Chapter 10 — Authorized offensive security and red team: orientation
Lesson map
Lesson 10 published. Map, example, EX028.
flowchart TD
N0["Learning outcomes"]
N1["10.1 A life cycle, not a tool list"]
N2["10.2 Permission is written"]
N3["10.3 Red, blue and purple"]
N4["10.4 What this book will not do"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX028"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 A life cycle, not a tool list"]
N2["10.2 Permission is written"]
N3["10.3 Red, blue and purple"]
N4["10.4 What this book will not do"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX028"]
[Learning outcomes]
|
v
[10.1 A life cycle, not a tool list]
|
v
[10.2 Permission is written]
|
v
[10.3 Red, blue and purple]
|
v
[10.4 What this book will not do]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX028]
Learning outcomes
You will (1) place vulnerability assessment, penetration testing and red teaming on a single life cycle; (2) name the documents that create permission; (3) explain the roles of red, blue and purple teams; (4) state the educational boundary of this book in your own words.
10.1 A life cycle, not a tool list
Authorized practice moves through governance and scoping, rules of engagement, execution within those rules, evidence handling, risk rating, reporting, remediation and validation. Tool names change; the life cycle does not. NIST SP 800-115 and PTES both organise work this way, even though their part titles differ.
Priya teaches the path from governance through scope, ROE, execution, evidence, rating and reporting to retest. In training runs, students who skipped straight to scanners produced a STOP for fare-system interaction. Northpoint is graded on how well it followed the life cycle before anyone looks at how clever its findings were.
10.2 Permission is written
Permission comes from a signed agreement that names the parties, the systems, the methods, the window, the exclusions, the data-handling rules, the emergency contact and the report audience. Verbal "go ahead" is not enough. Chapter 11 turns that agreement into checkable scope and ROE objects.
ENG-712's signed pack names the parties, systems, methods, window, exclusions, retention period, emergency contact and white-team phone number. An empty emergency contact cancels the Saturday start, exactly as the ROE labs teach. Retention and the white-team phone are checked in the same pass, because each one is needed before any activity begins.
10.3 Red, blue and purple
The red team (or testing provider) exercises adversary behaviours under authorization. The blue team (SOC and defenders) detects and responds. Purple teaming is structured collaboration: red announces or reveals techniques in a controlled way so blue can improve detection, with learning as the goal rather than a pure "gotcha". TIBER-EU and CBEST add a threat-intelligence-led layer used in financial-sector assurance; technologists should recognise those names even when their organisation is not a bank.
Red (Northpoint) exercises behaviours; blue (TRT SOC) detects; purple replays misses into DET-19 and DET-20. Priya refuses engagements that omit a reachable white team. Learning is a deliverable, not a soft extra.
10.4 What this book will not do
It will not provide exploit code, payloads or step-by-step attack procedures. It will not authorize anyone to test a real system. It teaches governance, evidence, measurement and remediation validation on synthetic data so that when a learner later joins a real team, the discipline is already in place.
No exploit code, no live authorization, no fare "just this once". Chapter 10's boundary is what Priya quotes when a panel asks for T1552.001 steps — she points at ATT&CK and stops. The refusal is practised in panel drills, not left as theory.
Worked example
TRT's CISO asks whether they "need a red team". Priya asks which decision the result will support. The CISO wants to know whether the SOC would notice a realistic intruder. That is a purple-capable red-team question, not a vulnerability scan. Priya proposes a scoped exercise with a white-team stop authority, a written ROE and a learning review — and notes that fare-payment stays excluded.
Synthetic case. The CISO conversation is invented for orientation.
Errors and limits
Buying a "red team" product that is actually a scan wastes money and creates false assurance. Framework names on a slide are not the same as following their phases.
Exercises
- EX028 — Decision first. Rewrite the CISO's need as a one-sentence assessment objective. Rubric: 3 = objective about SOC detection of a realistic intruder under a scoped exercise; 2 = vague objective; 1 = "run tools"; 0 = none.
- EX029 — Document list. Name five fields a signed agreement must contain before testing starts. Rubric: 3 = five from scope/exclusions/methods/window/emergency contact/data handling/report audience/parties; 2 = three; 1 = one; 0 = none.
- EX030 — Purple goal. In one sentence, what makes an exercise "purple" rather than purely competitive red-versus-blue? Rubric: 3 = structured collaboration aimed at improving detection/response, not only scoring a breach; 2 = collaboration mentioned; 1 = more tools; 0 = none.
Synthesis
Start from the decision, write the permission, know the roles, and keep this curriculum on the defensive side of the line.
Continue studying — chapter 10 of 30
← Chapter 09 (draft) · Course chapter index · Chapter 11 (draft) →