Chapter 13 — Authorized offensive security and red team: risk scenarios
Lesson map
Lesson 13 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["13.1 Transparent rating"]
N2["13.2 Scenarios connect the dots"]
N3["13.3 Severity versus urgency"]
N4["Lab E — finding scorer"]
N5["13.4 NIST language"]
N6["13.5 Communicating scores upward"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["13.1 Transparent rating"]
N2["13.2 Scenarios connect the dots"]
N3["13.3 Severity versus urgency"]
N4["Lab E — finding scorer"]
N5["13.4 NIST language"]
N6["13.5 Communicating scores upward"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX037"]
[Learning outcomes]
|
v
[13.1 Transparent rating]
|
v
[13.2 Scenarios connect the dots]
|
v
[13.3 Severity versus urgency]
|
v
[Lab E — finding scorer]
|
v
[13.4 NIST language]
|
v
[13.5 Communicating scores upward]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) rate findings with a transparent likelihood × impact matrix; (2) sort a finding list for remediation order; (3) write a short risk scenario that ties asset, technique and consequence; (4) separate severity of a weakness from urgency of a ticket.
13.1 Transparent rating
A 1–5 likelihood and 1–5 impact scale, multiplied, gives a score that anyone can recompute. Bands such as critical ≥ 20, high ≥ 12, medium ≥ 6, low ≥ 0 turn scores into language managers recognise. Document the scale in the report so readers are not guessing.
F-09 shows the arithmetic: likelihood 4 times impact 5 gives 20, which falls in the critical band. Priya prints that calculation in the report appendix so a director can recompute it in seconds. A score that cannot be recomputed invites argument about the tester's judgement instead of discussion of the risk, and review rejects it.
13.2 Scenarios connect the dots
"Shared admin account on the staff portal" is a weakness. The scenario adds: an adversary using T1078 Valid Accounts could alter public timetables (integrity) and lock out operators (availability). Scenarios make impact scores defensible.
In ENG-712 this sentence sits under F-01, linking the shared admin account to T1078 and to the integrity of public timetables. That link explains why the CISO should care before the weekend service change rather than after it. High findings without a scenario sentence are rewritten before the report builder produces the executive table.
13.3 Severity versus urgency
A critical finding on a decommissioned staging host may be low urgency. A medium finding on a system under active attack may be high urgency. Tickets carry both fields; collapsing them into one number loses information.
Priya runs a weekly triage sort with owners that orders tickets by urgency first. A medium finding on a system being actively abused can therefore move ahead of a critical one on a staging host that is about to be switched off. Owners see both values on the ticket, so the order is explained rather than mysterious.
Lab E — finding scorer
"""Lab E (ch 13): rate synthetic findings with a 1-5 likelihood x impact matrix and sort them."""
BANDS = [(20, "critical"), (12, "high"), (6, "medium"), (0, "low")]
findings = [
("F-01", "shared admin account on staff portal", 4, 4),
("F-04", "verbose error page on timetable API", 3, 1),
("F-07", "unreviewed VPN accounts of ex-contractors", 3, 5),
("F-09", "wiki page with plaintext service password", 4, 5),
]
def band(s):
return next(name for floor, name in BANDS if s >= floor)
for fid, title, lik, imp in sorted(findings, key=lambda f: -(f[2] * f[3])):
s = lik * imp
print(f"{fid} L{lik} x I{imp} = {s:2d} {band(s):8} {title}")
Run with python3 lab_score.py. Verified output:
F-09 L4 x I5 = 20 critical wiki page with plaintext service password
F-01 L4 x I4 = 16 high shared admin account on staff portal
F-07 L3 x I5 = 15 high unreviewed VPN accounts of ex-contractors
F-04 L3 x I1 = 3 low verbose error page on timetable API
13.4 NIST language
NIST SP 800-30 Rev. 1 describes risk as a function of threat, vulnerability and impact (among other framings). The classroom matrix is a simplification for ordering work, not a full enterprise risk assessment.
Priya puts the citation to SP 800-30 under the matrix figure, labelling the 1 to 5 scale as a classroom simplification of its ideas. Examiners can then see where the approach comes from and what it leaves out, such as threat-source analysis. Nobody reading the report should think TRT has invented its own theory of risk.
13.5 Communicating scores upward
When Priya presents the ordered list, she spends more time on the top two scenarios than on the low finding. Boards can absorb a handful of well-narrated risks; they cannot absorb a spreadsheet dump. She keeps the full table in an appendix for auditors and puts three sentences in the executive summary: what matters, why, and what decision she needs this week. In ENG-712's oral summary F-09 and F-01 lead, while the low verbose-error finding gets a single line.
Worked example
Four TRT findings enter the scorer. The wiki plaintext password (T1552.001 Credentials In Files) tops the list at 20 critical. The verbose timetable error page scores 3 low. Priya presents the ordered list to the remediation board with one-sentence scenarios attached.
Synthetic case. The four findings and their scores are invented.
Errors and limits
Do not invent likelihood numbers without a reason. CVSS (see FIRST CVSS v4.0) scores vulnerabilities; organisational risk also needs context the matrix must state.
Exercises
- EX037 — Top of list. Which finding does the lab rank first, and what is its band? Rubric: 3 = F-09 critical (score 20); 2 = F-09 only; 1 = wrong finding; 0 = none.
- EX038 — Scenario sentence. Write a one-sentence risk scenario for F-07 (ex-contractor VPN accounts). Rubric: 3 = asset + technique/actor path + consequence to CIA; 2 = two of three; 1 = restates title; 0 = none.
- EX039 — Urgency split. F-04 is low severity on a production API that is currently being probed from the internet. What urgency do you assign and why? Rubric: 3 = raised urgency despite low severity because of active probing; 2 = raised without reason; 1 = ignore probing; 0 = none.
Synthesis
Score transparently, narrate the scenario, and keep severity and urgency as separate dials.
Continue studying — chapter 13 of 30
← Chapter 12 (draft) · Course chapter index · Chapter 14 (draft) →