Chapter 20 — Authorized offensive security and red team: troubleshooting | Technologist Authorized offensive security and red team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 20 — Authorized offensive security and red team: troubleshooting

Lesson map

Lesson 20 published. Map, example, EX058.

flowchart TD
  N0["Learning outcomes"]
  N1["20.1 Sessions fail for boring reasons"]
  N2["20.2 Three fault classes"]
  N3["20.3 Go / no-go"]
  N4["20.4 Parallel incident"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX058"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["20.1 Sessions fail for boring reasons"]
  N2["20.2 Three fault classes"]
  N3["20.3 Go / no-go"]
  N4["20.4 Parallel incident"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX058"]

[Learning outcomes]
    |
    v
[20.1 Sessions fail for boring reasons]
    |
    v
[20.2 Three fault classes]
    |
    v
[20.3 Go / no-go]
    |
    v
[20.4 Parallel incident]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX058]

Learning outcomes

You will (1) build a fault tree for a failed assessment session; (2) separate tooling faults, scope faults and environment faults; (3) write a go/no-go note after a mid-window incident; (4) keep troubleshooting notes as engagement evidence.

20.1 Sessions fail for boring reasons

DNS drift, an expired tester certificate, a SIEM collector down, a white-team phone on silent, a scope sheet with a typo — these stop work more often than exotic problems. A fault tree starts with "session cannot proceed" and branches into authorization, connectivity, tooling and safety.

Priya gives these ordinary faults the first thirty minutes of any stuck ENG-712 session: she checks that names still resolve to approved addresses, that tester certificates are valid, that the SIEM collector is receiving and that the white-team phone rings. Only when all four are healthy does the team look for anything unusual. Most stuck sessions end at the first or second check.

20.2 Three fault classes

Scope faults: the target is no longer approved. Tooling faults: the checker or scanner misbehaves. Environment faults: the client's system is unstable or an incident is already in progress. Mis-classifying an environment fault as a tooling fault leads to "trying again" when the right move is to stop.

Each class has a different owner: scope faults go to the white team, tooling faults to Northpoint's own kit lead and environment faults to TRT operations. Priya's go/no-go note names the class so that the right person is paged. Filing an environment fault as a tooling fault would have Northpoint retrying against a system that operations is trying to stabilise.

20.3 Go / no-go

After any unexpected event — a crash, a complaint, a SIEM outage — the team writes a short go/no-go note: what happened, which fault class, who was informed, decision, signature/time. No-go is a professional outcome.

During a SIEM outage, for example, the team pauses traffic and writes the note before sending anything more, because activity the SOC cannot see produces noise without evidence value. The note records the timestamp of the last technique that was observed normally. That timestamp keeps the purple-team counts honest when the session resumes.

20.4 Parallel incident

If TRT's SOC is already handling a real incident, assessment activity that adds noise is usually suspended. NIST SP 800-61 Rev. 3 discusses incident response coordination; assessment teams must know how to stand down.

Priya's ROE for ENG-712 states the suspension path explicitly, including who tells Northpoint to stand down and who later says it may resume. The path is rehearsed in studio with a fake SOC page before the live engagement. Adding assessment noise while analysts work a real incident would compete for the attention the incident needs.

Worked example

At 23:10 the timetable API starts timing out. Northpoint's inventory tool is blamed first. Priya's fault tree asks whether any other client reported the outage — yes, the NOC did, before the scan rate increased. Classification: environment fault (pre-existing fragility). Decision: no-go for active checks; continue with document review only after white-team approval.

Synthetic case. The 23:10 timeout and NOC report are invented.

Errors and limits

Troubleshooting notes that blame people rather than systems poison purple-team trust. Do not hide a no-go from the report's limitations page.

Exercises

EX058 — Classify. A tester laptop clock is wrong, so the ROE checker marks every action outside the window. Fault class and first fix? Rubric: 3 = tooling (or local environment of tester); fix clock/NTP; re-run checker; 2 = class only; 1 = scope fault; 0 = none.
EX059 — Stand down. SOC declares an active ransomware investigation (synthetic). What does the assessment team do? Rubric: 3 = suspend noisy activity; notify white team; wait for written resume; 2 = pause vaguely; 1 = continue quietly; 0 = none.
EX060 — Go/no-go fields. List five fields a go/no-go note should contain. Rubric: 3 = five of event/time/class/informees/decision/signature; 2 = three; 1 = one; 0 = none.

Synthesis

Tree first, classify second, write the decision, and stand down when the organisation is already fighting a fire.

Continue studying — chapter 20 of 30

← Chapter 19 (draft) · Course chapter index · Chapter 21 (draft) →