Field notes
The RedTeam Security blog
How engagements actually run, what UAE regulators are asking for, and the parts of this work nobody puts in a brochure. Written by the people who run the engagements.
UAE regulation
The UAE rules that apply to IoT security testing: CBUAE, NESA and DESC
CBUAE, NESA, DESC and ADHICS each reach connected devices differently. This is who is bound, what they require and what testing evidence satisfies each regime.
Joel Aviad OssiRed Team Lead, RedTeam SecurityMore articles
RSS
What an IoT pentest report must contain
Structure, evidence requirements and the retest record for firmware, radio, hardware and cloud findings from an IoT security test.
Joel Aviad OssiRed Team Lead, RedTeam Security
How to buy an IoT pentest: scope, handover and what the proposal must say
Define scope, hand over the right assets and evaluate proposals for an IoT security test covering firmware, radio, hardware and the cloud backend.
Joel Aviad OssiRed Team Lead, RedTeam Security
What your monitoring should catch during an IoT pentest
The network, cloud and firmware signals that should fire when a tester probes your IoT estate. Covers device, radio and API-layer monitoring.
Joel Aviad OssiRed Team Lead, RedTeam Security
How an IoT pentest is run: firmware, radio, hardware and the cloud side
An IoT pentest covers firmware, radio protocols, hardware debug interfaces and the cloud backend. Learn the phases, what to prepare and what the report covers.
Joel Aviad OssiRed Team Lead, RedTeam Security
The UAE rules that require adversary simulation: what CBUAE, NESA, DESC and ADHICS ask for
Which UAE regulations require threat-led adversary simulation, what they ask for, and how CBUAE, NESA, DESC and ADHICS define the evidence.
Joel Aviad OssiRed Team Lead, RedTeam Security
How to buy an adversary simulation: scope, threat profile and what the report must prove
What to scope, what the threat profile must name, and what output proves the exercise was worth the investment. A buying guide for adversary simulation.
Joel Aviad OssiRed Team Lead, RedTeam Security
How an adversary simulation is planned: threat profile and objectives
How to build the threat profile, set objectives and write rules of engagement for an adversary simulation. Methodology for UAE security teams.
Joel Aviad OssiRed Team Lead, RedTeam Security
Detection coverage in an adversary simulation: which controls fire and which stay silent
What your SIEM, EDR and network monitoring should catch during an adversary simulation, and how to act on the TTPs that generated no alert.
Joel Aviad OssiRed Team Lead, RedTeam Security
What a software packer hides from static scanners and what it leaves in memory
A packer wraps malware so static scanners see only a stub. This walks the OEP chase, memory dump and import reconstruction used in adversary simulation.
Joel Aviad OssiRed Team Lead, RedTeam Security
How to buy a social engineering test: what the proposal must say
What a social engineering testing proposal must contain, what red flags to reject, and how to evaluate deliverables before you sign.
Joel Aviad OssiRed Team Lead, RedTeam Security
How a social engineering test is scoped: pretext, channels and rules of engagement
Define target population, channel mix and rules of engagement before the first pretext runs. A scoping guide for social engineering testing.
Joel Aviad OssiRed Team Lead, RedTeam SecurityLet's talk about your security
Tell us the objective you want tested. We will come back with a scope, a timeline and a quote.
Email [email protected]Nadd Hessa, Dubai Silicon Oasis
Dubai, United Arab Emirates