Information Security Assessment Overview

Six characteristics of a security assessment

1. information: back box or white box
2. intensity: passive, cautious, balancing, aggressive
3. extent: complete, partial, focused
4. strategy: covered, open
5. techniques: network, other comm, physical, social engineering
6. perspective: external internal

Red teams and Blue teams

Red teams

• rooted in military security assessment
• security from adversarial perspective
• outside experts
• Goal: assessing incident response
• output: list of attack vectors and countermeasures

Blue teams

• defense group
• red team opponent
• internal security group
• goal: reacting and prevention of expected attacks.
• output: strengthening defensive and investigative procedures.

Unified cyber kill chain

Initial foothold

1. reconnaissance
2. weaponization
3. delivery
4. social engineering
5. exploitation
6. persistence
7. Defense evasion
8. command and control

Network propagation

1. pivoting
2. discovery
3. privilege escalation
4. execution
5. credential access
6. lateral movement

Actions of objectives

1. collections
2. exfiltration
3. target manipulation
4. objectives