Development and operations a practical guide
Download 4.62 Mb. View original pdf
|
- Navigate this page:
- Personnel Labor Cost
| Duration The duration can be a set time frame as determined by the target or the Red Team however, it is recommended that duration beset after the target objectives, requirements, and scope are determined. A realistic time frame can then be placed in the context of the scope, and be increased or decreased as required. It is essential not to use the timeframe to set scope. Arbitrarily setting a deadline can negatively impact the quality of an engagement scope by imposing artificial constraints. Although this is best practice, and duration should beset after the goals and scope are determined, it is helpful to have guidelines. You can use a period of two to four weeks for most engagements. This is a good starting point but must be adjusted based on the actual scope. Focus Area The two-to-four week recommendation is for estimating an individual engagement, which maybe part of a larger campaign composed of multiple engagements. The goals must be considered when determining scope duration. Personnel Labor Cost Simultaneously while determining the scope and duration, Red Team leadership should estimate the number of personnel required for an engagement. These steps must be simultaneous as they depend on each other. When sizing a Red Team, you must consider the number, size, and length of engagements. The most basic Red Team engagement will consist of at least two individuals. A recommended standard starting size for planning is four individuals three operators and one lead. Adjust the number up or down based on the size, length, and goals. How can you adjust the scope using a factor of time or personnel Consider this example an engagement is scoped for six weeks using three operators against a target network that has nodes. This engagement could be extended to eight weeks by reducing operators or maybe reduced to four weeks by adding staff. This elasticity of time and personnel should be considered when planning to help address finance, schedule, and other limitations. There are limits and diminishing returns to this elasticity. Adjustments could compromise the ability to achieve engagement goals. It is recommended to always have a minimum of two dedicated operators for an engagement. |