Chapter 14 — Authorized offensive security and red team: methods I | Technologist Authorized offensive security and red team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 14 published. Map, example, EX040.

flowchart TD
  N0["Learning outcomes"]
  N1["14.1 Two maps of the same journey"]
  N2["14.2 Review before validation"]
  N3["14.3 Method statements"]
  N4["14.4 ATT&CK at ID level"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX040"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["14.1 Two maps of the same journey"]
  N2["14.2 Review before validation"]
  N3["14.3 Method statements"]
  N4["14.4 ATT&CK at ID level"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX040"]

[Learning outcomes]
    |
    v
[14.1 Two maps of the same journey]
    |
    v
[14.2 Review before validation]
    |
    v
[14.3 Method statements]
    |
    v
[14.4 ATT&CK at ID level]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX040]

Learning outcomes

You will (1) map engagement phases to NIST SP 800-115 and PTES; (2) choose review versus validation techniques based on risk; (3) write a method statement that a ROE can quote; (4) keep technique descriptions at the ATT&CK ID level without operational detail.

14.1 Two maps of the same journey

NIST SP 800-115 groups techniques into review, target identification and analysis, and target vulnerability validation, wrapped by planning and post-testing activities. PTES names pre-engagement, intelligence gathering, threat modelling, vulnerability analysis, exploitation, post-exploitation and reporting. A technologist does not need to memorise every subsection; they need to place each planned activity in a phase and know which document the client prefers.

SP 800-115 and PTES name stages; Priya maps ENG-712 activities onto both so Northpoint and auditors share vocabulary. Threat-led extras sit on top of scoping discipline, not instead of it.

14.2 Review before validation

Configuration review, document review and log review often answer the question with less operational risk than active validation. Use validation when the decision truly needs confirmation that a weakness is reachable under the agreed limits — and only then.

For the staff portal, reviewing the authentication configuration answered the MFA question with far less risk than any password experiment. Active validation is kept for cases where the CISO's decision depends on proof that a weakness can actually be reached under the ROE. A request for such validation needs a one-line decision statement before any active check runs.

14.3 Method statements

A method statement is a short, non-procedural description: "External service inventory of in-scope prefixes using approved scanners at agreed rates; authentication configuration review of the staff portal; no denial-of-service, no fare-system interaction, no social engineering." It belongs in the ROE.

ENG-712's statement stays at that level: inventory at agreed rates, review of portal authentication, and the three exclusions. Step-by-step exploit instructions belong neither in this book nor in the engagement deliverables. On the peer rubric, any dual-use detail in a method statement fails the safety criterion however complete the rest of the package is.

14.4 ATT&CK at ID level

Refer to behaviours as T1595 Active Scanning, T1046 Network Service Discovery, T1078 Valid Accounts. Do not expand them into how-to steps. Defenders can open the ATT&CK pages; attackers do not need this book.

Every deliverable links to the ATT&CK technique pages instead of pasting procedure text. Expanding these identifiers into recipes would break the educational boundary set in Chapter 10. A defender who needs more detail can follow the link, and the report stays useful to the SOC without becoming a manual for an attacker.

Worked example

Priya drafts the method statement for TRT's November window. Planning and ROE cite SP 800-115 planning controls. Execution lists inventory (identification) and authentication review (validation of a control's effectiveness). Reporting and remediation validation close the loop. The statement never describes how to bypass authentication.

Synthetic case. The November method statement is invented for TRT.

Errors and limits

Copying a method list from a vendor datasheet without matching it to scope produces unauthorized activity. "Exploitation" in PTES is a phase name, not a licence for uncontrolled attacks.

Exercises

EX040 — Phase placement. Place "authentication configuration review of the staff portal" into an SP 800-115 technique family and a PTES phase.
Show marking criteria
Rubric: 3 = review or validation (SP) + vulnerability analysis or equivalent PTES phase, with brief reason; 2 = one correct; 1 = wrong; 0 = none.
EX041 — Method sentence. Write a one-sentence method statement for inventory of TRT's in-scope prefixes that includes a hard limit.
Show marking criteria
Rubric: 3 = inventory + in-scope only + rate/window/exclusion limit; 2 = inventory only; 1 = unlimited scan; 0 = none.
EX042 — ID only. Why does the book cite T1046 by ID rather than describing scanning steps?
Show marking criteria
Rubric: 3 = defensive mapping without teaching attack procedures; 2 = brevity; 1 = because steps are secret; 0 = none.

Synthesis

Name the phase, prefer review when it answers, write the method as limits plus intent, and stop at the technique ID.

Continue studying — chapter 14 of 30

← Chapter 13 (draft) · Course chapter index · Chapter 15 (draft) →