Chapter 5 — Security literacy | Technologist Authorized offensive security and red team

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Three kinds of assessment"]
  N2["5.2 CIA in operational words"]
  N3["5.3 Existence versus effectiveness"]
  N4["5.4 Authorization is the line"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Three kinds of assessment"]
  N2["5.2 CIA in operational words"]
  N3["5.3 Existence versus effectiveness"]
  N4["5.4 Authorization is the line"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Three kinds of assessment]
    |
    v
[5.2 CIA in operational words]
    |
    v
[5.3 Existence versus effectiveness]
    |
    v
[5.4 Authorization is the line]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) distinguish vulnerability assessment, penetration testing and red teaming; (2) state the confidentiality, integrity and availability goals in plain words; (3) explain the difference between a control's existence and its effectiveness; (4) explain why authorization, not skill, separates testing from crime.

5.1 Three kinds of assessment

A vulnerability assessment enumerates known weaknesses broadly and usually stops at identification. A penetration test tries, within agreed limits, to confirm whether weaknesses can actually be used and what they lead to. A red-team exercise emulates a specific threat actor over a longer period to test detection and response as a whole, often with only a small "white team" aware of it. NIST SP 800-115 describes review, target identification and analysis, and target vulnerability validation as families of technique; PTES describes phases from pre-engagement through reporting.

5.2 CIA in operational words

Confidentiality: only the right people read timetable drafts and staff records. Integrity: nobody alters next week's driver roster without trace. Availability: passengers receive real-time arrivals when they need them. Every finding should say which of these it threatens, because that steers who cares and how fast.

For TRT, confidentiality covers staff roster drafts; integrity covers timetable truth; availability covers passenger information at rush hour. Priya rates F-01 shared admin as integrity and availability risk, not as a confidentiality trophy hunt.

Timetable integrity failures at rush hour hurt riders even when no personal data leaks. Priya's F-01 write-up leads with that operational CIA framing for the CISO.

5.3 Existence versus effectiveness

A policy that requires multi-factor authentication exists on paper. Effectiveness is shown only when an assessor observes that accounts actually cannot sign in without the second factor. Assessments measure effectiveness; audits often stop at existence. Both matter, but a report must say which one it measured.

ENG-712 does not rely on the policy PDF as proof of anything. It includes an observed staff-portal login path that still accepted a password without a second factor, recorded as evidence before it was rated. The report states that this was an effectiveness check, so a reader does not mistake a policy quote for proof that MFA works.

5.4 Authorization is the line

The same activity — checking whether an account is protected — is a service when written permission exists and an offence in many jurisdictions when it does not. Skill does not change that. Chapter 10 covers the documents that create permission.

Priya opens ENG-712 only after the CISO approval path has signed, and the signature timestamp is the first line in the engagement pack. Northpoint may not start quietly on staging clones before that line exists, however keen its testers are. Any activity before the signature is treated as unauthorised, even if the same check would later have been permitted.

Worked example

A TRT manager asks Priya for "a quick pen test of the VPN before Friday". She asks what decision the result will support. The real need is to confirm that ex-contractor accounts have been disabled — an effectiveness question about one control. She proposes a targeted account review instead of a penetration test, which needs a scope, an agreement and a window that Friday cannot provide.

Synthetic case. The manager's request and TRT's VPN are fictional.

Errors and limits

Calling every scan a "pen test" inflates assurance. Labels from vendors vary; read what was actually done.

Exercises

EX013 — Name the service. A board wants to know whether the SOC would notice a realistic intruder over six weeks. Which assessment type fits, and why? Rubric: 3 = red-team exercise; tests detection/response over time against a threat profile; 2 = type only; 1 = vulnerability scan; 0 = none.
EX014 — Paper control. TRT's policy states that all VPN logins require MFA. What evidence would show effectiveness rather than existence? Rubric: 3 = observed/sampled sign-in records or test accounts showing second factor enforced for all paths; 2 = vague observation; 1 = the policy document; 0 = none.
EX015 — Roster change. Which CIA property is threatened if a driver roster can be altered without a trace, and who should hear first? Rubric: 3 = integrity; operations/roster owner and security lead; 2 = integrity only; 1 = availability; 0 = none.

Synthesis

Choose the assessment type from the decision it must support, measure effectiveness, and remember that permission is the only line between practice and harm.

Continue studying — chapter 05 of 30

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →