Chapter 1 — Security foundations for practitioners
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Where offensive testing sits"]
N2["1.2 CIA at a credit union"]
N3["1.3 Least privilege and depth"]
N4["1.4 Frameworks you will cite"]
N5["1.5 What practitioners produce"]
N6["1.6 Member trust"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Where offensive testing sits"]
N2["1.2 CIA at a credit union"]
N3["1.3 Least privilege and depth"]
N4["1.4 Frameworks you will cite"]
N5["1.5 What practitioners produce"]
N6["1.6 Member trust"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Where offensive testing sits]
|
v
[1.2 CIA at a credit union]
|
v
[1.3 Least privilege and depth]
|
v
[1.4 Frameworks you will cite]
|
v
[1.5 What practitioners produce]
|
v
[1.6 Member trust]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) place authorized offensive security among other security practices; (2) name confidentiality, integrity and availability with credit-union examples; (3) explain least privilege and defense in depth; (4) list the frameworks this course uses.
1.1 Where offensive testing sits
Security work includes architecture, monitoring, incident response and authorized testing. Testing finds what the others missed, under written permission. It does not replace patching, logging or training. At HCU, Leo's ENG-440 scope covers online banking staging and the staff VPN, and his reviews sit beside patching, logging and training rather than replacing them. When a finding appears, Leo still asks whether patching or monitoring should have caught it, so testing feeds everyday hardening rather than competing with it. A clean ENG-440 report still leaves Secure and HttpOnly cookie work to app-sec and MFA gaps to the VPN owners.
1.2 CIA at a credit union
Confidentiality protects member account data; integrity protects balances and transfer instructions; availability keeps online banking usable. A finding is judged by which of these it threatens, and when Leo rates one he names which of the three is at stake. A session cookie without Secure and HttpOnly threatens confidentiality of member sessions; a shared admin password threatens integrity of changes; a test that locks accounts threatens availability. The same technical issue can hit more than one, and the report should say so. Account lockout is why the ROE forbids password spraying: one careless run on payday could lock members out of their wages. The cookie-flag finding in ENG-440 is rated mainly on confidentiality, because a stolen session exposes a member's account view.
1.3 Least privilege and depth
Accounts and network paths should allow only what is needed. Several layers — network, application, identity, monitoring — mean one failure does not end the story. Testers look for places where layers are missing.
On the staff VPN, least privilege means each admin has a named account rather than a shared login, and depth means a stolen password still faces MFA and monitoring. Leo looks for places where one layer is missing, such as an admin path reachable without the jump host, because that is where a single failure ends the story.
1.4 Frameworks you will cite
NIST SP 800-115 for planning assessments; PTES for engagement stages; OWASP WSTG for web checks; MITRE ATT&CK for technique names; TIBER-EU and CBEST for threat-led tests in finance. Each reference answers a different question, so Leo cites the one that matches the decision being recorded. He opens OWASP WSTG first for web application tests of online banking staging, PTES for the engagement stages, and NIST SP 800-115 when planning what kind of assessment HCU needs. ATT&CK supplies technique names such as T1078 Valid Accounts for the SOC. TIBER-EU and CBEST matter only if HCU later sponsors a threat-led test.
1.5 What practitioners produce
Practitioners produce scoped plans, validated findings, clear reports and verified remediations — not piles of unconfirmed scanner noise. Leo's first week delivers a scoped plan for online banking and the VPN, not a scanner dump. Later he will produce validated findings, a clear report for the CISO and engineers, and verified remediations with retest evidence. Those four outputs are what the CISO and examiners can audit. Unconfirmed tool noise stays out of the report so owners can act on what is real; scanner noise without validation wastes fixer time and hides the issues that matter to members.
1.6 Member trust
Members trust HCU with wages and savings. A careless test that locks accounts or leaks a statement destroys that trust faster than most technical findings. Every method Leo proposes must answer: what member harm could this cause if it goes wrong, and how do we prevent it? That question shapes the ROE: staging first, no password spraying, stop if member data appears unexpectedly. A locked payday transfer or a leaked statement would harm members who never chose to be part of a test, so prevention is written into methods and stop conditions before any packet leaves.
Worked example (synthetic HCU)
Leo Okonkwo joins HCU's security team. His first week is a map: online banking and the staff VPN are in the next authorized review; the core banking AS/400 is out of scope. He pins the CIA questions above his desk.
Synthetic case — Harborline Credit Union (HCU). The credit union, Leo Okonkwo and all figures are invented for teaching.
Errors and limits
Local policies and laws differ; follow HCU's authorization and your jurisdiction. This book never authorizes testing of real systems.
Exercises
- EX001 — Three practices. Name three security practices besides authorized testing. Rubric: 3 = three of architecture, monitoring, IR, patching, training; 2 = two; 1 = one; 0 = none.
- EX002 — CIA match. Match: leaked member statements; altered transfer amount; online banking down. Rubric: 3 = C, I, A; 2 = two; 1 = one; 0 = none.
- EX003 — Least privilege. Give a credit-union example of least privilege. Rubric: 3 = concrete account/path limited to need; 2 = vague; 1 = wrong; 0 = none.
- EX004 — Defense in depth. Why is one firewall not enough? Rubric: 3 = other layers can fail independently; app/identity/monitor still needed; 2 = partial; 1 = it is enough; 0 = none.
- EX005 — Framework pick. Which source would Leo open first to structure a web application test? Rubric: 3 = OWASP WSTG; 2 = ATT&CK; 1 = CBEST only; 0 = none.
Synthesis
Authorized testing sits beside other practices; CIA, least privilege and public frameworks shape every engagement.