Hi everybody welcome to the final video of the routine assessments mini module in this video.
We're going to be talking about building an assessment plan from scratch.
So what does an assessment plan.
It is a plan or map that handles about a year's worth of red team assessments.
For them to execute.
Now this can be like we talked about anything from phishing password cracking to external engagements.
Network segmentation testing.
Sometimes these plans can spend more than a year maybe two years.
It entirely depends on the requirement for your organization so it also needs to take an account for
any unknown assessments that might occur.
So why is this important.
It allows other teams to identify what will be tested.
Now other teams will not get a full document.
They'll get a watered down document that might have the quarter and how long a particular test might
be that team will get a more detailed scoped identify scope document that will go over later around
when exactly it is.
So for phishing engagements for example the blue team can see this document but they'll only see the
phishing engagements for that quarter lasting a week.
But they're not going to see whether it's an active or passive test.
So this also provides accountability to the red team to follow Mr T O there to follow through with the
plan that's been set by them at the beginning of the year.
So now things do change.
People leave.
People get hired people get fired.
There's a lot of changes that can happen twice a year.
So it's not a set goal but it is one that you try to achieve by the end of the year.
So structure of a plan is generally one to two yearly assessments for quarterly three monthly and three
consistent assessments.
Now what you're going to be doing is building a plan around this general concept.
So what we're doing is you're going to build an assessment plan a two year assessment plan from 2018
2019.
We're going to assume at least two unknown assessments per year.
So you don't have to take into account and shift stuff around depending on what you can shift a third
party audit is required by the compliance team in 2018 but not 20 19 and there is a sample plan which
kind of shows which will be the one I'm gonna show you in a minute as well as a template that you can
use in the material video materials link as above.
So let's take a look at an assessment plan.
So the names here are completely arbitrary.
This is this is not an assessment plan that I use at work as an example.
This is just a standard one that I built for this course.
So this is as you know this is not a complete list of every assessment for the whole year.
This is giving you an idea of how you can structure it.
So let me go ahead and make this a little bigger for everybody
first thing you want to do.
You want to note the requirements here as the task the owner the quarter in which it's being done length
of time it's going to take.
Is it required in any notes that you may want to leave for other team members.
So do you see.
Here we have a production test by me in Q1 for three weeks and it is required we have another one because
let's say the team decided they wanted to do two production tests this this year.
So in Q4 we have another through a test but this one is not required and can be moved for an unknown
assessment.
So you want to know what's required you want to at least get a production corporate development test
each done each year at least one which is why this one right here is considered not required.
So we have fishing.
So we have three per quarter and account for one per month each of whom take about a week.
Now if you automate the fishing process which I highly suggest you do it does not take a week.
It should be happening all the time but it's good to note it here.
So in this case we have a random guess of active and passive.
Now as I said before other teams won't see this particular column they might see something like this
where it's third party compliance requirement but for stuff that's sensitive that we want to keep hidden
such as this for fishing we're going to leave this out when we give them the document.
So as we can see Peter the unlucky soul has to deal with the fishing attempts every day or every every
quarter throughout the week.
So we also have a external perimeter testing by John.
Peter and I in Q3 for four weeks.
So this is an in-house one as we spoke about before in-house and third party which is right below it.
And I'm gonna be handling the third party in Q4.
It's going to take about four weeks.
So this is a compliance requirement.
So we have a yes here so don't know what's wrong with that but a Jenkins service So Peter's going to
run that's about a week.
This was due to a new addition to the Jenkins service.
So something quick is simple they added something we need to test.
Active Directory testing.
So we've.
Let's say we did this last year hasn't been too many tweaks.
We're going to leave it as a not required but can be moved but we still want to do a full one on the
list.
Same thing for code review.
In some cases it required some cases it's not in this particular case it is not required.
This can be moved for an unknown assessment network segmentation or not.
So queue for two weeks it is required.
We're gonna be checking prod to death specifically and that also goes reverse so from dev to prod if
time permits but in a general sense you're checking one direction at a time since it could take a while
to go do the test and this particular particular case for doing two weeks most of the time these engagements
go three to four.
So you can see that this is not as fully developed as what you would normally see.
So this could be you know 100 plus lines depending on what people want to test how many people are on
the team.
So you're going to assume that you have four people on the team including yourself.
So you want to build a an assessment plan similar to this look up different variations of tests.
There's definitely a lot of penetration tests that are different.
So these are just some common ones particular services maybe you throw in a patchy service testing and
hear front end web app maybe you do engine X testing.
So go out and take a look at different technologies that may be used in an enterprise or organization
or maybe ones that you have seen used and add them to the list.
The requirements are below the video as well as well as the slideshow.