◇ OpenCyber Academy
Professional · Chapter 3 · English

Chapter 3 — Authorized practice and evidence handling

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Authorized practice and evidence handling

Lesson map

Lesson 03 published. Map, example, EX011.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Checklist before kickoff"]
  N2["3.2 Evidence rules"]
  N3["3.3 Chain of custody"]
  N4["3.4 Personal devices"]
  N5["3.5 Classroom versus production"]
  N6["3.6 When the checklist fails"]
  N7["3.7 Agreement beats habit"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX011"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Checklist before kickoff"]
  N2["3.2 Evidence rules"]
  N3["3.3 Chain of custody"]
  N4["3.4 Personal devices"]
  N5["3.5 Classroom versus production"]
  N6["3.6 When the checklist fails"]
  N7["3.7 Agreement beats habit"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX011"]

[Learning outcomes]
    |
    v
[3.1 Checklist before kickoff]
    |
    v
[3.2 Evidence rules]
    |
    v
[3.3 Chain of custody]
    |
    v
[3.4 Personal devices]
    |
    v
[3.5 Classroom versus production]
    |
    v
[3.6 When the checklist fails]
    |
    v
[3.7 Agreement beats habit]
    |
    v
[Worked example] --> [Exercise EX011]

Learning outcomes

You will (1) complete a rules-of-engagement checklist; (2) explain evidence retention and redaction; (3) refuse work that lacks an emergency contact; (4) describe chain of custody for test data.

3.1 Checklist before kickoff

Every required field of the rules of engagement must be filled: scope, exclusions, methods, window, emergency contact, data handling and report audience. An empty emergency contact stops the test.

"""Lab 3: validate a synthetic rules-of-engagement checklist before testing starts."""
required = ["in_scope", "out_of_scope", "allowed_methods", "window", "emergency_contact",
            "data_handling", "report_audience"]
draft = {"in_scope": "192.0.2.0/24 web and VPN", "out_of_scope": "core banking AS/400",
         "allowed_methods": "config review, authenticated web tests", "window": "Sat 08:00-12:00",
         "emergency_contact": "", "data_handling": "delete within 30 days", "report_audience": "CISO"}
missing = [k for k in required if not draft.get(k)]
print("complete" if not missing else "MISSING: " + ", ".join(missing))
for k in required:
    print(f"  {k}: {draft.get(k) or '(empty)'}")

Run with python3 lab_roe.py. Verified output:

MISSING: emergency_contact
  in_scope: 192.0.2.0/24 web and VPN
  out_of_scope: core banking AS/400
  allowed_methods: config review, authenticated web tests
  window: Sat 08:00-12:00
  emergency_contact: (empty)
  data_handling: delete within 30 days
  report_audience: CISO

The lab prints MISSING when emergency_contact is empty, and lists the other fields so Leo can see what is already filled. In the worked draft every field except emergency_contact is filled, which is why the lab prints a single MISSING line. He will not schedule the Saturday 08:00–12:00 window until the CISO names an on-call contact. An empty field is a stop, not a prompt to improvise.

3.2 Evidence rules

Capture only what proves the finding. Redact member identifiers. Store evidence in the approved repository with access limited to the engagement team. Delete or return it when the agreement says so. For HCU, that means screenshots without member names or account numbers, stored under the engagement ticket in the vault, not in personal chat; evidence that proves a cookie flag is missing does not need a real member's session token. Access to the ENG-440 folder is limited to the team named in the agreement. When the agreement says delete within 30 days, Leo diaries the deletion and confirms it, and the vault entry shows the deletion date beside the folder so a reviewer can check the rule was met.

3.3 Chain of custody

Note who collected each item, when, and every hand-off. For classroom labs the log is short; for real exams it can be scrutinised. Leo's custody line for ENG-440 notes who exported each file, from which jump host, and when it entered the vault. A two-line custody log is enough for the classroom engagement ENG-CLASS-11, but it records exactly the fields Leo will use for ENG-440, so the practice transfers. If evidence moves at shift change, the hand-off line names both people and the ticket id; missing custody is how files go astray before an exam.

3.4 Personal devices

Do not keep HCU evidence on personal laptops or chat apps. Use the issued environment. HCU issues a locked-down jump environment for testing. Evidence that leaves it — copied to a phone, pasted into WhatsApp, or saved to a personal drive — breaks the agreement and can expose member data. Leo treats the issued environment as the only place evidence may live. If he must work remotely, he uses the VPN into that environment, never a sync folder that copies files to a home machine. If a copy does leave, Leo reports it to the CISO the same day rather than deleting it quietly.

3.5 Classroom versus production

These labs validate checklists on synthetic drafts; they do not replace a legal review of a real ROE. Passing lab_roe on a synthetic draft proves Leo can spot a missing emergency contact; it does not mean a real ROE is ready. A real ROE also needs the CISO's signature, legal's contract check and the network team's firewall approval, none of which the lab simulates. Leo states that classroom-versus-production boundary in every lab report, so nobody treats a classroom pass as production authorization.

3.6 When the checklist fails

If any required ROE field is empty on the morning of the test, Leo cancels the window in writing and informs the CISO and SOC. Restarting after a scramble to fill fields produces mistakes; a clean postponement is cheaper than an unauthorized hour. He posts the cancellation to the engagement channel with the missing field named, and the CISO and the SOC lead receive the same written cancellation, so nobody keeps a stale Saturday plan in their calendar or expects traffic. A new window is booked only after the checklist prints complete on a full ROE; the written cancel protects him if someone later claims testing ran without one.

3.7 Agreement beats habit

Even if Leo tested the same staging site last quarter, he does not reuse last quarter's ROE. Systems, owners and exclusions change. Each engagement starts from a current signed agreement, and the checklist is run against that agreement, not against memory. Last quarter's exclusions might have omitted a new staging host that is now production-adjacent; running the checklist against the current signed agreement catches that, and the new host would also need a named owner in the stakeholder list before Leo could include it in scope. He dates each checklist run and keeps the output with the new ROE in the vault, so the check can be shown later. Habit is not authorization.

Worked example (synthetic HCU)

Leo runs the checklist on the draft ROE. It prints MISSING: emergency_contact. He will not schedule the Saturday window until the CISO names an on-call contact and the field is filled.

Synthetic case — Harborline Credit Union (HCU). The credit union, Leo Okonkwo and all figures are invented for teaching.

Errors and limits

Local policies and laws differ; follow HCU's authorization and your jurisdiction. This book never authorizes testing of real systems.

Exercises

Synthesis

No emergency contact, no test; evidence is minimised, retained as agreed and never parked on personal devices.

Continue studying — chapter 03 of 12

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →