Vulnerability › Module 1 › Lesson 2
RoE Written Scope
If it is not written, it is not in scope — draft YOUR VA RoE for $LAB_HOST.
Visual · va_roe_written_scope
RoE = written who / what / when / stop. $LAB_HOST only. Original Cyberlium.
Opening
Curiosity is not authorization. A RoE file you chmod 600 is.
Rules of Engagement for VA labs answer: which host ($LAB_HOST you control), which operator (you on your hardware), which actions (inventory, credentialed scan per brief, read-only discovery on lab only), where notes live ($HOME/cyberlium-lab), and stop conditions (any IP not $LAB_HOST, production employer assets without ticket, dorm LANs, café Wi-Fi, internet ranges). Original Cyberlium. You draft RoE before any scanner touches a target. You do not copy a bug-bounty scope and aim it at a school network. Next: Lab Assets Only.
1. Four RoE lines: who, what, where, stop
Who: the asset owner (you) on hosts you control. What: scan/inventory $LAB_HOST only per lab brief — no exploit chains. Where: notes under $HOME/cyberlium-lab, mode 600. Stop: any IP or hostname not $LAB_HOST, employer production without ticket, dorm sweeps, café gateways, public cloud IPs you do not own.
Written scope is how you refuse 'scan my roommate's PC' in Discord. Their machine needs their RoE — not your Nessus job.
Command guide
Try these commands — Four RoE lines: who, what, where, stop
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CIS Controls — https://www.cisecurity.org/controls (authorization baseline) CISA Cybersecurity — https://www.cisa.gov/topics/cybersecurity-best-practices
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3 sudo apt install curl
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/ Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
python3 -c "print('RoE: assets, methods, hours, contacts, stop conditions')"
curl -sS https://www.cisa.gov/topics/cybersecurity-best-practices | head -5Primary tools to practice this lesson: python3, curl. Reference sites: CIS Controls (https://www.cisecurity.org/controls); CISA Cybersecurity (https://www.cisa.gov/topics/cybersecurity-best-practices). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Authorization is not 'the port replied'
A responsive ping does not grant permission to assess. Scope is host-level: $LAB_HOST is in; everything else is out until a signed engagement says otherwise — this course is not that engagement.
Professional VA teams attach RoE to contracts and change tickets. Steal the habit (write scope, respect stop) and leave stranger networks alone.
3. Stop conditions you can say out loud
If the target is not $LAB_HOST in your file, stop. If someone asks you to nmap the dorm subnet, stop. If a tutorial scans a public cloud range, stop and rewrite to $LAB_HOST.
Next lesson locks the asset boundary: lab VM and intentional targets only, not bridged stranger LANs.
4. What you ship: four written RoE lines for VA work
who/what/where/stop on disk. $LAB_HOST named. NEVER stranger LANs, café Wi-Fi, internet ranges. chmod 600.
5. What you record before the next lesson
Date. Four RoE lines. $LAB_HOST named. File t18-m01-l02-roe-scope.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Keep RoE 'in your head.' nmap classmate IP because they 'said it is fine' without written scope.
Right
Write four lines and stop conditions. Next: Lab Assets Only.
Mission: freeze VA RoE before scanners
1) Write who/what/where/stop in $HOME/cyberlium-lab. 2) Name $LAB_HOST as the only in-scope host. 3) List stop conditions including dorm LANs and café Wi-Fi. Never scan visible neighbor devices.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor for a RoE template shape — not for a list of classmate IPs to scan.
Knowledge Check
APPLY: A classmate shares their laptop IP and says 'practice VA.' Your RoE lists only $LAB_HOST. You:
Multiple choice
Knowledge Check
APPLY: True or False: A responsive port authorizes scanning that host for VA.
True or False
Knowledge Check
APPLY: RoE 'stop' should include:
Multiple choice