Chapter 15 — Authorized offensive security and red team: guided lab
Lesson map
Lesson 15 published. Map, example, EX043.
flowchart TD
N0["Learning outcomes"]
N1["15.1 Three gates"]
N2["15.2 The operator log"]
N3["Lab F — guided pipeline"]
N4["15.3 HOLD is a feature"]
N5["15.4 Reviewer use"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX043"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["15.1 Three gates"]
N2["15.2 The operator log"]
N3["Lab F — guided pipeline"]
N4["15.3 HOLD is a feature"]
N5["15.4 Reviewer use"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX043"]
[Learning outcomes]
|
v
[15.1 Three gates]
|
v
[15.2 The operator log]
|
v
[Lab F — guided pipeline]
|
v
[15.3 HOLD is a feature]
|
v
[15.4 Reviewer use]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX043]
Learning outcomes
You will (1) run a three-gate pipeline that admits an action only when target, time and activity all pass; (2) maintain an operator log of admitted actions; (3) explain why a HOLD is a success, not a failure; (4) hand the log to a reviewer as evidence of discipline.
15.1 Three gates
Every planned action has a target address, a timestamp and an activity name. The target must sit in the in-scope prefix, the timestamp inside the window, and the activity on the approved list. Fail any gate and the action does not proceed.
In the Lab F output A2 is held on the activity gate and A3 on the target gate, so neither reaches the operator log. Priya screenshots both HOLD lines into the training notes, because for ENG-712 the gates are the product and improvisation is the defect.
15.2 The operator log
Only actions that pass all three gates are written to the operator log. The log is evidence that the team stayed inside the agreement. A log full of improvisation is a finding against the testing team itself.
In the lab only A1 and A4 pass all three gates, so they are the only entries in the operator log. Priya reviews the log before the CISO session and compares it with the chat history. Any action that appears in chat but not in the log is a shadow action and becomes a process finding against Northpoint.
Lab F — guided pipeline
"""Lab F (ch 15): guided pipeline - an action is logged only if target, time and activity all pass."""
import ipaddress
from datetime import datetime
scope = ipaddress.ip_network("192.0.2.0/25")
window = (datetime(2026, 11, 3, 22, 0), datetime(2026, 11, 4, 5, 0))
approved = {"service inventory", "authentication review", "configuration review"}
actions = [
("A1", "192.0.2.12", "2026-11-03 22:15", "service inventory"),
("A2", "192.0.2.12", "2026-11-03 22:40", "password spraying"),
("A3", "192.0.2.140", "2026-11-03 23:05", "configuration review"),
("A4", "192.0.2.30", "2026-11-04 01:20", "authentication review"),
]
log = []
for aid, ip, when, act in actions:
checks = {
"target": ipaddress.ip_address(ip) in scope,
"time": window[0] <= datetime.strptime(when, "%Y-%m-%d %H:%M") <= window[1],
"activity": act in approved,
}
failed = [k for k, ok in checks.items() if not ok]
print(aid, "PROCEED" if not failed else "HOLD (" + ",".join(failed) + ")")
if not failed:
log.append(aid)
print("operator log entries:", log)
Run with python3 lab_pipeline.py. Verified output:
A1 PROCEED
A2 HOLD (activity)
A3 HOLD (target)
A4 PROCEED
operator log entries: ['A1', 'A4']
15.3 HOLD is a feature
A2 is held because "password spraying" is not an approved activity. A3 is held because the target is outside the /25. Those HOLDs protect TRT and Northpoint. Celebrating a HOLD in the debrief teaches juniors that restraint is professional.
Debriefs give HOLDs and fare-payment STOPs the same recognition as findings. Studio grades award points for documented HOLDs that prevented out-of-scope or out-of-window work. Juniors who hide a HOLD to look productive fail the studio grade, because hiding it removes the evidence that the gates worked.
15.4 Reviewer use
A reviewer should be able to replay the gates against the log. If an entry appears that would not pass, the engagement has a process failure regardless of whether anything "interesting" was found.
Peer review of ENG-712 training packs includes running the gate checks again on every log entry. If an entry would have been held, the engagement records a process failure even when the related finding looks impressive. Process is graded beside findings, so a strong result cannot hide a log the gates would have rejected.
Worked example
Four candidate actions enter the pipeline. A1 and A4 proceed; A2 and A3 hold. The operator log contains only ['A1', 'A4']. Priya attaches that printout to the engagement records before the night shift ends.
Synthetic case. The four actions and the pipeline results are invented for the guided lab.
Errors and limits
The pipeline does not replace human judgement about fragility or ongoing incidents; it only enforces the three hard gates. Soft concerns still need a person.
Exercises
- EX043 — Hold reasons. Why do A2 and A3 hold, according to the lab? Rubric: 3 = A2 activity not approved; A3 target out of scope; 2 = one correct; 1 = both proceed; 0 = none.
- EX044 — Log contents. What does the operator log contain after the run, and why is that list evidence? Rubric: 3 = ['A1','A4']; proves only gated actions were performed; 2 = names list; 1 = includes holds; 0 = none.
- EX045 — Soft concern. The timetable API is fragile but A4's target and activity are allowed. What extra step should a human take? Rubric: 3 = apply ROE throttle/fragility note or switch method; confirm with white team if unsure; 2 = vague caution; 1 = ignore; 0 = none.
Synthesis
Three hard gates, a log of only what passed, and human judgement still applied on top.
Continue studying — chapter 15 of 30
← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →