Assessment methodology: standards, workflow and evidence handling
You get to know public methodology frameworks, build your own checklist, plan an assessment phase by phase and back every finding with solid, storable evidence.
Level 301 · 21 lessons · 18 practice labs
Lessons
Methodology frameworks
- Why a method: repeatable, comparable results
- Public frameworks: NIST SP 800-115, the OWASP testing guide and PTES
- Mapping findings to MITRE ATT&CK: speaking the defenders’ language
- Building your own checklist
- Short task: write a checklist for an internal network assessment
Workflow
- Planning: goals, assumptions and success criteria
- The discovery phase: inventory and service map
- The analysis phase: ranking candidate findings
- The validation phase: gathering evidence with the least impact
- Time-boxing: splitting the testing day and setting priorities
- Short task: draw up a day-by-day plan for a five-day assessment
Evidence and records
- Good evidence: timestamp, command, output and context
- Recording the terminal session: script and asciinema
- Screenshot discipline and masking sensitive data
- The activity log: what was done, when, and from which address
- Storing evidence encrypted and destroying it after the test
- Short task: prepare a complete evidence pack for one finding
Teamwork
- A shared notebook and finding tracker
- Deconfliction with the defence team: announcing test traffic
- Peer review: a second pair of eyes on each finding
- Capstone: run a methodical assessment of a lab network from start to finish
Practice labs
- Map a test plan's steps to a public framework: Match the steps of the given internal network plan to NIST SP 800-115 phases and point out the missing phase.
- Write your own checklist for an internal network assessment: Using the frameworks, prepare a checklist with measurable items for discovery, analysis, validation and reporting.
- Map findings to ATT&CK techniques and hand them to the defence team: Map six lab findings to the relevant ATT&CK techniques and suggest a data source the defence team can monitor for each.
- Build the lab network's service map in the discovery phase: Find the machines and services on the lab network and prepare a per-host service map and inventory table.
- Analyse finding candidates and order them for validation: Rank ten finding candidates from the discovery output by likelihood and impact and write which you will validate and why.
- Validate a finding with the least impact and prove it: Validate the lab target's misconfiguration using read-only steps, show from the logs that the service was not affected and save the evidence.
- Split one test day into timeboxes: Fit a six-task list into one day by priority and estimated time and reserve buffer time.
- Draw up a day-by-day plan for a five-day assessment: Plan the planning, discovery, analysis, validation and reporting days for Kuzeyyıldızı Kargo with goals and outputs.
- Re-plan after an unexpected outage: When the test window is cancelled on day three, reprioritise the remaining work and write the note explaining the change to the client.
- Collect timestamped evidence with command and context for a finding: While validating the lab finding, create an evidence record with the command, output, time and source address.
- Record a terminal session and mask sensitive data: Record the assessment session with script, mask passwords and personal data in it and place the clean copy in the evidence folder.
- Reconcile your activity log with the defence logs: Match the activity log you kept during the day with the target's logs, find an entry you cannot explain and note it in the report.
- Protect an evidence pack's integrity with hashes: Produce a hash list for the evidence folder, change one file and show the list catches the change.
- Prepare a complete evidence pack for one finding: Create an encrypted pack for one finding with a command log, screenshot, hash list and short description.
- Sort evidence by retention period and destroy what has expired: Sort three assessments' evidence by retention rules, securely delete the expired items and complete the destruction record.
- Tidy the shared finding tracker and merge duplicates: Merge the finding lists kept by two assessors, remove duplicates of the same finding and assign an owner to each.
- Announce test traffic to the defence team and match the alerts: Write the notice listing test source addresses and times, match the lab alerts against it and separate the one not caused by testing.
- Re-verify a colleague's finding with fresh eyes: Repeat the given finding record's steps on the lab, find the part that cannot be reproduced and write the corrected record.
About this course
You get to know public methodology frameworks, build your own checklist, plan an assessment phase by phase and back every finding with solid, storable evidence.
What you will learn
- Methodology frameworks
- Workflow
- Evidence and records
- Teamwork
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.