◇ OpenCyber Academy
Rapid course · Chapter 1 · English

Chapter 1 — What authorized offensive security is

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 1 — What authorized offensive security is

Lesson map

Lesson 01 published. Map, example, EX001.

flowchart TD
  N0["Learning outcomes"]
  N1["1.1 Authorized testing, not hacking for thrills"]
  N2["1.2 Why organisations pay for it"]
  N3["1.3 What this course will not teach"]
  N4["1.4 Who says yes"]
  N5["1.5 Shared language for techniques"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX001"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["1.1 Authorized testing, not hacking for thrills"]
  N2["1.2 Why organisations pay for it"]
  N3["1.3 What this course will not teach"]
  N4["1.4 Who says yes"]
  N5["1.5 Shared language for techniques"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX001"]

[Learning outcomes]
    |
    v
[1.1 Authorized testing, not hacking for thrills]
    |
    v
[1.2 Why organisations pay for it]
    |
    v
[1.3 What this course will not teach]
    |
    v
[1.4 Who says yes]
    |
    v
[1.5 Shared language for techniques]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX001]

Learning outcomes

You will (1) define authorized offensive security and red teaming; (2) explain how they differ from crime and from everyday IT work; (3) name the main public frameworks that guide them; and (4) describe who decides when testing is allowed.

1.1 Authorized testing, not hacking for thrills

Authorized offensive security means looking for weaknesses in systems with the owner's written permission, for the purpose of making them safer. A red team is a group that simulates a realistic attacker under those same rules. Both are jobs done for a client or for one's own organisation. Breaking into systems without permission is a crime, even if you plan to tell someone afterwards. This course teaches how authorized testing is planned, limited and reported — never how to attack systems you do not own.

1.2 Why organisations pay for it

Defenders need to know what an attacker could actually do, not only what a checklist says. NIST SP 800-115 describes several kinds of security testing and assessment, from reviews to technical tests. The Penetration Testing Execution Standard (PTES) organises a pentest into stages such as scoping, intelligence gathering, vulnerability analysis, exploitation, post-exploitation and reporting. Threat-led programmes such as TIBER-EU and CBEST use intelligence to make the test look like a real adversary against financial institutions.

For Riverside Civic College, the value is practical: the outside firm's test of the staff portal will show whether a real attacker could misuse it, and Maya's team will use the report to decide which fixes come first.

1.3 What this course will not teach

You will not be given exploit code, payloads or step-by-step attack procedures for real products. Labs use synthetic data and offline scripts. You will learn to check scope, keep evidence, write findings and stay inside the rules.

Instead, the labs are short Python scripts that read local, invented data, such as a target list and four draft findings for Riverside Civic College. You will practise the decisions that keep testing safe and useful: what may be touched, what must be left alone, how serious a finding is and how to tell the people who must act. Those skills are needed before any technical testing is allowed.

1.4 Who says yes

Permission comes from someone who owns or is authorised to speak for the system — often a business owner and a security lead, recorded in a signed document. Your manager, a friend or a public website's "report a bug" page is not enough unless the written rules say so. When in doubt, do not test.

At Riverside Civic College, the staff portal test is allowed because the college's portal owner and IT security lead have signed an agreement with the outside firm. Maya's manager cannot add systems to that agreement by asking, and neither can Maya. A bug bounty page counts only for its own published scope and rules. If a system's owner is unclear, find out who it is before anything is tested.

1.5 Shared language for techniques

MITRE ATT&CK gives public names for adversary techniques, such as T1078 Valid Accounts. Testers and defenders use those names so a finding and a detection rule describe the same behaviour.

For example, a grading system where several staff share one admin login relates to T1078 Valid Accounts, because anyone with the password acts as a legitimate user and nobody can tell who did what. Maya will use this name in Chapter 3. A name does not score the finding or prove an attack happened; it gives testers and defenders a common reference, so a detection team can look up the technique and check whether they would notice it.

Worked example (synthetic RCC)

Maya Chen joins Riverside Civic College's IT security team as a trainee. Her manager explains that next month an outside firm will test the college's staff portal under a signed agreement. Maya's job this month is to learn what that agreement means and how the college will prepare, so she can help review the report afterwards.

Synthetic case — Riverside Civic College (RCC). The college, Maya Chen, systems and all figures in this book are invented for teaching.

Errors and limits

Framework names and editions change; check the current published versions before citing them in real work. This book grants no authority to test any real system.

Exercises

Synthesis

Authorized offensive security is permissioned testing done to improve defence; frameworks guide it, and this course stays inside those rules.

Continue studying — chapter 01 of 04

← Course home · Course chapter index · Chapter 02 (draft) →