Service Overview
The Red Teaming exercise conducted by CYE is designed for organizations that have an operational Security Operations Center (SOC) actively monitoring networks and digital environments for suspicious activity. The goal is to evaluate the organization’s incident detection capability and overall readiness.
Methodology
CYE typically performs the exercise in stealth mode, without notifying the SOC team, in order to test the visibility of their monitoring sensors and challenge their alerting mechanisms and methodology. By gradually increasing the “noise level” until detection occurs, the exercise tests the organization’s ability to detect and respond to threats targeting crown jewels. The exercise addresses technology-process-human qualification aspects involved in cybersecurity operations.
Deliverables
Upon completion of the exercise, the client receives a detailed report that includes:
Executive summary with high-level overview of the activity and results
Methodology description
Summary of results, including main attack scenarios successfully executed on the assessed environment and timeline
Detailed description of identified vulnerabilities in different security domains categorized by risk level
Mitigation and remediation recommendations
Prerequisites
Based on the agreed attack scenarios, the prerequisites may include:
Technical documentation
Access into the network (if it includes the internal environment)
Users and passwords
External assets scope definition
Customer Engagement
The exercise begins with interviews and planning sessions involving relevant stakeholders. During this phase, CYE and the client define:
Clear targets
Timelines
Communication channels
Emergency contact procedures (“panic buttons”)
Success criteria
Relevant Standards
The methodology is based on the MITRE ATT&CK framework.
Security Domains Covered
Security operations, monitoring, and incident response
Additional security domains may also be addressed during the exercise:
Cross-organization policies, procedures, and governance
Network level security
Servers, network equipment, and endpoint security
Application-level security
Sensitive data and information management
Identity management and remote access