And that is the whole spiel.
The piece de resistance of tying actionable operational intelligence to red team
tools that provide immediate capabilities to test the risk of an organization
prioritized by actors most likely to be a threat.
Want more?
Of course you do, because you should.
Step one, know your APTs.
No, there's not just one source for this information,
but if the attackers are advanced you can't be thwarted by having to check
more than one website to get smart on how they operate.
Next, explore the ATT&CK Navigator,
and get your hands dirty with the courses in this path,
of course.
Oh, you're the extra mile kind of person?
You want the whole vegan enchilada?
Good.
Then you probably picked up that different threats are most
likely adversaries to different industries,
and you need to tailor your red team operations to
testing based on those threats.
The way to do that is to, first,
get some knowledge on red team integration into a
security organization with John Elliott.
Then start getting plugged in to the sources that are going
to give you the context that you need.
In the US at least, critical industries,
as well as states, have sponsored information sharing in analysis centers.
These are groups that you can join that share information about
specific threats and problems their sectors are facing.
On a more individual level, check out the graph capability on VirusTotal,
and use some indicators from your own environment and see
how they relate to other techniques.
And this is just a little pitch for InfraGard,
which is a program ran by the FBI here in the States that
pushes out specific threat information on a pretty consistent
basis. And that being a member, I've been pretty happy with the content therein.
I hope you enjoy these courses as much as we enjoy making them.
And thank you for watching Red Team Tools for Emulating Adversary
Techniques with MITRE ATT&CK, here on Pluralsight.