Hi everybody and welcome to part two of the routine assessments module mini module.
So this particular issue is about the yearly assessments that need to occur.
So what are yearly assessments yearly assessments.
Assessments are engagements that happen on a year basis.
So this can be for a variety of reasons.
It could be maybe there's a compliance obligation maybe it could be a government restriction possibly
a US government restriction on these type of engagements are done yearly because they take a large amount
of time to complete.
So stuff like we'll be talking about is the external perimeter testing so that can take a large amount
of time to finish depending on the size of the team.
And sometimes these engagements or assessments tend to have a third party involvement of some kind.
So this could be a freelancer contractor it entirely depends on the type of engagement or assessment
you're trying to do.
So the first type is the external perimeter testing that's done in-house by the current red team.
So there's a full test from an attacker's perspective from the outside of the organization.
There's there's a few restrictions that need to be in place.
So we need to assume that there's no knowledge prior knowledge of the network so that the red team needs
to throw out everything that they understand about the network and go from there.
They cannot use work related equipment or credentials such as a VPN or anything like that to gain an
initial foothold in the network.
Possible restrictions for this could be exploits that might not be reliable could be services that may
be too customer facing and have the criticality of being unstable to look to a point.
So we want to avoid those type of things based because we don't want to take down the business just
to prove a point.
So the last bit is the feedback loop so that is creating the tickets that might need to be created to
the correct teams.
But following up with them validating that they fixed the issue retesting the issue to make sure that
they fixed it so that a feedback loop is something I want you all to understand fully that it is very
important concept and it's not just a red teaming concept.
It's no matter what you're doing a feedback loop is extremely important for improving a process that
you are currently working with.
So take that to any aspect that you want but a feedback loop is very important.
So the other type of yearly engagement can be a third party external perimeter testing.
Now this is pretty much remotely the same as the in-house one.
Again maybe required per the compliance obligations such as having US government as a as a customer
or a client tends to make this required by a third party and not from an internal source.
Red team tends to organize the scope which will go over in the scope identification module but they'll
create the scope all the paperwork and provide it to the third party so they know what to attack what
type of exploits to use when where they should attack.
As an example earn and what not to attack so we again make sure those critical services stay up once
the red team or once they're done the red team will then take that report finalize any findings and
actually test them themselves to make sure that they were valid they weren't they weren't putting in
false findings for whatever reason maybe their testing environment on their machine was different then
and something showed up incorrectly.
There's a lot of instances where this needs to be validated but validating it needs to happen.
Then the Red Team will prioritize all issues based on business risk what's actually relevant to us what's
not.
For example there might be already a patching effort to bring everything up to up to snuff and prioritizing
that does not always necessarily mean that because we've got the finding we already know it's it's happening
it's in the process making an extra ticket doesn't do anybody any good.
Still noted down but maybe in your particular case making it tick it doesn't matter.
Feedback loop again the whole process.
Create the ticket.
It's all it's all well-documented.
Make sure it's got the whole loop comes around from the time it's found to the time it's resolved to
the time it's fixed everything has to come back around.
So this is a quick snippet on the yearly type of assessments.
Now keep in mind that you can't move in the next few videos we'll be talking about the quarterly and
monthly type of assessments and the consistent types.
Any of those types of assessments can fall under a yearly type assessment depending on how the team
thinks it wants to use these particular types of assessments.
Maybe network segmentation is a big enough of a task for your particular team where it needs to be done
yearly and it cannot.
We don't have the manpower to run it every week or every month or every quarter.
So in a quarter in a general sense it's normally about three months.
So just keep in mind that I'm noting these two here because they tend to be the biggest ones.
But any other assessment can fall into the yearly assessment range.