Chapter 3 — Specialist evidence | Postgraduate Authorized offensive security and red team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Specialist evidence

Lesson map

Lesson 03 published. Map, example, EX011.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Specialist grade"]
  N2["3.2 Privileged data"]
  N3["3.3 Challenge survival"]
  N4["3.4 Theatre screenshots"]
  N5["3.5 Chain of custody"]
  N6["3.6 Platform"]
  N7["3.7 Narrative"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX011"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Specialist grade"]
  N2["3.2 Privileged data"]
  N3["3.3 Challenge survival"]
  N4["3.4 Theatre screenshots"]
  N5["3.5 Chain of custody"]
  N6["3.6 Platform"]
  N7["3.7 Narrative"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX011"]

[Learning outcomes]
    |
    v
[3.1 Specialist grade]
    |
    v
[3.2 Privileged data]
    |
    v
[3.3 Challenge survival]
    |
    v
[3.4 Theatre screenshots]
    |
    v
[3.5 Chain of custody]
    |
    v
[3.6 Platform]
    |
    v
[3.7 Narrative]
    |
    v
[Worked example] --> [Exercise EX011]

Learning outcomes

You will (1) define specialist-grade evidence; (2) handle privileged clearing data; (3) design evidence that survives challenge; (4) refuse theatre screenshots.

3.1 Specialist grade

Evidence must be reproducible under the ROE, minimised, hashed, time-zoned and tied to a decision. "Looks bad in a tool" is not specialist grade: reproducibility is the grade, drama is not. Specialist-grade evidence can be reproduced under the ROE by another tester using hashes, timestamps and scope context from the vault. FindingsDesk blocks board-pack entry until hash and owner are present, so drama without those fields never reaches a committee slide. An observation that fails the test is rewritten until another specialist could repeat it.

3.2 Privileged data

Clearing messages and participant identifiers are highly sensitive. Sensitivity is not a reason to skip evidence; it is a reason to design safer evidence. Amira keeps real messages and identifiers out of ordinary evidence whenever synthetic message templates can show the same class of issue, and she prefers those templates even in staging. Anything that still looks too real is redacted before it enters the vault. The result is a vault in which ordinary entries prove the issue without carrying participant data that a leak or a careless export could expose.

3.3 Challenge survival

Legal or white-team challenge asks: could another specialist reproduce this observation without your laptop folklore? If not, rewrite. In challenge drills a second specialist has ten minutes to find a missing hash, timezone or ROE clause, and is scored for catching real gaps. If the observation cannot survive, Amira rewrites it before vault entry; calm repair after a catch scores well, defensiveness does not. The drill exists so that legal or white-team challenge never meets an unreproducible claim for the first time in a real dispute.

3.4 Theatre screenshots

Dark-themed dashboards without hashes, timestamps or scope context look impressive and prove nothing, and the evidence vault rejects them on sight. They waste examiner time and train juniors to confuse polish with evidence. Amira asks first for the boring artefacts — command output, config excerpts and hashes — and will not argue about colour themes until hashes and timestamps exist. A rejected theatre screenshot becomes a teaching example in the next challenge drill, so the same polish mistake does not return in the following quarter's evidence.

3.5 Chain of custody

For threat-led exercises, custody logs are as important as technical artefacts. They show who held which artefact, when it moved and who authorised the move, and a missing custody line is treated as seriously as a missing hash. White-team and legal challenges often start with chain-of-custody questions, so the log is built during the exercise, while memory is fresh, rather than reconstructed afterwards. A log written from memory a week later invites exactly the doubt that custody records exist to remove.

3.6 Platform

FindingsDesk fields enforce hash and owner before a finding may enter board packs. The platform gate is how Meridian Clearing House keeps specialist standards when calendar pressure rises before a committee meeting. Amira refuses manual overrides for late slides, even when the meeting is tomorrow and colour and severity look ready. Colour and severity fields come after hash and owner, never instead of them. A finding that misses the pack because its hash is absent goes to the next pack complete, which costs one cycle rather than credibility.

3.7 Narrative

Challenge drills pair two specialists: one presents evidence, the other has ten minutes to find a missing hash, timezone or ROE clause. Amira scores the challenger for catching real gaps and the presenter for calm repair. Vault rejection rates dropped afterward, because presenters arrived with hashes filled. Custody drills include a simulated laptop seizure asking whether hashes still prove out; partial hash recovery counts as a fail, and a past fail funded HSM work for vault keys. The seizure scenario is rerun after every change to how vault keys are stored.

3.8 Drill-funded controls

The HSM budget memo used the seizure-drill fail as exhibit A: boring drills buy real controls. The memo set the recovered fragment beside the vault-key inventory, showing which key the seized laptop would have exposed. Finance accepted the HSM line because the drill record had a dated plan, a written rule and a failed result nobody had softened. Treating the partial result as a fail is what made the drill credible evidence in that memo; a softened score would have read as a near-pass and funded nothing.

3.9 Drill scoring rule

Seizure-drill scores are pass/fail, and partial hash recovery is a fail: a recovered fragment still proves key material left the device, so the rule has no middle grade. Amira writes that pass-fail sentence into the drill brief before the exercise starts and keeps it beside the drill plan for later cohorts. The brief also names the scorer in advance, so nobody who ran the seizure scenario grades it afterwards. Operators who want a middle grade after a fragment recovers learn that the rule does not bend for comfort; softening it would train them to negotiate scores.

Worked example (synthetic MCH)

Amira rejects a vendor slide of a red dashboard; accepts a packet with request ids, hashes, UTC offsets and the ROE clause that allowed the check.

Synthetic case — Meridian Clearing House (MCH). The clearing organisation, Amira Hassan and all figures are invented for teaching.

Errors and limits

Threat-led and clearing-system tests require specialised legal authorization. This book uses synthetic scenarios only and never supplies exploit code or live targeting advice for market infrastructures.

Exercises

EX011 — Four traits. List four specialist-grade evidence traits. Rubric: 3 = four of reproducible, minimised, hashed, time-zoned, tied to decision; 2 = three; 1 = one; 0 = none.
EX012 — Synthetic preference. Why prefer synthetic clearing templates? Rubric: 3 = sensitivity of real clearing data; 2 = partial; 1 = laziness; 0 = none.
EX013 — Challenge question. What question tests challenge survival? Rubric: 3 = could another specialist reproduce without folklore; 2 = partial; 1 = is it red; 0 = none.
EX014 — Theatre reject. Why reject a dark dashboard screenshot alone? Rubric: 3 = no hash/time/scope context; 2 = partial; 1 = aesthetics; 0 = none.
EX015 — Vault gate. What does FindingsDesk require before board packs? Rubric: 3 = hash and owner (and related fields); 2 = one; 1 = colour; 0 = none.

Synthesis

Specialist evidence survives challenge; theatre does not enter the vault.

Continue studying — chapter 03 of 12

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →