◇ OpenCyber Academy
Technologist · Chapter 16 · English

Chapter 16 — Authorized offensive security and red team: methods II

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 16 — Authorized offensive security and red team: methods II

Lesson map

Lesson 16 published. Map, example, EX046.

flowchart TD
  N0["Learning outcomes"]
  N1["16.1 OWASP WSTG as a catalogue"]
  N2["16.2 Threat-led assurance"]
  N3["16.3 Mixing methods without mixing scopes"]
  N4["16.4 Exclusion language that works"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX046"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["16.1 OWASP WSTG as a catalogue"]
  N2["16.2 Threat-led assurance"]
  N3["16.3 Mixing methods without mixing scopes"]
  N4["16.4 Exclusion language that works"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX046"]

[Learning outcomes]
    |
    v
[16.1 OWASP WSTG as a catalogue]
    |
    v
[16.2 Threat-led assurance]
    |
    v
[16.3 Mixing methods without mixing scopes]
    |
    v
[16.4 Exclusion language that works]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX046]

Learning outcomes

You will (1) contrast web-application testing literacy (OWASP WSTG) with network-focused methods; (2) explain what threat-led frameworks (TIBER-EU, CBEST) add; (3) choose a method mix for a transit operator that is not a bank; (4) write exclusion language that survives contact with reality.

16.1 OWASP WSTG as a catalogue

The OWASP Web Security Testing Guide organises checks for web applications: configuration, identity, input handling, business logic and more. A technologist uses it as a coverage checklist for the staff portal and timetable API, not as a licence to run every check. Each selected check still needs a ROE line.

For ENG-712 Priya marks which WSTG areas were run against the staff portal and which against the timetable API, and which were deliberately left out. That record is what gives a coverage statement its meaning for readers. A report that just says the team followed WSTG cannot tell a reader whether business-logic checks on the API were done or skipped.

16.2 Threat-led assurance

TIBER-EU and CBEST describe intelligence-led exercises used especially in financial-market infrastructure. They add a threat-intelligence phase, a white-team control function and a learning-focused replay. TRT is not a bank, but borrowing the white-team and learning-review ideas improves any red-team exercise.

TIBER/CBEST ideas — intel, white team, learning replay — are borrowed cautiously for TRT. Priya does not claim CBEST compliance for a bus operator. She claims white-team reachability and purple tickets, and her slides say explicitly that borrowing these ideas does not let TRT claim bank-style compliance.

16.3 Mixing methods without mixing scopes

A single engagement can include a WSTG-informed portal review and a limited network inventory, provided both sit inside the same agreement and exclusions. Mixing in an unstated "quick look" at fare-payment systems violates the agreement even if the method is gentle.

The ENG-712 agreement holds both the portal review and the network inventory, with the same exclusions applying to each. A quiet look at a fare-payment host would still be contact with an excluded system, and the scope checker would return STOP for it. Scope creep is treated as a stop condition, never as a stretch goal for a quiet afternoon.

16.4 Exclusion language that works

"Fare-payment systems, including hosts in 192.0.2.64/27 and any hostname under fare.trt.example, are excluded from all activities." This beats "sensitive systems are out of scope", which nobody can check.

The precise version can be loaded straight into the scope checker, which can then return STOP for any address in 192.0.2.64/27 or any name under fare.trt.example. Peer review rejects vague exclusion wording because no tool and no reviewer can test against it. At kickoff, checkable exclusion strings are a gate as firm as having an emergency contact on the ROE.

Worked example

Priya proposes for next quarter: WSTG-informed configuration and identity checks on the staff portal; inventory of in-scope prefixes; a half-day purple replay of T1078 and T1133 with the SOC. Fare-payment stays excluded by prefix and by hostname pattern. The CISO accepts the mix because each piece maps to a decision.

Synthetic case. The quarterly mix is a fictional planning artefact.

Errors and limits

Name-dropping TIBER-EU without a threat-intelligence provider or white team is theatre. WSTG coverage percentages without severity context mislead boards.

Exercises

Synthesis

Pick catalogues for coverage, borrow white-team discipline from threat-led frameworks, and write exclusions a script can check.

Continue studying — chapter 16 of 30

← Chapter 15 (draft) · Course chapter index · Chapter 17 (draft) →