Chapter 26 — Authorized offensive security and red team: operational handoff
Lesson map
Lesson 26 published. Map, example, EX076.
flowchart TD
N0["Learning outcomes"]
N1["26.1 What operations need"]
N2["26.2 Residual risk and unknowns"]
N3["26.3 Access transfer"]
N4["26.4 Retest on the calendar"]
N5["26.5 Warm introductions"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX076"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["26.1 What operations need"]
N2["26.2 Residual risk and unknowns"]
N3["26.3 Access transfer"]
N4["26.4 Retest on the calendar"]
N5["26.5 Warm introductions"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX076"]
[Learning outcomes]
|
v
[26.1 What operations need]
|
v
[26.2 Residual risk and unknowns]
|
v
[26.3 Access transfer]
|
v
[26.4 Retest on the calendar]
|
v
[26.5 Warm introductions]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX076]
Learning outcomes
You will (1) write a handoff package that operations can act on without the testing team present; (2) include residual risk and known unknowns; (3) transfer evidence access cleanly; (4) schedule the retest window before demobilising.
26.1 What operations need
Owners need: each finding with severity, scenario, evidence pointer, recommended control, and a suggested due date. They do not need a travelogue of every tool the testers ran. Cut narrative that does not change a decision.
Priya builds the executive table with the report builder and leaves out any due date that has no owner, since a date nobody holds will not be met. Each owner then gets a finding sheet that opens with the scenario and the due date. Notes on which tools were run go to an optional appendix for readers who need to reproduce the work.
26.2 Residual risk and unknowns
Every engagement ends with things not tested — excluded segments, techniques not exercised, windows that were shortened. List them. Boards hate surprises more than they hate incomplete work that is honestly bounded.
For ENG-712 the residual-risk page names two gaps in plain words: the fare-payment segment was not tested, and technique T1021 still produced no alert. The handoff checklist treats a residual page without the fare-payment line as incomplete. Writing the gaps down now costs a short paragraph, while a board finding out about them later costs trust in the whole engagement.
26.3 Access transfer
Tester accounts, VPN profiles and vault grants end on the handoff date. Operations receives read access to the evidence package under its own roles. Shared mailboxes used "just for the test" are closed.
On the ENG-712 handoff call Priya reads the revocation checklist aloud with Northpoint present, and the VPN profiles are revoked that same afternoon. The evidence vault is switched to TRT-only access control, but only after operations confirms it can open the files. Any Northpoint access that still works after the handoff date is logged as a finding against the engagement itself.
26.4 Retest on the calendar
A remediation due date without a retest slot is a wish. Book the validation window (Chapter 27) before the testing team disperses. A handoff without a booked retest is marked incomplete on the evaluation sheet.
For ENG-712 the retest is booked for 2026-12-08 while Northpoint's testers are still engaged, and the calendar invitation is attached to the handoff pack. Booking it early means the people who know the findings will be available to run the checks. A handoff pack that arrives without the invitation is marked incomplete until the slot is agreed.
26.5 Warm introductions
A handoff meeting where Priya introduces each finding owner by name beats an email dump. Ten minutes of face-to-face (or video) clarification prevents a week of misrouted tickets. She records attendance so the evaluation sheet can show that operations actually received the work.
Priya tracks one simple measure of how well this worked: the number of tickets that reach the wrong team in the first week after handoff. An owner who has heard the scenario explained in person is less likely to bounce a ticket back as not theirs. The attendance list from the meeting goes into the evaluation sheet as proof of delivery.
Worked example
Priya's handoff pack for ENG-712: executive table from the report builder; four finding sheets; residual-risk page (fare-payment untested; T1021 still missed); evidence vault ACL flipped to TRT-only; retest slot booked for 2026-12-08. Northpoint's VPN profiles are revoked the same afternoon.
Synthetic case. The handoff pack contents are invented.
Errors and limits
Handoffs that dump raw scanner exports without triage create ticket floods. Do not revoke evidence access before operations confirms it can open the files.
Exercises
- EX076 — Pack contents. Name five artefacts in a minimum handoff pack. Rubric: 3 = five of exec table/findings/residual risk/evidence pointers/ACL note/retest date; 2 = three; 1 = PDF only; 0 = none.
- EX077 — Unknown. Write one residual-risk sentence for TRT's fare-payment exclusion. Rubric: 3 = states exclusion + that no assurance is claimed there; 2 = mentions exclusion; 1 = claims fare is fine; 0 = none.
- EX078 — Revoke order. In which order should vault ACL flip and Northpoint VPN revoke happen, and why? Rubric: 3 = confirm TRT can read evidence, then revoke tester access; 2 = either order with weak reason; 1 = revoke first blindly; 0 = none.
Synthesis
Hand over decisions and evidence, say what you did not test, move access carefully, and book the retest before goodbye.
Continue studying — chapter 26 of 30
← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →