tegwick
beab2a04d1
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0260c-4067-7052-9647-ad000d576e38
42 lines
1.8 KiB
Markdown
42 lines
1.8 KiB
Markdown
# whitehat-security
|
|
|
|
NetKingdom's offensive security facility. Automated white hat IT-security,
|
|
pen-testing and isolation-probing — pointed at infrastructure we choose,
|
|
including our own.
|
|
|
|
The estate's **adversarial evidence facility**: it attacks our own systems, on
|
|
a schedule, to find out whether the security properties they claim are actually
|
|
true.
|
|
|
|
It exists because a repo testing its own boundary grades its own homework. The
|
|
probes most worth having are the ones an author would not think to write.
|
|
|
|
- **Independent in operation.** It does not take a declared posture as true.
|
|
NetKingdom owns both the security canon and this facility, so findings leave
|
|
through `risk-nexus` under separate ownership rather than being resolved here.
|
|
- **It finds; it does not fix.** Findings route to `risk-nexus`, which owns
|
|
severity and disclosure. The repo that owns the defect owns the repair.
|
|
- **A pass means the attacks we tried did not work** — not that the boundary
|
|
holds. Reports say so.
|
|
|
|
- Intent: [`INTENT.md`](INTENT.md)
|
|
- Scope: [`SCOPE.md`](SCOPE.md)
|
|
- Workplans: [`workplans/`](workplans/)
|
|
- Attacker model: [`docs/attacker-model.md`](docs/attacker-model.md)
|
|
- Rules of engagement (accepted; live targets still require engagement approval):
|
|
[`docs/rules-of-engagement.md`](docs/rules-of-engagement.md)
|
|
- Operator runbook: [`docs/operator-runbook.md`](docs/operator-runbook.md)
|
|
- Target packs: [`probe-packs/`](probe-packs/)
|
|
|
|
## Offline calibration
|
|
|
|
```sh
|
|
make check
|
|
make fixture-evidence
|
|
```
|
|
|
|
This proves that every current differential probe passes an enforcing fixture
|
|
and detects the corresponding missing-tenant-predicate fixture. It sends no
|
|
network traffic and is not evidence about a target service. Live execution
|
|
requires a current target-specific record based on
|
|
[`engagements/template.json`](engagements/template.json).
|