Chapter 28 — Field practice
Lesson map
Lesson 28 published. Map, example, EX082.
flowchart TD
N0["Learning outcomes"]
N1["28.1 Field kit"]
N2["28.2 Conduct"]
N3["28.3 Unexpected events"]
N4["28.4 Debrief with facts"]
N5["28.5 Remote field practice"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX082"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["28.1 Field kit"]
N2["28.2 Conduct"]
N3["28.3 Unexpected events"]
N4["28.4 Debrief with facts"]
N5["28.5 Remote field practice"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX082"]
[Learning outcomes]
|
v
[28.1 Field kit]
|
v
[28.2 Conduct]
|
v
[28.3 Unexpected events]
|
v
[28.4 Debrief with facts]
|
v
[28.5 Remote field practice]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX082]
Learning outcomes
You will (1) prepare a field kit checklist for an on-site or remote supervised session; (2) practise professional conduct with operations staff; (3) handle an unexpected production event during a window; (4) debrief with facts, not folklore.
28.1 Field kit
Written ROE and emergency contacts (offline copy); pinned tool versions; scope checker and ROE checker; evidence vault credentials that work; a tested out-of-band phone path to the white team; a notepad for custody lines when systems are down. Fancy dashboards are optional; the checklist is not.
The offline copy matters more than it seems during a long night on site. A phone can be the only device holding the ROE and the white-team number, and a dead battery on a station platform then leaves the tester unable to check a boundary or call anyone. Priya carries a printed ROE and contact sheet, and the conduct checklist fails a kit that lacks them.
28.2 Conduct
Assessment staff are guests in operations' house. Explain what you are about to do in plain language, keep to the window, and never surprise a change manager with traffic during a freeze. Purple-team success depends on trust built in these small moments.
In practice this means telling the duty controller what the next check will touch before starting it. If a Friday roster cutover is scheduled, an almost finished check stops and moves to the next window, even though the target is in scope. The change manager owns that cutover, and testers who ignore it lose the access they need for the rest of the engagement.
28.3 Unexpected events
A breaker trip, a passenger-information outage, a medical emergency on site — none of these appear in the ROE, and all of them mean stop noisy work and yield to operations. Resume only on white-team instruction.
The ROE cannot list every emergency, so the default when something unexpected happens is to stop. Restarting needs an explicit go from the white team, and the log records the name of the person who gave it and the time. That record later shows that the pause and the resume were decisions, not drift.
28.4 Debrief with facts
"The SOC was asleep" is folklore. "T1021 produced no alert for 40 minutes; ticket DET-19 opened" is a fact. Field notes should support the second style.
Writing the forty-minute silence on T1021 and the DET-19 ticket gives the SOC something to fix and a way to check that it has been fixed. Insulting wording about the SOC is edited out of field notes, and a note author who uses it gets a conduct finding raised through the liaison. Blame closes down exactly the conversations a purple team needs.
28.5 Remote field practice
When the session is remote rather than on-site, the kit still applies: out-of-band phone, offline ROE, tested screen-sharing that does not expose unrelated desktop files. Priya closes every other window before joining the white-team call. Accidental disclosure of another client's screen is a field failure even if no packet was sent.
Remote work adds its own risks, such as a chat notification popping up during screen sharing or a file from another client visible on the desktop. Before a white-team call Priya tests her screen sharing with a classmate and confirms that only the agreed window is visible. The offline ROE and the out-of-band phone stay on her desk exactly as they would on site.
Worked example
During a supervised evening window the passenger-information displays fail city-wide for an unrelated reason. Priya halts inventory traffic, notifies the white team, and switches to offline evidence labelling. When the NOC clears the event, the white team authorises a shortened resume. The debrief cites the halt time and the DET tickets, not personalities.
Synthetic case. The display outage and halt are invented field practice.
Errors and limits
Field heroics that "finish the scan anyway" during an outage are how assessment teams get banned. Take the no-go.
Exercises
- EX082 — Kit item. Why carry an offline ROE copy? Rubric: 3 = vault/VPN may be down; still need scope/emergency contacts; 2 = backup vaguely; 1 = unnecessary; 0 = none.
- EX083 — Freeze. A change freeze starts two hours early. What does the team do with planned active checks? Rubric: 3 = stop active checks; confirm with white team/change manager; reschedule; 2 = pause; 1 = squeeze them in; 0 = none.
- EX084 — Fact line. Rewrite "The SOC ignored us" as a factual debrief sentence. Rubric: 3 = names technique, time-to-alert or miss, ticket ID; 2 = partial fact; 1 = keeps blame; 0 = none.
Synthesis
Pack the checklist, behave as a guest, yield to real events, and debrief with ticketed facts.
Continue studying — chapter 28 of 30
← Chapter 27 (draft) · Course chapter index · Chapter 29 (draft) →