## Chapter 1 — What authorized offensive security is ### Learning outcomes You will (1) define authorized offensive security and red teaming; (2) explain how they differ from crime and from everyday IT work; (3) name the main public frameworks that guide them; and (4) describe who decides when testing is allowed. ### 1.1 Authorized testing, not hacking for thrills Authorized offensive security means looking for weaknesses in systems with the owner's written permission, for the purpose of making them safer. A red team is a group that simulates a realistic attacker under those same rules. Both are jobs done for a client or for one's own organisation. Breaking into systems without permission is a crime, even if you plan to tell someone afterwards. This course teaches how authorized testing is planned, limited and reported — never how to attack systems you do not own. ### 1.2 Why organisations pay for it Defenders need to know what an attacker could actually do, not only what a checklist says. NIST SP 800-115 describes several kinds of security testing and assessment, from reviews to technical tests. The Penetration Testing Execution Standard (PTES) organises a pentest into stages such as scoping, intelligence gathering, vulnerability analysis, exploitation, post-exploitation and reporting. Threat-led programmes such as TIBER-EU and CBEST use intelligence to make the test look like a real adversary against financial institutions. For Riverside Civic College, the value is practical: the outside firm's test of the staff portal will show whether a real attacker could misuse it, and Maya's team will use the report to decide which fixes come first. ### 1.3 What this course will not teach You will not be given exploit code, payloads or step-by-step attack procedures for real products. Labs use synthetic data and offline scripts. You will learn to check scope, keep evidence, write findings and stay inside the rules. Instead, the labs are short Python scripts that read local, invented data, such as a target list and four draft findings for Riverside Civic College. You will practise the decisions that keep testing safe and useful: what may be touched, what must be left alone, how serious a finding is and how to tell the people who must act. Those skills are needed before any technical testing is allowed. ### 1.4 Who says yes Permission comes from someone who owns or is authorised to speak for the system — often a business owner and a security lead, recorded in a signed document. Your manager, a friend or a public website's "report a bug" page is not enough unless the written rules say so. When in doubt, do not test. At Riverside Civic College, the staff portal test is allowed because the college's portal owner and IT security lead have signed an agreement with the outside firm. Maya's manager cannot add systems to that agreement by asking, and neither can Maya. A bug bounty page counts only for its own published scope and rules. If a system's owner is unclear, find out who it is before anything is tested. ### 1.5 Shared language for techniques MITRE ATT&CK gives public names for adversary techniques, such as T1078 Valid Accounts. Testers and defenders use those names so a finding and a detection rule describe the same behaviour. For example, a grading system where several staff share one admin login relates to T1078 Valid Accounts, because anyone with the password acts as a legitimate user and nobody can tell who did what. Maya will use this name in Chapter 3. A name does not score the finding or prove an attack happened; it gives testers and defenders a common reference, so a detection team can look up the technique and check whether they would notice it. ### Worked example (synthetic RCC) Maya Chen joins Riverside Civic College's IT security team as a trainee. Her manager explains that next month an outside firm will test the college's staff portal under a signed agreement. Maya's job this month is to learn what that agreement means and how the college will prepare, so she can help review the report afterwards. > **Synthetic case — Riverside Civic College (RCC).** The college, Maya Chen, systems and all figures in this book are invented for teaching. ### Errors and limits Framework names and editions change; check the current published versions before citing them in real work. This book grants no authority to test any real system. ### Exercises - **EX001 — Defining the work.** In one sentence, what is authorized offensive security? *Rubric:* 3 = testing with owner's written permission to improve security; 2 = partial; 1 = "hacking"; 0 = none. - **EX002 — Crime versus job.** Explain the difference between authorized testing and unauthorized access. *Rubric:* 3 = permission vs no permission; legal vs illegal; purpose of improvement; 2 = two; 1 = one; 0 = none. - **EX003 — Red team in plain words.** What does a red team do that a short vulnerability scan might not? *Rubric:* 3 = simulates a realistic attacker under rules; may chain findings; 2 = partial; 1 = "scans more"; 0 = none. - **EX004 — NIST SP 800-115.** What kind of document is NIST SP 800-115? *Rubric:* 3 = NIST guide to information security testing and assessment; 2 = "a standard"; 1 = wrong; 0 = none. - **EX005 — PTES stages.** Name three stages from the Penetration Testing Execution Standard. *Rubric:* 3 = three of scoping, intelligence gathering, vulnerability analysis, exploitation, post-exploitation, reporting; 2 = two; 1 = one; 0 = none. - **EX006 — TIBER-EU and CBEST.** What do TIBER-EU and CBEST have in common? *Rubric:* 3 = threat-led tests for financial sector, use intelligence, authorized; 2 = two; 1 = one; 0 = none. - **EX007 — What this course refuses.** Why does this course refuse to share exploit code? *Rubric:* 3 = dual-use / could harm real systems; learning goal is authorized defence improvement; 2 = partial; 1 = "too hard"; 0 = none. - **EX008 — Who grants permission.** Who can authorize a test of RCC's staff portal? *Rubric:* 3 = the college (owners) via signed agreement, typically business + security leads; 2 = partial; 1 = Maya alone / a friend; 0 = none. - **EX009 — Bug bounty confusion.** A public website offers a bug bounty. May Maya test it for practice? *Rubric:* 3 = only under that programme's written rules and scope; otherwise no; 2 = partial; 1 = yes freely; 0 = none. - **EX010 — Maya's role this month.** What is Maya preparing to do after the outside firm's test? *Rubric:* 3 = help review the report; understand the agreement; 2 = one; 1 = run exploits; 0 = none. - **EX011 — Lab data only.** Where do this course's lab numbers come from? *Rubric:* 3 = synthetic offline data / scripts; no live targets; 2 = partial; 1 = the internet; 0 = none. - **EX012 — ATT&CK role.** What is MITRE ATT&CK used for in this field? *Rubric:* 3 = shared names for adversary techniques; map findings / plan detection; 2 = partial; 1 = a scanner; 0 = none. - **EX013 — First rule when unsure.** What should Maya do if she is unsure whether something is in scope? *Rubric:* 3 = do not test; ask the authorizing contact / stop; 2 = ask only; 1 = try carefully; 0 = none. ### Synthesis Authorized offensive security is permissioned testing done to improve defence; frameworks guide it, and this course stays inside those rules. ### Continue studying — lesson 01 (chapter 01 of 20) [← Course home](../../README.md) · [Course chapter index](../SUBJECTS.md) · [Chapter 02 →](#ch-02) Continue to the next authored lesson. ## Worked answers **EX001.** Authorized offensive security is looking for weaknesses in systems with the owner's written permission, so the organisation can fix them. **EX002.** Authorized testing has written permission and a defined purpose of improving security; unauthorized access lacks that permission and is illegal regardless of intent. **EX003.** A red team tries to act like a real attacker within agreed rules, often chaining weaknesses and testing detection and response, not only listing known software flaws. **EX004.** It is NIST's Technical Guide to Information Security Testing and Assessment — a public guide that describes types of testing and how to plan them. **EX005.** Scoping, intelligence gathering and reporting (vulnerability analysis, exploitation and post-exploitation are also stages). **EX006.** Both are threat intelligence-led assessment frameworks used mainly for financial institutions; tests are authorized and shaped by realistic adversary intelligence. **EX007.** Exploit code can be used against real systems without permission, which is illegal and harmful; the course teaches authorized testing and reporting, which does not need attack payloads. **EX008.** Riverside Civic College itself, through people authorised to speak for the system — typically the business owner of the portal and the security lead — in a signed agreement. **EX009.** Only if she follows that programme's published rules and stays inside its scope; outside those rules she has no permission. **EX010.** Understand the signed agreement and help her team review the firm's report afterwards — not perform the offensive testing herself yet. **EX011.** From synthetic data processed by offline Python scripts; no live systems are scanned or attacked. **EX012.** It is a public knowledge base of adversary techniques with shared names, used to describe what an attacker did or might do and to plan detections. **EX013.** Stop and do not test; ask the person named in the authorization until the answer is clear.