◇ OpenCyber Academy
Professional · Chapter 6 · English

Chapter 6 — Operational workflow

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 6 — Operational workflow

Lesson map

Lesson 06 published. Map, example, EX026.

flowchart TD
  N0["Learning outcomes"]
  N1["6.1 Day-of sequence"]
  N2["6.2 Activity log"]
  N3["6.3 SOC coordination"]
  N4["6.4 Mid-test questions"]
  N5["6.5 End state"]
  N6["6.6 Handover between testers"]
  N7["6.7 Communication channel discipline"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX026"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["6.1 Day-of sequence"]
  N2["6.2 Activity log"]
  N3["6.3 SOC coordination"]
  N4["6.4 Mid-test questions"]
  N5["6.5 End state"]
  N6["6.6 Handover between testers"]
  N7["6.7 Communication channel discipline"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX026"]

[Learning outcomes]
    |
    v
[6.1 Day-of sequence]
    |
    v
[6.2 Activity log]
    |
    v
[6.3 SOC coordination]
    |
    v
[6.4 Mid-test questions]
    |
    v
[6.5 End state]
    |
    v
[6.6 Handover between testers]
    |
    v
[6.7 Communication channel discipline]
    |
    v
[Worked example] --> [Exercise EX026]

Learning outcomes

You will (1) describe the day-of workflow from kickoff to debrief; (2) keep a contemporaneous activity log; (3) coordinate with the SOC; (4) handle a mid-test scope question.

6.1 Day-of sequence

Kickoff call confirms ROE and contacts; testers begin only inside the window; progress notes go to the engagement channel; mid-point check with the product owner if anything sensitive appears; end-of-day debrief; evidence vaulted. For ENG-440, Leo's Saturday sequence follows that order. Nothing starts before the kickoff confirms the ROE still matches the signed copy, and evidence is vaulted before he leaves for the day. Deviations from the sequence are logged with a reason so a later review can see why.

6.2 Activity log

Every action gets a time, system, method and result. The log defends the team if an outage is blamed on testing and feeds the report. Leo's log line includes time, host, method and result, such as a pause when a hostname looked like production. Each line uses the jump host clock, so log entries and SOC alerts can be lined up afterwards without guessing offsets. Logs are kept in the vault with the evidence, not only in chat history that scrolls away. If payday traffic slows, the log is what shows whether testing was involved.

6.3 SOC coordination

Send start and stop messages. If the SOC sees related alerts, they call the emergency contact rather than blocking Leo's access without notice. Leo's start message for ENG-440 goes out at 08:05, names staging only and carries the ticket id, the source IP and the 12:00 end time. If the SOC calls about his IP, he confirms the ticket, shares the window and reduces rate or pauses if they ask; any rate change is written in the activity log with the time and the analyst's name. At 12:00 Leo posts stop to the engagement channel with the ticket id so the SOC can clear his IP from the watch list. Silent testing against a watching SOC creates avoidable incidents.

6.4 Mid-test questions

New hostname discovered? Pause and ask. Do not "just include it." At 09:40 Leo finds a hostname that might be production; he pauses, asks the product owner, learns it is staging, logs the decision and continues. The product owner's reply confirming the host belongs to staging is pasted into the ticket before testing resumes, so ENG-440 shows judgment under time pressure, not a lucky guess. The question costs minutes; an unauthorized probe on a production-looking host would cost the engagement. Guessing would have been out of scope.

6.5 End state

At stop time, stop. Unfinished checks become next-window work or explicit out-of-time notes — not silent overruns. At 12:00 Leo stops even if a WSTG check is half done. The half-finished check is listed in the report with the step it reached, so the next window starts there. The SOC expects silence after the 12:00 stop message, so any later packet from Leo's IP would look like an attack. Silent overruns break the agreement the SOC and CISO relied on, and the 12:00 stop on ENG-440 is the same rule he practises on ENG-CLASS-11.

6.6 Handover between testers

If Leo ends his shift and a colleague continues, the activity log and evidence vault are the handover. Verbal notes are not enough; the colleague must see what was already validated so they do not retest destructively or miss a stop condition. The colleague opening the vault should see validated findings, open questions and any stop conditions already hit. Handover notes name the next safe action and anything that must not be repeated, such as a pause Leo already agreed. When a colleague picks up mid-window, the note plus the vault path is enough; Leo does not leave critical context only in his head.

6.7 Communication channel discipline

Engagement chat is for scope, stops and status — not for jokes about "hacking the bank". Casual language leaks into screenshots and damages trust if an examiner later reads the channel. Leo writes status in plain, professional words, with ticket ids, because screenshots of the channel can appear in evidence or examiner review. Screenshots for ENG-440 strip desktop clutter and unrelated tabs before they enter the vault under the ticket id. Communication stays in the engagement channel; personal chat is not an evidence store for ENG-440.

6.8 Window extensions

If work must continue past the window, Leo stops, requests a written extension from the CISO, and waits for confirmation before any further packet leaves his laptop. Verbal "sure, keep going" is not enough, even from the CISO on the phone. A written extension names the new end time and is filed with the ROE before work resumes. If Saturday runs long, Leo's laptop sends no further packets until that extension exists, because the SOC and emergency contact must see the same clock Leo uses.

Worked example (synthetic HCU)

At 08:05 Leo posts "ENG-440 start — staging only". At 09:40 he finds a hostname that might be production; he pauses, asks the product owner, learns it is staging, logs the decision, continues.

Synthetic case — Harborline Credit Union (HCU). The credit union, Leo Okonkwo and all figures are invented for teaching.

Errors and limits

Local policies and laws differ; follow HCU's authorization and your jurisdiction. This book never authorizes testing of real systems.

Exercises

Synthesis

Workflow is kickoff, logged work, SOC visibility and pause-to-ask — never silent scope creep.

Continue studying — chapter 06 of 12

← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →