Hi everybody and welcome to part four of the routine assessments many module.
In this particular video we're going to be talking about monthly assessments.
So what is a monthly assessment a monthly assessment is an assessment that is done monthly.
It is the most common frequency of assessment that we'll talk about and this is where you're going to
find the most reoccurring and new findings on a consistent basis.
So normally a read a monthly assessment contains two things.
It contains a red team assessment which is everything that we included previous to this such as the
external perimeter testing maybe segmentation testing zero day audits.
And then there's one phishing campaign now the phishing campaign it changes per month.
So there's going to be an active and then there's going to be a passive.
So you need to flip flop.
Which one at random you're going to want to do maybe you're too active one passive one passive too active
maybe you're going exactly back and forth.
The goal is to keep everybody on their toes and keep them unaware of what could possibly happen.
Maybe they're going to get their heads up.
So and also you're not going to tell them when it's going to be launched.
So could be anytime during a month any time at night during the day could be any point.
So the campaigns must be on rotations the campaign in a nutshell is the email template that you're sending
out and that can be blocked in a nutshell it's the domain itself that gets blocked by the blue team
then needs to be unblocked each quarter because you're going to want to rotate this again and retest
the same people maybe every six months or you want to try the same campaign again against a different
batch of employees this time so they can see it for the first time.
So there's a lot of reasons there and there's going to be a phishing module similar to the Red Team
blueprint but its own course that's going to be released soon soon after this that will go through how
to set up all the automation in an enterprise way how to set up automation around go fish how to how
to utilize everything how to set campaigns how to identify the complexity of a phishing email.
So you're not sending something too perfect or too stupid and you kind of get the middle ground for
employees to have an actual chance at identifying this because it's more of a learning experience remember
for the employees they want to be able to understand this looks weird I need to report this.
So keeping that in mind you don't wanna make something too perfect to where it looks flawless and has
the perfect domain.
Everything looks great.
They're always going to click on it.
But the goal is to keep them learning to eventually you can get to the point where you can increase
the difficulty over time so unplanned assessments there's always going to be something unplanned prepare
for it at least once or twice a quarter you're going to have something that's unplanned now unplanned
assessments can be anything from somebody bringing up a new service to something people are planning
on bringing on to the environment could be.
In most cases it's when a red team member or another blue team member identify something that they want
to test.
So maybe there's a new service that comes up and new code base they've identified a few issues already
and they want it tested a little further and actually have the full capabilities of testing because
downloading a copy of it and testing is great.
However you want to keep the feedback loop on a consistent basis so you don't want to be poor reporting
bugs on a Friday night at a high of a hike criticality if you know that you could have tested that on
a normal basis on a Monday and filed everything from there.
You do not want to piss everybody off on a Friday.
So there will always be unplanned assessments planned for it live it love it you know always be there
you'll never you'll never have a quarter or two without something unplanned that you want to look at
or that somebody else is saying hey you may want to take a peek at this.
That's kind of how the world of security works there's always stuff changing.
So this is the end for the monthly assessments.
The next video we're going to go over is the consistent one.
So we'll be talking a little bit more about the automation and what type of stuff you can do on a consistent
basis.