The main goals of TBG’s Red Team are to improve the overall readiness of your organization, provide remediation recommendations to your defensive practitioners, inspect the current performance levels and measure a company’s security controls over a longer duration than a typical penetration test. Independent Red Teams can provide valuable and objective insights about the existence of vulnerabilities and about the efficacy of defenses and mitigating controls already in place and even those planned for future implementation. Red Team exercises result in a better understanding of possible adversaries and help to improve counter measures against them and future threats.

TBG’s Red Team service consists of the following features:

• Assigned Tactical Red Team Manager
• Yearly threat modeling activity and assessment goal setting
• Quarterly on-site debriefings and assessment goal realignment
• Internet Reconnaissance reporting
• Physical security assessment
• Social Engineering testing throughout the year
• Vulnerability assessment activities throughout the year
• Ongoing network, application, wireless penetration testing

DELIVERABLES:

At the conclusion of each Red Team engagement, TBG Security will produce a findings and recommendations report containing:

• An executive summary including;
  • The scope of the engagement
  • An overview of our activities
  • A high-level, categorical, risk-based breakdown of findings
  • High level recommendations
  • A high-level plan for remediation
• Detailed findings
  • A risk-based list of addressable issues detailing the area of exploit, exploit description, risk to the environment, sophistication of the attack, impact of the finding, evidence and detailed remediation recommendations.
  • Detailed findings will be grouped as follows;
    • Social Engineering Findings
    • Physical security findings
    • Technology findings
      • Network (internal and external)
      • Application
    • Open Source Intelligence (OSINT) Findings
    • Response capability findings

In addition to the above report we will also produce;

• A vulnerability spreadsheet including;
  • A list of vulnerabilities identified broken out by host, vulnerability and criticality
  • A list of exposed services
  • A prioritized list of vulnerabilities requiring immediate attention
  • Detailed remediation guidance
• A high-level project plan including;
  • Activities, cost rating, level of effort, benefits to the organization, complexity, sales impact if applicable and whether the project includes people, process or technology.
• Identified Running and exposed services