter; steps skipped most often are rewritten or removed, and the runbook's revision history shows each change with its reason.
Steps skipped most often are either wrong or too hard under stress. Sam's last rewrite removed a step that asked for a screenshot of a page the jump host could not open, which had been skipped in four engagements running.
Exercises
- EX109 — Checklist. List six close-out steps. Rubric: 3 = six sensible; 2 = four; 1 = two; 0 = none.
- EX110 — Handover. What three fields must the shift log include? Rubric: 3 = findings/events/approvals (or equiv.); 2 = two; 1 = one; 0 = none.
- EX111 — SLA lab. How many SLA breaches in the lab? Rubric: 3 = 3; 2 = list without count; 1 = wrong; 0 = none.
Synthesis
Operate with runbooks, handovers and ruthless close-out.
Continue studying — chapter 37 of 50
← Chapter 36 (draft) · Course chapter index · Chapter 38 (draft) →