Chapter 4 — Guided synthesis: plan, check, report
Lesson map
Lesson 04 published. Map, example, EX039.
flowchart TD
N0["Learning outcomes"]
N1["4.1 The classroom engagement"]
N2["4.2 Ranking for the summary"]
N3["4.3 Writing the page"]
N4["4.4 Pressure scenarios"]
N5["4.5 After the course"]
N6["4.6 Recording the exercise"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX039"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 The classroom engagement"]
N2["4.2 Ranking for the summary"]
N3["4.3 Writing the page"]
N4["4.4 Pressure scenarios"]
N5["4.5 After the course"]
N6["4.6 Recording the exercise"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX039"]
[Learning outcomes]
|
v
[4.1 The classroom engagement]
|
v
[4.2 Ranking for the summary]
|
v
[4.3 Writing the page]
|
v
[4.4 Pressure scenarios]
|
v
[4.5 After the course]
|
v
[4.6 Recording the exercise]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX039]
Learning outcomes
You will (1) combine scope checking and finding ranking into one short exercise; (2) produce a one-page report for RCC; (3) apply stop rules under pressure; and (4) state your next learning step.
4.1 The classroom engagement
Maya is given a synthetic engagement pack: a one-page authorization for documentation addresses in 192.0.2.0/25, an exclusion of 192.0.2.10, a list of four draft findings from a policy and configuration review (no live exploitation), and a request for a one-page summary for the IT director.
Before starting, Maya runs the scope check on any address mentioned in the pack, and confirms that her work is limited to the review the authorization permits. The four findings cover reused portal passwords, an old web server banner, a shared grading admin account and guest Wi-Fi reaching a printer admin page. Her output is a ranked list and a one-page summary for the IT director, with evidence attached.
4.2 Ranking for the summary
Not every finding fits the first page. Ranking by likelihood × impact puts the issues that most need decisions first.
"""Lab 4: rank synthetic findings by likelihood x impact (1-3 each) for the report summary."""
findings = [("F1", "Staff portal allows reused passwords", 3, 2),
("F2", "Old web server banner shows version", 2, 1),
("F3", "Shared admin account on grading system", 2, 3),
("F4", "Guest Wi-Fi reaches printer admin page", 2, 2)]
for fid, title, lik, imp in sorted(findings, key=lambda f: (-f[2] * f[3], f[0])):
score = lik * imp
band = "high" if score >= 6 else "medium" if score >= 4 else "low"
print(f"{fid} score={score} {band:6} {title}")
Run with python3 lab_findings.py. Verified output:
F1 score=6 high Staff portal allows reused passwords
F3 score=6 high Shared admin account on grading system
F4 score=4 medium Guest Wi-Fi reaches printer admin page
F2 score=2 low Old web server banner shows version
The script multiplies likelihood by impact, sorts by score and breaks ties by finding id. F1 and F3 both score 6 and are high; F4 scores 4 and is medium; F2 scores 2 and is low. The first page gives F1 and F3 most space, and F2 can sit in the attachment, since a version banner alone rarely enables much harm.
4.3 Writing the page
The summary states the authorization, the window, how testing was limited (configuration and policy review only), the top findings with scores, and the decisions needed. Detail sits in an attachment.
Maya's page states that the work covered 192.0.2.0/25 except 192.0.2.10, that it was a configuration and policy review with no live exploitation, and that F1 and F3 scored highest. It asks the director to approve named grading accounts and a password-reuse control for the portal within thirty days. Full write-ups, evidence and reproduction steps go in the attachment.
4.4 Pressure scenarios
During the exercise a classmate asks Maya to add their blog to the target list, and a draft finding mentions a medical clinic server that is not in the college scope. She refuses the blog and removes the clinic server note as out of scope.
The blog is a personal system outside the college's agreement, and the clinic server belongs to another owner, so even listing it as a target would be improper. Maya records both decisions in her notes. If the portal test page becomes slow during a permitted check, she pauses, calls the emergency contact and records the time.
4.5 After the course
The next course in this curriculum is about AI security. Longer red-team courses deepen scoping, methods, tooling, reporting and threat-led testing. Keep a record of exercises completed.
This course gives no authority to test real systems. Before any real engagement you will need further training, supervised practice and, above all, a signed agreement from the system's owner. Maya's next step is to help her team review the outside firm's staff portal report, using the scope, evidence and severity skills from this course.
4.6 Recording the exercise
Maya files the one-pager, the ranked list, the scope-check output and a note of the two refused requests. That packet is what her manager reviews, and it becomes her evidence that the classroom engagement stayed inside the rules.
A reviewer should be able to trace each finding on the page back to its evidence, and each address back to the scope-check output. If something is missing, Maya adds it before filing. Keep the packet only for as long as the agreement allows, and store it where only her manager and the team can read it.
Worked example (synthetic)
Maya's ranked list puts F1 (reused portal passwords) and F3 (shared grading admin) first with score 6, then F4 (guest Wi-Fi to printer admin) at 4, then F2 (banner) at 2. Her one-pager asks the director to approve named accounts for grading and a password-reuse control for the portal within thirty days. She notes that no live exploitation was performed.
Synthetic case — RCC. Findings and scores are invented.
Errors and limits
A classroom ranking is not a full professional report. Real engagements need the complete authorization trail and technical detail.
Exercises
- EX039 — Authorization one-liner. Write the authorization sentence Maya puts at the top of the page. Rubric: 3 = who authorized, what scope, what methods, what window; 2 = three; 1 = one; 0 = none.
- EX040 — Why F2 is last. Why does the banner finding rank below password reuse? Rubric: 3 = lower likelihood×impact; less harm than credential issues; 2 = partial; 1 = banners always first; 0 = none.
- EX041 — Lab reorder. If F4's impact rises to 3, what new order does the lab print? Rubric: 3 = F4 rises from 4 to 6 (2 × 3), so F1, F3 and F4 all score 6 and are sorted by id, then F2; 2 = partial; 1 = same; 0 = none.
- EX042 — Blog request again. Under time pressure the classmate repeats the blog ask. Maya's answer? Rubric: 3 = still refuse; no written authorization; 2 = refuse; 1 = quick scan; 0 = agree.
- EX043 — Clinic server note. Why remove the medical clinic server from the draft? Rubric: 3 = out of college scope / authorization; possible separate legal duties; 2 = partial; 1 = keep it; 0 = none.
- EX044 — Decision request. What decision does Maya ask of the IT director? Rubric: 3 = approve named grading accounts and portal password-reuse control within 30 days; 2 = partial; 1 = "fix security"; 0 = none.
- EX045 — Methods limitation. Why must the summary say "no live exploitation"? Rubric: 3 = honest about methods; reader must not think systems were attacked; matches authorization; 2 = partial; 1 = hide it; 0 = none.
- EX046 — Evidence attachment. What goes in the attachment rather than the one-pager? Rubric: 3 = detailed reproduction, screenshots/logs, full finding text; 2 = partial; 1 = vague; 0 = none.
- EX047 — Stop during synthesis. The portal test page becomes slow during a permitted check. What does Maya do? Rubric: 3 = stop / pause; contact emergency contact; record time; 2 = partial; 1 = continue; 0 = none.
- EX048 — CVSS mention. When might Maya mention CVSS in a beginner report? Rubric: 3 = if the organisation uses it and scores are agreed; else keep simple scale; 2 = partial; 1 = always invent scores; 0 = none.
- EX049 — Next course. What does the next course in the curriculum cover? Rubric: 3 = AI security (course 020); 2 = vague; 1 = wrong; 0 = none.
- EX050 — Personal limit. State one thing Maya still must not do after this course. Rubric: 3 = test systems without written authorization / use exploits on real targets; 2 = partial; 1 = anything; 0 = none.
Synthesis
A short authorized engagement checks scope, ranks real findings and asks for clear decisions — without crossing the rules.
Continue studying — chapter 04 of 04
← Chapter 03 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →