Chapter 2 — Current practice in authorized offensive security
Lesson map
Lesson 02 published. Map, example, EX006.
flowchart TD
N0["Learning outcomes"]
N1["2.1 Practice landscape"]
N2["2.2 Threat-led specifics"]
N3["2.3 SP 800-115 and PTES"]
N4["2.4 Vendor critique"]
N5["2.5 MCH catalogue"]
N6["2.6 Currency"]
N7["2.7 Narrative"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX006"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 Practice landscape"]
N2["2.2 Threat-led specifics"]
N3["2.3 SP 800-115 and PTES"]
N4["2.4 Vendor critique"]
N5["2.5 MCH catalogue"]
N6["2.6 Currency"]
N7["2.7 Narrative"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX006"]
[Learning outcomes]
|
v
[2.1 Practice landscape]
|
v
[2.2 Threat-led specifics]
|
v
[2.3 SP 800-115 and PTES]
|
v
[2.4 Vendor critique]
|
v
[2.5 MCH catalogue]
|
v
[2.6 Currency]
|
v
[2.7 Narrative]
|
v
[Worked example] --> [Exercise EX006]
Learning outcomes
You will (1) map current practice frameworks; (2) position TIBER-EU and CBEST among lighter tests; (3) critique vendor claims; (4) keep MCH's catalogue honest.
2.1 Practice landscape
Organisations mix vulnerability management, periodic web application tests following OWASP WSTG themes, purple-team drills and occasional threat-led exercises under TIBER-EU or CBEST-like rules. Names are not interchangeable, and wrong names produce wrong expectations about detection learning and SWIFT-adjacent coverage. Amira's catalogue lists those four activities as separate rows with separate claims. Calling all of them a red team is how boards hear SWIFT assurance that was never bought, so she corrects vocabulary in every planning meeting until the names stay separate in every planning note.
2.2 Threat-led specifics
TIBER-EU and CBEST emphasise intelligence-led scenarios, white-team control and learning for detection and response — not finding count maximisation. When executives say "just pentest everything", Amira opens the public guides and shows those three expectations; a week of scanning is not a threat-led programme under them. Her RFP language asks for intelligence, white-team design and detection learning, not for a finding-count target, which is scored as theatre. Vendors who cannot describe white-team design leave the shortlist, so Meridian Clearing House does not buy a scan dressed as threat-led work.
2.3 SP 800-115 and PTES
NIST SP 800-115 and PTES are still the backbone for planning assessment types and engagement stages. Threat-led programmes sit on top of, not instead of, that scoping discipline: written authorization, inclusions, exclusions and stop conditions remain mandatory even when the scenario is intelligence-led and biennial. Skipping scoping because the exercise is special is how out-of-scope probes happen. Sitting on that backbone is how Amira keeps SWIFT-adjacent systems out of ordinary tests while still running a biennial scenario under white-team control. The biennial scenario's own ROE therefore names the SWIFT-adjacent exclusion explicitly.
2.4 Vendor critique
Vendors who promise "full red team in a week" without intelligence, a white team or detection goals are selling a scan with theatre. Amira's RFP scoring asks who acts as white team, what detection goals will be measured, and how intelligence shapes scenarios; those three answers separate a real offer from a slogan. She has rejected a one-week full red team bid with no intelligence phase and recorded the reason in the catalogue. Each rejection reason stays there, so the next buyer at Meridian Clearing House can see the pattern of scan-with-theatre bids.
2.5 MCH catalogue
A living catalogue maps each activity to what it can and cannot claim. Ordinary quarterly web tests cannot claim SWIFT safety; a biennial threat-led exercise cannot claim continuous coverage of every web change. Honesty here stops insurance questionnaires and board slides from overstating Meridian Clearing House's assurance. A catalogue row without a cannot-claim line is incomplete, and Amira will not let such a row enter a pack. She also blocks board-pack language that invents claims a complete row forbids, even when the wording comes from a senior sponsor.
2.6 Currency
Amira reviews the catalogue twice a year against new framework editions. The reviews catch new ATT&CK, WSTG, TIBER-EU and CBEST editions and redline retired vendor slogans still sitting in old board packs. A catalogue that is never refreshed becomes a museum of last year's swagger. She dates each review and files the redline index, so retired slogans cannot be pasted forward from old packs into new ones. Currency is a scheduled control with a date in the calendar, not a hope that someone will notice a stale claim before a committee does.
2.7 Narrative
Catalogue reviews include a red-team vendor as guest critic once a year. Amira asks them to attack the cannot-claim lines: if they can honestly say a quarterly web test proves SWIFT safety, the line is too weak. Last year's guest failed to break the lines; she still tightened one adjective. She invites a different vendor each year so the critique does not become captured. Currency reviews also hunt retired vendor slogans lingering in old board packs and redline them in the archive index.
2.8 Archive redlines
Archive redlines of old packs are linked from the catalogue changelog, so reviewers see which claim was softened and why; forgetting history is how swagger returns to board language. The rewrite from "we are CBEST compliant" to a time-bounded CBEST-inspired exercise with SWIFT-adjacent exclusions is the worked example, and both versions stay in the archive. When a director asked why "compliant" vanished from the 2025 slide, the changelog link answered the question without a meeting. Each changelog entry records the date, the old wording and the reviewer who approved the new wording.
Worked example (synthetic MCH)
Amira rewrites a board slide from "we are CBEST compliant" to "we completed a CBEST-inspired exercise in 2025; ordinary quarterly tests exclude SWIFT-adjacent systems per catalogue".
Synthetic case — Meridian Clearing House (MCH). The clearing organisation, Amira Hassan and all figures are invented for teaching.
Errors and limits
Threat-led and clearing-system tests require specialised legal authorization. This book uses synthetic scenarios only and never supplies exploit code or live targeting advice for market infrastructures.
Exercises
- EX006 — Not interchangeable. Why not call every test a red team? Rubric: 3 = different depth/intel/detection goals; 2 = partial; 1 = same; 0 = none.
- EX007 — Threat-led emphasis. Name two emphases of TIBER-EU/CBEST-style tests. Rubric: 3 = intel-led scenarios and detection/response learning (white team); 2 = one; 1 = finding volume; 0 = none.
- EX008 — RFP question. Give one RFP question that weeds out theatre. Rubric: 3 = asks white-team/learning objectives/intel; 2 = partial; 1 = cheapest price only; 0 = none.
- EX009 — Cannot-claim. What must a catalogue state besides what tests do? Rubric: 3 = what they cannot claim; 2 = partial; 1 = logos; 0 = none.
- EX010 — Slide rewrite. What was wrong with "we are CBEST compliant"? Rubric: 3 = overclaim / imprecise; 2 = partial; 1 = says nothing was wrong; 0 = no answer.
Synthesis
Current practice is a catalogue of honestly named activities, not a single buzzword.
Continue studying — chapter 02 of 12
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →