tegwick
beab2a04d1
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0260c-4067-7052-9647-ad000d576e38
98 lines
4.2 KiB
Markdown
98 lines
4.2 KiB
Markdown
# Scope
|
|
|
|
## One-liner
|
|
|
|
`whitehat-security` is NetKingdom's authorization-bound offensive-security
|
|
tooling for producing adversarial evidence about security claims.
|
|
|
|
## Core idea
|
|
|
|
The repository turns stated security properties into dated, reproducible attack
|
|
attempts. It remains separate from the systems it tests, reports findings
|
|
without grading their severity, and never treats a passing probe as proof that a
|
|
boundary always holds.
|
|
|
|
## In scope
|
|
|
|
- Attacker models for tenant isolation, credential confinement, noisy-neighbour
|
|
behavior and erasure verification.
|
|
- Differential probes that compare behavior across controlled tenant contexts.
|
|
- Known-bad and known-good fixtures that demonstrate every probe can fail.
|
|
- Rules of engagement, target authorization, engagement records, abort
|
|
controls and evidence minimization.
|
|
- Probe cadence and the resulting assurance/exposure window.
|
|
- Delivery of findings and passing-run evidence to `risk-nexus`.
|
|
|
|
## Out of scope
|
|
|
|
- Fixing defects in target repositories.
|
|
- Assigning severity, disclosure policy or remediation deadlines.
|
|
- Replacing mechanical checks owned by a target repository's CI.
|
|
- Defining the estate's security model or publishing permanent policy.
|
|
- Probing any target without the authorization and engagement records required
|
|
by [the rules of engagement](docs/rules-of-engagement.md).
|
|
- Blocking build-mode delivery without a separately recorded decision.
|
|
|
|
## Safety invariants
|
|
|
|
- The rules of engagement are accepted, but their acceptance authorizes no live
|
|
target. Without a complete approved engagement record, only documentation
|
|
and non-networked fixture design may proceed.
|
|
- No live target is authorized by this scope document.
|
|
- Every live run names its authorization, target, owner, window, technique,
|
|
credential lane, rate ceiling, abort contact and finding destination.
|
|
- A probe stops at the recorded boundary and never follows an adjacent system.
|
|
- Evidence records response shape and counts, never real tenant row values or
|
|
credentials.
|
|
- Findings leave this repository; repairs do not enter it.
|
|
|
|
## Relevant when
|
|
|
|
- A service claims a Tenancy Posture evidence level that requires adversarial
|
|
rather than mechanical evidence.
|
|
- A boundary must be tested using a leaked runtime credential or hostile tenant
|
|
context.
|
|
- The estate needs to know when a probe last ran, what attacker it modeled, and
|
|
whether it was proven against a known-bad fixture.
|
|
|
|
## Not relevant when
|
|
|
|
- A repository needs unit, schema or provisioning tests for its own code.
|
|
- A finding needs triage, severity or disclosure handling; use `risk-nexus`.
|
|
- Permanent policy needs publication; use `policy-nexus`.
|
|
- The desired activity falls outside an approved engagement boundary.
|
|
|
|
## Current state
|
|
|
|
- Repository status: active.
|
|
- Active plan: `WHITEHAT-WP-0001`.
|
|
- `T01` is complete: the rules of engagement were accepted on 2026-08-21.
|
|
- `T02` is complete: the per-axis attacker model is recorded in
|
|
`docs/attacker-model.md`.
|
|
- `T03` is in progress: the differential core and audit-core/tenant-engine
|
|
target packs exist, but target run records are still gated.
|
|
- `T04` is in progress: all generic read/write operations detect the
|
|
known-bad fixture; target-specific calibration follows executable adapters.
|
|
- `T05` is in progress with a 24-hour E3 cadence and offline evaluator.
|
|
- `T06` is in progress with a bounded characterization evaluator; no shared
|
|
substrate window is approved.
|
|
- `T07` is in progress with a report schema and risk-nexus message formatter;
|
|
the first target report has not yet been produced.
|
|
- No live probe traffic is authorized; each target still requires its own
|
|
engagement record and approvals.
|
|
|
|
## Relationships
|
|
|
|
- Owner and security canon: `net-kingdom`.
|
|
- Finding intake, severity and disclosure: `risk-nexus`.
|
|
- Permanent publication: `policy-nexus`.
|
|
- Initial proposed target owners: `tenant-engine`, `audit-core` and
|
|
`flex-auth`.
|
|
|
|
## Getting oriented
|
|
|
|
1. Read [`INTENT.md`](INTENT.md) for the durable purpose and ownership model.
|
|
2. Read [the rules of engagement](docs/rules-of-engagement.md) before any probe
|
|
design or execution.
|
|
3. Read [`WHITEHAT-WP-0001`](workplans/WHITEHAT-WP-0001-cross-tenant-evidence.md)
|
|
for active tasks and sequencing.
|