Chapter 21 — Authorized offensive security and red team: service integration | Technologist Authorized offensive security and red team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 21 published. Map, example, EX061.

flowchart TD
  N0["Learning outcomes"]
  N1["21.1 Assessment as a service"]
  N2["21.2 Interfaces and SLAs"]
  N3["21.3 One risk tracker"]
  N4["21.4 Shadow IT"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX061"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["21.1 Assessment as a service"]
  N2["21.2 Interfaces and SLAs"]
  N3["21.3 One risk tracker"]
  N4["21.4 Shadow IT"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX061"]

[Learning outcomes]
    |
    v
[21.1 Assessment as a service]
    |
    v
[21.2 Interfaces and SLAs]
    |
    v
[21.3 One risk tracker]
    |
    v
[21.4 Shadow IT]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX061]

Learning outcomes

You will (1) place the assessment service among identity, logging, ticketing and change-management services; (2) define hand-off interfaces with owners and SLAs; (3) explain why assessment findings must enter the same tracker as other risks; (4) avoid shadow IT for evidence and tickets.

21.1 Assessment as a service

An authorized assessment capability is a service with inputs (requests, agreements), processes (scoped execution) and outputs (findings, reports, retest results). It depends on identity (who may approve), logging (where evidence of activity goes), ticketing (where findings live) and change management (when fixes roll out). Drawing those dependencies prevents the assessment team from inventing parallel tools that nobody else watches.

Treating the work as a service changes what Priya measures. Alongside critical counts she tracks queue time from a stop call to white-team acknowledgement and the rate at which findings reopen after retest. A provider with many criticals but slow acknowledgements and frequent reopens may serve TRT worse than a quieter one.

21.2 Interfaces and SLAs

Each interface needs an owner and a response expectation: white-team acknowledgement within fifteen minutes of a stop call; remediation ticket acknowledgement within two business days; evidence repository access revoked within one day of engagement close. SLAs without owners are decorations.

For ENG-712 these expectations are written into the agreement, each with a named owner, and Priya tracks them during the engagement. A missed acknowledgement appears as process debt on the signed evaluation sheet. An interface without an owner tends to become a place where stop calls and tickets go unanswered.

21.3 One risk tracker

Findings that live only in a PDF never meet their owners. Export them into the organisation's risk or vulnerability tracker with the same severity vocabulary Chapter 4 required. Keep the PDF as the narrative; keep the tracker as the work queue.

In ENG-712 F-01 and F-07 exist as tracker tickets before any slide deck is built, using the same severity words as the report. A deck that arrives before the tickets is sent back unpublished. The tracker is where owners and due dates live, so a finding that never reaches it never gets fixed.

21.4 Shadow IT

Personal drives, unmanaged chat channels and private boards for "just this engagement" become the place evidence goes to die — or to leak. Use the approved services even when they feel slower.

The rule covers temporary files too: a screenshot saved to a desktop folder called evidence_tmp is outside the vault and its retention clock. Weekly vault audits sample laptops and shared drives for such shadow folders during the engagement. Chapter 25's quiet-channel rule applies in the same way, so evidence and ROE details move only through approved services.

Worked example

Priya integrates Northpoint's outputs with TRT's tracker: each finding becomes a ticket with ATT&CK ID, severity, owner and due date; the PDF report is attached. The evidence vault grants Northpoint time-bounded access that expires at retention end. The SOC receives a calendar invite for the purple replay before the window opens, not after.

Synthetic case. The integration pattern is invented for TRT's tooling landscape.

Errors and limits

Integration that floods the SOC with raw scanner noise trains people to ignore tickets. Filter and rate findings before they enter the tracker.

Exercises

EX061 — Interface owner. Name three assessment interfaces and an owner role for each.
Show marking criteria
Rubric: 3 = three distinct interfaces with roles (e.g. white-team/CISO, tracker/vuln management, vault/security eng); 2 = two; 1 = one; 0 = none.
EX062 — PDF only. Why is a PDF report alone a weak integration?
Show marking criteria
Rubric: 3 = no work queue/owner/due date; findings stall; 2 = hard to search; 1 = PDF is enough; 0 = none.
EX063 — Shadow board. A tester creates a private Trello for TRT findings. What should Priya require instead?
Show marking criteria
Rubric: 3 = use TRT's approved tracker; export/migrate; disable the private board; 2 = migrate only; 1 = allow private board; 0 = none.

Synthesis

Treat assessment as a service with named interfaces, one tracker and no shadow stores.

Continue studying — chapter 21 of 30

← Chapter 20 (draft) · Course chapter index · Chapter 22 (draft) →