Target: Threat-Informed Scenarios, Risk and Priority Techniques

All courses / AI Purple / Module 2 / Chapter 5

Learning objectives

After the lesson the participant can:

• Explain what each of the four inputs to a scenario supplies and why the proposer is not the selector.
• Rank candidate techniques by impact, relevance and uncertainty about the defence into priority tiers.
• Draft a scenario record with source, expected outcome per layer, safety class, evidence rule and exclusions.
• Review a scenario library for selection bias and record exclusions in an exclusion register.

Key concepts

Priority technique

A technique chosen for regular testing by the sum of three coarse tiers: impact on critical assets, relevance to this organisation or sector, and uncertainty about whether the defence would stop it. The result is an order and a tier, with reasons.

Scenario record

The testable statement built from one or more techniques and held as code (SCN-NR, SCN-HM): identity and owner, source, technique set and parameters, expected outcome per layer, safety class and environment, evidence rule, exclusions and sensitivity.

Scenario curator

An agent or drafting assistant that reads intelligence, register entries and incident reviews and proposes scenario drafts at Level 1 Assisted. A named person accepts each draft, sources are treated as untrusted input, and the reviewer's work is measured.

Selection bias

The tendency of a library to fill with scenarios that are cheap to run. The guards are gaps reported as gaps, a reserved share for hard techniques, a check of the curator's mix and a protected class of human-authored scenarios.

Exclusion register

The record of what is deliberately not tested: out of scope, unsafe, unauthorised or not worth testing, each with the reason, the decider and a review date. An excluded technique is untested, and untested is not covered.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. At Hansa Mutual the detection-engineering team may nominate techniques but cannot remove one. What would the priority list look like after two years if the tested side could remove entries?
2. Nordvik Region reported T1190 and T1486 as untested when their mirror evidence had expired. What pressures push an organisation to report such techniques differently?
3. The curator's proposals favoured well-documented techniques. How would you design the review so that a reviewer who sees mostly good drafts still reads each one?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Which three factors does the chapter combine to rank priority techniques?

   1. Novelty, ease of emulation and the number of public reports.
   2. Cost of the test, tester availability and the audit calendar.
   3. Impact, relevance and uncertainty about the defence.
   4. Severity, exploitability and the age of the vulnerability.
   Show the answer

   C. Impact, relevance and uncertainty about the defence.
   The ranking sums three coarse ordinal tiers, impact, relevance and uncertainty about the defence, to give an order and a tier with reasons. The chapter says explicitly that techniques are not chosen by novelty.

2. What is the ceiling for AI at P1 Target, and who decides what enters the scenario library?

   1. Level 1 Assisted; a named owner accepts or rejects each draft.
   2. Level 2 Supervised; the curator adds drafts and a person samples them.
   3. Level 3 Bounded; the policy decision point accepts catalogued drafts.
   4. Level 0 Advisory; the detection-engineering team selects the scenarios.
   Show the answer

   A. Level 1 Assisted; a named owner accepts or rejects each draft.
   The chapter sets the ceiling at P1 Target at Level 1 Assisted: a proposal made by a system is not a decision, and a draft enters the library only when the named owner accepts it. Scenario selection is not delegated to a Mode 5 agent.

3. How does the chapter treat a priority technique that has been placed on the exclusion register?

   1. As covered by the compensating controls of the wider estate.
   2. As removed from the priority list until the next six-monthly review.
   3. As low risk, because the exclusion was approved by a named person.
   4. As untested, and untested is not covered.
   Show the answer

   D. As untested, and untested is not covered.
   All four categories of exclusion end in a record with a reason, a decider and a review date. The chapter's rule is that an excluded technique is untested, and untested is not covered.