You’ve Gained +2 Perception! Leveling Up Your Red Team with a New Maturity Model

Ground Floor, 14:00 Wednesday The Red Team, helps an organization know itself. It asks questions. It challenges assumptions. It pokes holes, not just in ideas but also in an organization’s technology so that the organization gets quantitative inform...

Ground Floor, 14:00 Wednesday

The Red Team, helps an organization know itself. It asks questions. It challenges assumptions. It pokes holes, not just in ideas but also in an organization’s technology so that the organization gets quantitative information about how well its security is doing.

But how does a Red Team know itself? Red Teams need to possess a lot of different skills, cover a lot of different attack surfaces, and are often small in the personnel world. How can the team know that it’s up to the task, and how can the team communicate that readiness to leadership so they have confidence in the data the team generates?

This presentation will cover a new, first of its kind Capability Maturity Model to help solve that exact problem. It may not be the sexy new tool to pwn all the things, but if we as offensive security practitioners cannot relate to and support the business-side of the organization, we’re not much better than actual hackers. We’ll discuss how we got to this point and spend the bulk of the time discussing how new and established teams can employ the model to help plan for and report on continued maturity.

Brent Harrell, Garet Stroup