◇ OpenCyber Academy
Technologist · Chapter 18 · English

Chapter 18 — Authorized offensive security and red team: controls

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 18 — Authorized offensive security and red team: controls

Lesson map

Lesson 18 published. Map, example, EX052.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 Controls as answers to findings"]
  N2["18.2 Compensating controls"]
  N3["18.3 Detect and respond are controls too"]
  N4["18.4 Forbidden assurance phrases"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX052"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 Controls as answers to findings"]
  N2["18.2 Compensating controls"]
  N3["18.3 Detect and respond are controls too"]
  N4["18.4 Forbidden assurance phrases"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX052"]

[Learning outcomes]
    |
    v
[18.1 Controls as answers to findings]
    |
    v
[18.2 Compensating controls]
    |
    v
[18.3 Detect and respond are controls too]
    |
    v
[18.4 Forbidden assurance phrases]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX052]

Learning outcomes

You will (1) map common assessment findings to control families in NIST SP 800-53 and CSF 2.0 language; (2) distinguish compensating controls from missing controls; (3) write a remediation recommendation that names a control, an owner and a check; (4) avoid promising "full security".

18.1 Controls as answers to findings

A finding is a gap; a control is how the organisation closes it. NIST SP 800-53 Rev. 5 provides control families (access control, audit and accountability, identification and authentication, and many others). NIST CSF 2.0 organises outcomes into Govern, Identify, Protect, Detect, Respond and Recover. Reports that recommend "be careful" help nobody; reports that recommend "enforce MFA on all VPN paths (IA-family control); owner: identity team; check: quarterly account review" create work.

Findings map to SP 800-53 families and CSF functions in the recommendation line. F-01 points at identity controls; missed T1021 points at detect/respond work. Owners see a control verb, not only a problem.

18.2 Compensating controls

If MFA cannot yet cover a legacy path, a compensating control might be a jump host with session recording and a shorter session timeout. Document the compensation and the plan to remove it. Assessors should test whether the compensation actually works, not merely whether it is written down.

Every compensation carries an end date and a retest hook, so it cannot quietly become permanent. Assessors check that the jump host really records sessions and that the shorter timeout really ends idle sessions, rather than accepting the design document. A compensation that is never revisited turns into an accepted risk without a named approver.

18.3 Detect and respond are controls too

Purple-team work often finds that Prevent failed but Detect also failed. Recommendations then land in the Detect and Respond functions: a new alert, a runbook step, a playbook link. D3FEND offers defensive technique vocabulary that can sit beside ATT&CK IDs in a mature programme.

When ENG-712 found that both prevention and detection failed for a technique, the result was a DET ticket and a runbook step rather than advice to monitor more. D3FEND verbs make the recommendation specific enough for a detection engineer to act on and for a later exercise to retest. Each recommendation also names an owner, so it reaches someone who can act.

18.4 Forbidden assurance phrases

"Fully secure", "guaranteed", "hack-proof" and "100% coverage" are false and forbidden in TRT reports. Time-bounded, scope-bounded statements are the professional alternative.

TRT lists these phrases in the ROE appendix, so vendors cannot claim they did not know, and drafts containing them are returned until rewritten. The replacement statement for ENG-712 is bounded in time and scope, saying what was tested, in which window and within which limits. Review checks every draft for the listed phrases before the pack reaches the CISO, and a reviewer who finds one also checks the surrounding paragraph for an unbounded claim.

Worked example

For F-07 (ex-contractor VPN accounts) Priya recommends: disable the three accounts within 48 hours (Protect / access control); institute a joiner-mover-leaver review every 90 days (Govern); add a SIEM alert for VPN logins from accounts with end-dated contracts (Detect). She refuses a vendor draft that called the VPN "fully secured after remediation".

Synthetic case. The control recommendations are invented for TRT's F-07.

Errors and limits

Control catalogues are large; pick the few that match the finding. Mapping every finding to twenty controls creates noise.

Exercises

Synthesis

Name the control, the owner and the check; allow temporary compensations; never sell absolute safety.

Continue studying — chapter 18 of 30

← Chapter 17 (draft) · Course chapter index · Chapter 19 (draft) →