Phase 00 - Safety, Ethics, Legal Boundaries, and Lab Operations
Duration: 4 weeks (Month 1)
Objective: become a trustworthy operator before acquiring offensive capability.
Exit Standard
You can reject an unsafe request, prove authorization, isolate an exercise, preserve evidence, handle private data, escalate a critical finding, and explain responsible disclosure. Your lab must pass the acceptance test in ../templates/lab-acceptance-checklist.md.
Learning Path
Beginner
- White, black, gray, red, blue, green, and purple team terminology; why labels never replace authorization.
- Computer misuse, contract, privacy, export, workplace, and sector-specific constraints at a conceptual level. Obtain qualified legal advice for real engagements.
- Scope, rules of engagement, safe harbor, data minimization, need-to-know, and conflicts of interest.
Intermediate
- Vulnerability disclosure and VRP lifecycle; duplicates, severity disputes, embargoes, and publication permission.
- Evidence provenance, UTC timelines, hashing, chain of custody, redaction, retention, and secure destruction.
- Safe malware handling: inert fixtures first, isolated networks, snapshots, no shared folders, no clipboard, no host credentials, and controlled sample transfer.
Advanced
- Design a research environment whose failure modes are contained.
- Lead go/no-go review, critical-finding escalation, incident conversion, and executive status.
- Resolve ambiguous scope by stopping and obtaining written clarification.
Required Theory
- Read the policies of three major VRPs and compare scope, prohibited testing, data handling, automation, and disclosure terms.
- Read NIST SP 800-61 incident-handling preparation sections and NIST SP 800-86 evidence concepts.
- Study local organizational policies and the laws applicable to the learner's jurisdiction.
Labs
| Lab | Build / perform | Required evidence |
|---|---|---|
| 00.1 Isolated range | management, attacker, victim, telemetry, mobile, K8s, and optional OT zones | diagram, firewall tests, packet proof that unintended egress is blocked |
| 00.2 Endpoint set | Ubuntu, Windows evaluation VM, Android emulator, Apple workflow if available | version inventory, snapshots, reset script/runbook |
| 00.3 Telemetry | centralize Linux, Windows, network, container, and application logs | event matrix and one verified event per source |
| 00.4 Cloud sandbox | dedicated project/account, MFA, budget, quota, least privilege, teardown | account diagram, cost alert test, clean teardown |
| 00.5 Rules of engagement | complete the repo template for a fictional assessment | signed mock ROE, stop conditions, escalation tree |
| 00.6 Disclosure workflow | triage and report a seeded fictional flaw | disclosure report and timeline |
| 00.7 Evidence drill | collect a disk file, log export, pcap, and screenshot | manifest, hashes, transfer and redaction log |
| 00.8 Notebook | create decision, hypothesis, evidence, finding, and daily-log structure | searchable index and sanitized sample entry |
Runnable lab portfolio
- Engagement Guard and Evidence Verifier: scope drift, prohibited techniques, ceilings, stop conditions, and evidence tampering.
- Range Containment Verifier: required telemetry paths and forbidden LAN, internet, OT, and management reachability.
- Evidence Redaction Pipeline: sanitized reporting with deterministic transformation counts.
Read WARMUP.md before implementing it and use HITCHHIKERS-GUIDE.md to build and harden the range.
Capstone - Security Research Operating Manual
Deliver:
- legal/ethical operating rules and refusal policy;
- lab architecture and data-flow diagram;
- installation and version inventory;
- authorization, evidence, triage, disclosure, and incident-conversion procedures;
- backup, snapshot, reset, teardown, and cloud-cost controls;
- a 10-minute go/no-go briefing.
Tools
Git, age or GPG for encrypted artifacts, SHA-256 tooling, virtualization platform, host firewall, Docker/Podman, kind/k3d, Android Studio, Wazuh/OpenSearch or equivalent, Wireshark, Sysmon, auditd.
Evaluation Checklist
- Every segment has a documented purpose and default-deny boundary.
- A test from each lab host proves prohibited routes fail.
- No real secret or personal data exists in the repository.
- Evidence survives transfer with matching hashes.
- ROE names allowed methods, exclusions, rates, time, contacts, and stop conditions.
- The learner stops and escalates during an injected scope ambiguity.
Common Mistakes
- Treating public reachability as authorization.
- Using a VPN, disclaimer, or VM as a substitute for scope.
- Allowing vulnerable images to retain internet or LAN access.
- Capturing excessive data and calling it "evidence."
- Publishing before the owner authorizes disclosure.
Interview Questions
- What would make you stop an assessment immediately?
- How do you preserve evidence while minimizing personal data?
- A client verbally asks you to test an asset absent from the signed scope. What do you do?
- When does a security assessment become an incident response engagement?
- Explain responsible disclosure to an executive who wants immediate publication.
Portfolio and Stretch
Publish sanitized templates and the architecture, never raw evidence. Stretch work: add infrastructure-as-code for the local range, automatic egress tests, encrypted evidence indexing, and a tabletop involving accidental third-party data.