RTASS - 红蓝对抗量化评估系统（Red Team Assessment Scoring System）

项目说明

中文 | English

Red Team Assessment Scoring System (RTASS) 1.0.5

> Red Team Assessment Scoring System
>
> Github: <
>
> License: Apache
>
> Maintainer: Monyer, Collaborators: devils, makato, vf3ng
>
> Online Calculator <

Introduction

The Red Team Assessment Scoring System (RTASS) is an open framework used to assess the capability in of both offensive and defensi in a single cyber red-blue confrontation or actual combat exercise, as well as the degree of risk faced by the business and the enterprise in. Through RTASS, it is possible to quantify the risk status of attackers, defenders, business parties and enterprises in the red-blue ad network attack and defense drills. This framework is suitable for security assessment scenarios that conduct real network attacks on enterprises by simulating hacker APT methods, such as network red-blue confrontation drills, network actual offensive and defensi, red team assessments, and blue army assessments.

> RTASS is founded, owned, and managed by the JD.Army team. JD.Army is a professional red team which focuses on exca and solving the hidden security risks of enterprise safe operation. JD.Army reserves the right to update RTASS and this document regularly at its sole discretion. Although JD.Army owns all the rights and interests in RTASS, it permits the public to use it freely and follows the Apache open source agreement.

Background

Years ago, companies often assessed their own security by simply using "penetration testing" to find in indi application systems. To assess the criticality of , the National Infrastructure Ad Council (NIAC) de a Common Assessment System, CVSS, hosted by the Forum for Incident Response and Security Teams (FIRST). Based on the previous , FIRST has continued to iterate the v2 and v3 . The hazard assessment criteria for a single are more and more accurate and perfect, and are also used by major security organizations and recording platforms. With the de of network security, the threats to the network are increasing day by day. By simulating the APT attack methods and behaviors of hackers, the red-blue confrontation exercise method to carry out comprehensi assessment on enterprises has been widely adopted. Some organizational units have also de some scoring systems in order to e between attackers and defenders. However, this scoring system can only measure the difference between the attacker and the attacker, and between the defender and the defender. In the case of only one attacking team and one defending team, the problem is even more prominent: if the core system is breached, does it mean that the attacking team is strong or the defending team is weak? If the core system is not broken, is the attacking team weak or the defending team strong? This is very difficult to measure, and there is no mature system for e in the industry. Therefore, JD.Army has de a red-blue confrontation scoring framework for the actual combat exercise scenario based on years of cyber offensive and defensi and red-blue confrontation experience, referring to CVSS and OWASP risk rating methods.

Methods

RTASS consists of two categories, "Confrontation Factors" and "Business Factors".

Confrontation FactorsMainly measure their respecti from the perspective of offense and defense, e the lethality of key in the penetration path, and finally combine business factors to form "offensi" and "defensi" scores.It consists of process factors and scores such as Offensi, Defensi, Risk.

Offensi to the highest level of attack technology used by the attacker on the key penetration path in a single red-blue confrontation exercise.

Defensi to the minimum level of defensi used by the defending team on the key penetration path in a single red-blue confrontation exercise.

RiskRefers to the risk assessment of the most critical on the critical penetration path of the drill in a single red-blue confrontation exercise.

Business FactorsIt mainly e from the perspective of the impact on the enterprise, the level of business security capabilities, and the three elements of CIA information security, and finally combines the offensive and defensi to form the "business risk" and "enterprise risk" scores.It consists of process factors and scores such as Offensi, Defensi, Risk.

Offensi to the highest level of attack technology used by the attacker on the key penetration path in a single red-blue confrontation exercise.

Defensi to the minimum level of defensi used by the defending team on the key penetration path in a single red-blue confrontation exercise.

RiskRefers to the risk assessment of the most critical on the critical penetration path of the drill in a single red-blue confrontation exercise.

Why must it be "critical path" and "highest", "lowest", "largest" and "most critical"?

This is because in a single red-blue confrontation, the attacker can adopt different strategies to form different attack paths, and use dozens or hundreds of different TTPs in the attack path. If these TTPs are measured in turn, it is ob unrealistic and greatly increases the workload of the e.

Security follows the "short board principle" as well as the "long board principle" - the attacker does not need to ensure that every TTPs in is the highest technical ability, as long as there are one or several attacks on the critical path High-le may take down corporate targets. So we take the highest level of attack attackers invest in the critical path as a measure of their offensi.

Ob, we can also see that the strength of the attacker does not represent the total effecti in of the attacker in a single red-blue confrontation exercise. Let's take physics as an analogy: the maximum force a person exerts on an object does not represent the effective work the person does on the object. Therefore, in order to measure the "work" of the attacker, we introduce the concept of "offensi" to represent the total effecti of the attacker in a single red-blue confrontation exercise, that is, the technical level of the attacker in this exercise.

RTASS uses the e factor to form 6 process scores, and the process scores are combined in different ways to form four different roles for the attacker, defender, business, and enterprise. Item final score: Offensi, Defensi, Business Risk, Enterprise Risk. These 4 items refer to the situation in a single exercise, so in different exercises, the score may be different. The scoring methods and factors will be described in detail below.

Offensi[OE, Offensi]

Offensi[OE] is calculated from 3 process scores such as Offensi[OS], Defensi[DS], Enterprise Impact[EI], It is the effecti of the attacker in a single exercise, which can represent the level of the attacker in this exercise.

> Offensi: OE = ( OS * 1 + DS * 1 + EI * 1 )/3

The offensi represents the highest level of the attacker's attack output in this red-blue confrontation. But other factor scores are needed to correct it: if a very ad technique is used, it takes a lot of effort, but no effect is achieved, then it is equi to doing useless work in this exercise, which means that the offensi is very low.The introduction of the "defensi" factor is to correct the effecti of the "offensi" in terms of ability. Generally speaking, the stronger the defense is, the stronger the attack is on the premise of achieving the same goal; on the contrary, if the defender is weaker, the attacker can usually have less in in order to achieve the goal. Offensi is not so great."Enterprise Impact" is a measure of the effecti of an attacker's "work done". The more enterprise risks exposed in a single exercise, the stronger the attacker's energy; the less enterprise risks exposed in countermeasures, the lower the attacker's energy in the exercise.

Defensi[DE, Defensi]

Defensi[DE] is calculated from 3 process scores such as Defensi[DS], Risk[VR], Enterprise Impact[EI], It is the effecti of the defender in a single exercise, and can represent the level of the defender in this exercise.

> Defensi: DE = ( DS * 1 + ( 10 - VR ) * 1 + ( 10 - EI ) * 1 )/3

The defensi is generally the lower level of the defender's defensi output in this red-blue confrontation. But you can't simply think that "defensi" is the embodiment of defensi. Because no matter how strong the defense is, if the target is finally taken by the attacker, it still shows that the defense ability is low.The introduction of risk is to correct the effecti of "defensi" in ability, which is negatively correlated with defensi. The higher the risk, the lower the defensi. Even if the defensi is very strong, but a serious risk is exposed on the critical path of the offense, it means that the defensi has not been fulfilled, and points should be deducted.Corporate influence is negatively correlated with defensi, the greater the corporate influence, the lower the defensi. Even if the defense is strong and the loopholes are small, it can still have a significant impact on the enterprise, indicating that the effecti generated by the defense is not enough, and points should be deducted.

Business Risk[BR, Business Risk]

Business Risk[BR] is calculated from 3 process scores such as Technical Impact[TI], Enterprise Impact[EI], Business Strength[BS], It refers to the risk level of business exposure in terms of security, which can represent the security level of the participating business parties in this exercise.

> Business Risk: BR = ( TI * 1 + EI * 1 + ( 10 - BS ) * 1 )/3

The technical impact is mainly measured from the three elements of security: confidentiality, integrity and a. The greater the technical impact of the business, the higher the risk of the business.Enterprise impact is closely related to business risks. If it can bring a greater impact on the enterprise, whether it is economic loss, loss of goodwill or compliance impact, it will affect the de of the enterprise to a large extent, and then affect the de of the business.Business strength is mainly reflected in the implementation of SDL or De. If there is a problem, it will bring great obstacles to the promotion of security and the elimination of risks, which will cause major risks to the business. Therefore, business strength is negatively correlated with business risk score, and the lower the strength, the greater the risk.

Enterprise Risk[ER, Enterprise Risk]

Enterprise Risk[ER] is calculated from 3 process scores such as Defensi[DS], Risk[VR], Enterprise Impact[EI], It refers to the degree of risk exposed by the enterprise in terms of security, which can represent the security level of the enterprise as a whole in this exercise.

> Enterprise Risk: ER = ( ( 10 - DS ) * 1 + VR * 1 + EI * 1 )/3

Defensi is negatively correlated with corporate risk. If an enterprise does not invest much in security construction, it will generally directly affect its protection capability, detection capability and response capability, that is, its defensi. On the other hand, if the defensi of the enterprise is weak, it means that the enterprise is facing problems in safety construction or defensive team building, which will make the enterprise face more risks.If the key on the penetration path are very easy to be discovered, exploited, and ha lethality, it generally means that the defense has a relatively large problem in the daily security operations, SDL or De security process landing, and the risk of the enterprise Sex will increase.The "corporate impact" is more related to the normal operation, revenue and even life and death of the company, so it is related to corporate risks.

The abo may change with the e of RTASS.

In this scoring framework, each scoring factor has a total of 5 scoring items from 0 to 4. The process score and final score: the lowest score is 0 points, and the highest score is 10 points. Among them, the distribution of the corresponding grades for each score is as follows:

| Score | Level |
| ------------ | ------- |
| 0.00 | None |
| 0.01 - 3.99 | Low |
| 4.00 - 6.99 | Medium |
| 7.00 - 8.99 | High |
| 9.00 - 10.00 | Extreme |

> Note: Some scoring factors in this framework, such as " risk" and "enterprise impact", refer to the relevant factors in the OWASP risk rating method.

Score Factor

Confrontation Factors

Confrontation Factors consists of 3 parts, such as Offensi, Defensi, Risk.

#### Offensi[OS]

Offensi is calculated from 4 factor scores such as Offensi[OL], Offensi[OD], Target Reach[TR], Anti-traceability Level[AL]. The calculation algorithm is:

> Offensi[OS] = ( OL * 1 * 2.5 + OD * 1 * 2.5 + TR * 1 * 2.5 + AL * 1 * 2.5 )/4

##### Offensi[OL]

Offensi mainly used for e when The highest level of skill used by the attacker in the e path.

0 - equi to entry-le

1 - Equi to a normal le or a tool, script hacker

2 - equi to a hacker proficient in penetration techniques

3 - Requires more professional teamwork

4 - Equi to National APT Hacking Team

##### Offensi[OD]

Offensi mainly used for e when The highest difficulty the attacker has to solve the puzzle in the entire e path.

0 - almost no difficulty for professional hackers

1 - a bit difficult for professional hackers

2 - more difficult for professional hackers

3 - difficult for professional hackers

4 - Almost impossible for professional hackers

##### Target Reach[TR]

Target Reach mainly used for e when Whether the attacker achieved the intended goal

0 - basically not achieved

1 - small amount achieved

2 - medium reached

3 - Mass Achie

4 - Fully Achieved

##### Anti-traceability Level[AL]

Anti-traceability Le used for e when What is the attacker's ability to trace back to the source?

0 - The attacker's real identity information is traced to the source, or the attacking asset or computer is re controlled

1 - The attacker's identity feature or the real IP in the territory is traced

2 - The attacker's persistent attack behavior is marked by fingerprints, or a large number of indicators of attack (IOAs) are marked by records (honeypots, etc.)

3 - The attacker's fixed C2 server IP or fixed tunnel return IP is traced back to the source

4 - hardly any useful information can be traced back to the source

#### Defensi[DS]

Defensi is calculated from 4 factor scores such as Pre Level[PL], Detection Level[DL], Response Level[RL], Traceability Level[TL]. The calculation algorithm is:

> Defensi[DS] = ( PL * 1 * 2.5 + DL * 1 * 2.5 + RL * 1 * 2.5 + TL * 1 * 2.5 )/4

##### Pre Level[PL]

Pre Le used for e when A defender's ability to block critical penetration paths.

0 - almost no interception

1 - slight interception

2 - stronger interception

3 - very strong interception

4 - almost hard to break

##### Detection Level[DL]

Detection Le used for e when Defender's cyber threat discovery capabilities for critical penetration paths.

0 - almost no threat detected

1 - Threat of sporadic attack on non-critical assets detected

2 - few critical path threats detected

3 - Significant critical path threats detected

4 - Nearly all threats detected

##### Response Level[RL]

Response Le used for e when Defender's ability to recover, repair, and respond to a compromised system.

0 - almost difficult to advance (3+ days)

1 - slow response (12+ hours)

2 - The response is more timely (within 12 hours)

3 - Response near real time (within 2 hours)

4 - Real-time response (within 30 minutes)

##### Traceability Level[TL]

Traceability Le used for e when Whether the defender can effectively trace the source of the attacker.

0 - hardly any useful information can be traced back to the source

1 - The attacker's fixed C2 server IP or fixed tunnel back-up IP is traced back to the source

2 - The attacker's persistent attack behavior is marked by fingerprints, or a large number of indicators of attack (IOAs) are marked by records (honeypots, etc.)

3 - The attacker's identity feature or the real IP in the territory is traced

4 - The attacker's real identity information is traced, or the attacked assets or computers are re controlled

#### Risk[VR]

Risk is calculated from 4 factor scores such as Disco[VD], Exploitability[VE], Lethality[VL], Disclosure Window[VDW]. The calculation algorithm is:

> Risk[VR] = ( VD * 1 * 2.5 + VE * 1 * 2.5 + VL * 1 * 2.5 + VDW * 1 * 2.5 )/4

##### Disco[VD]

Disco mainly used for e when Disco of critical in the penetration path.

0 - almost impossible to find

1 - harder to spot for professional hackers

2 - Medium difficulty to find for professional hackers

3 - For professional hackers, discovery is easier

4 - Discovery with common automation tools

##### Exploitability[VE]

Exploitability mainly used for e when Exploitability of critical in the penetration path.

0 - almost impossible to exploit

1 - Difficult to exploit for professional hackers

2 - Moderately difficult to exploit for professional hackers

3 - easier to exploit for professional hackers

4 - Can be exploited using common automation tools

##### Lethality[VL]

Lethality mainly used for e when Maximum lethality for critical in the penetration path.

0 - almost no harm

1 - lower lethality, affects indi non-core assets

2 - medium-scale lethality, affecting a subset of non-core assets

3 - Massi, affecting indi core assets

4 - Extremely broad lethality, affecting a subset of core assets

##### Disclosure Window[VDW]

Disclosure Window mainly used for e when The maximum exposure time window for critical in the penetration path.

0 - little public disclosure

1 - Small-scale private dissemination of hacker circles

2 - Public disclosure less than 3 days

3 - public disclosure greater than 3 days

4 - Public disclosure greater than 1 week

Business Factors

Business Factors consists of 3 parts, such as Technical Impact, Enterprise Impact, Business Strength.

#### Technical Impact[TI]

Technical Impact is calculated from 3 factor scores such as Loss of Confidentiality[LC], Loss of Integrity[LI], Loss of A[LA]. The calculation algorithm is:

> Technical Impact[TI] = ( LC * 1 * 2.5 + LI * 1 * 2.5 + LA * 1 * 2.5 )/3

##### Loss of Confidentiality[LC]

Loss of Confidentiality mainly used for e when How much data can be leaked and how sensitive it is.

0 - cannot cause data leakage

1 - can leak a small amount of non-sensitive data

2 - can leak large amounts of non-sensitive data

3 - A small amount of sensitive data can be leaked

4 - Can reveal large amounts of sensitive data

##### Loss of Integrity[LI]

Loss of Integrity mainly used for e when How much data might be damaged and how much.

0 - no data corruption

1 - can corrupt a small amount of non-core data

2 - can corrupt a lot of non-core data

3 - can corrupt a small amount of core data

4 - can corrupt a lot of core data

##### Loss of A[LA]

Loss of A mainly used for e when How much service can be lost and how important it is.

0 - no business interruption

1 - Can cause a small amount of non-core business disruption to the business

2 - Can cause substantial disruption to the non-core business of the enterprise

3 - Can cause a small amount of disruption to the company's core business

4 - Can cause substantial disruption to the company's core business

#### Enterprise Impact[EI]

Enterprise Impact is calculated from 3 factor scores such as Financial Damage[FD], Reputation Damage[RD], Compliance Impact[CI]. The calculation algorithm is:

> Enterprise Impact[EI] = ( FD * 1 * 2.5 + RD * 1 * 2.5 + CI * 1 * 2.5 )/3

##### Financial Damage[FD]

Financial Damage mainly used for e when the greatest impact on the business economy.

0 - less than the cost of fixing the bug

1 - will not have a significant impact on the company's annual profit

2 - Can affect a certain company's annual profit

3 - Significant impact on the company's annual profit

4 - Significant impact on the company's annual profit

##### Reputation Damage[RD]

Reputation Damage mainly used for e when Whether it will cause damage to the company's reputation and thus damage the business.

0 - no loss of goodwill

1 - May cause slight damage to goodwill

2 - Can cause serious damage to goodwill

3 - Can lead to large or large customer churn

4 - Can cause significant brand damage

##### Compliance Impact[CI]

Compliance Impact mainly used for e when How much breach risk arises from a problem that arises or a malicious action by an attacker.

0 - no risk of

1 - can create a slight risk of non-compliance

2 - Can cause a more obvious risk of

3 - Can create a very high profile breach risk

4 - Serious or Contribution to

#### Business Strength[BS]

Business Strength is calculated from 3 factor scores such as De Life Circle[DLC], Operation Life Circle[OLC], Employment Security Awareness[ESA]. The calculation algorithm is:

> Business Strength[BS] = ( DLC * 1 * 2.5 + OLC * 1 * 2.5 + ESA * 1 * 2.5 )/3

##### De Life Circle[DLC]

De Life Circle mainly used for e when Whether there are security issues identified in the software de life cycle.

0 - almost no security concerns

1 - There are a lot of security process issues

2 - has a moderate amount of security process issues

3 - There are minor security process issues

4 - basically no security process issues

##### Operation Life Circle[OLC]

Operation Life Circle mainly used for e when Whether there are security issues found in the operation and maintenance life cycle.

0 - almost no security concerns

1 - There are a lot of security process issues

2 - has a moderate amount of security process issues

3 - There are minor security process issues

4 - basically no security process issues

##### Employment Security Awareness[ESA]

Employment Security Awareness mainly used for e when Whether the majority of employees ha awareness issues during the assessment process.

0 - almost no security awareness

1 - Most of the employees in key positions have weak safety awareness

2 - A small number of employees in key positions have weak safety awareness

3 - Most of the employees in key positions have high safety awareness

4 - All staff have high safety awareness

Score Ability

In order to be able to measure the scoring factor in more detail, RTASS de the Plus on the basis of the Base , adding a more refined "ability factor" to the scoring factor. With the capability factor, RTASS can not only make a macro e of the attackers, defenders, business parties and enterprises, but also indicate the strengths and weaknesses of their capability points and the direction that needs to be further improved in a more detailed manner. As of now, the following scoring factors ha options:

Offensi[OL]

Offensi consists of 11 parts, such as Intelligence Reconnaissance Capability[IRC], Weaponization Capability[WC], Mining and Exploitation Capability[VMEC], Anti Threat Detection Capability[ATDC], Social Engineering Capability[SEC], Permission Persistence Capability[PPC], Tunnel Construction Capability[TCC], Lateral Mo Capability[LMC], AI-Assisted Offensi[AIOC], Supply Chain Attack Capability[SCAC], Cloud Nati Capability[CNAC]. The calculation algorithm is:

> Offensi[OL] = ( IRC * 1 + WC * 1 + VMEC * 1 + ATDC * 1 + SEC * 1 + PPC * 1 + TCC * 1 + LMC * 1 + AIOC * 1 + SCAC * 1 + CNAC * 1 )/11

##### Intelligence Reconnaissance Capability[IRC]

Intelligence Reconnaissance Capability mainly used for e when The attacker's capabilities in the information gathering, intelligence reconnaissance phase

0 - Could not obtain valid intelligence information

1 - Basic IT asset and network information collection capabilities

2 - Strong asset collection ability, able to find remote and assets; strong organizational personnel reconnaissance ability, able to find key social work targets

3 - Ability to fully grasp the intelligence of the target organization, operations, collaboration, personnel, assets, security, network architecture, etc. through active and passi, and formulate targeted attack plans

4 - Under the premise that the target is not aware of the target, it can grasp the o picture of the online and offline operations of the target enterprise and the details of the target, accurately draw the attack path, and quickly and accurately find the stronghold establishment plan

##### Weaponization Capability[WC]

Weaponization Capability mainly used for e when Attacker capabilities during the weaponization, resource de phase

0 - no programming or programming ability

1 - Ability to write simple script EXP

2 - Ability to write more complex penetration tools

3 - Able to develop C2, automated penetration platform

4 - Ability to design and implement ad complex nuclear bomb-le (eg Stuxnet, Bvp47, Wannacry, etc.)

##### Mining and Exploitation Capability[VMEC]

Mining and Exploitation Capability mainly used for e when Attacker's black and white box mining ability and actual combat exploitation ability

0 - Unable to find exploits or exploited exploits successfully

1 - Able to exploit general in applications and exploit them successfully

2 - Ability to mine and exploit highly complex in applications

3 - Ability to mine common component or middleware and exploit them successfully

4 - Ability to mine operating system and common system component-le and exploit them successfully

##### Anti Threat Detection Capability[ATDC]

Anti Threat Detection Capability mainly used for e when Attacker's ability to bypass WAFs, firewalls, antivirus, and threat detection devices

0 - Little means or ability to counter threat detection systems

1 - Able to bypass WAF, NGFW and other defenses to achie exploitation

2 - It can bypass anti-virus, HIDPS and other defense methods to achieve C2 online without alarm

3 - Low threat perception during RBI and intranet lateral mo

4 - In the case of extremely strong defensi, non-perceptual, long-term, and stable target action can be achie target breakthrough

##### Social Engineering Capability[SEC]

Social Engineering Capability mainly used for e when The attacker's social engineering capabilities on the network or on the ground and the success rate

0 - cannot implement successful social work

1 - Successful social worker with access to general staff

2 - Successful social work and access to security awareness trained non-security practitioners

3 - Successful social work and authorization for those who are engaged in security positions

4 - Able to successfully social work and gain access to the most professional security engineers

##### Permission Persistence Capability[PPC]

Permission Persistence Capability mainly used for e when The attacker's ability to maintain permissions on the foothold after gaining initial access

0 - Unable to maintain stability and continuity of stronghold authority

1 - Enables long-term stable execution of basic orders at the base

2 - In permission maintenance in case of reboot

3 - Ability to execute more commands without perceptually ele the base's pri

4 - Pri Sustainability After Emergency Response

##### Tunnel Construction Capability[TCC]

Tunnel Construction Capability mainly used for e when Attacker's ability to build tunnels after gaining initial access

0 - Unable to build a smooth and stable tunnel

1 - Able to build a simple springboard to achieve C2 online and intranet roaming

2 - Ability to build multi-le tunnels according to the needs of the en

3 - Ability to hide springboard traffic into normal network traffic to achie insensitivity

4 - On the basis of the former, it can penetrate the target multi-layer intranet and use a of different protocols to build long-term and stable tunnel links

##### Lateral Mo Capability[LMC]

Lateral Mo Capability mainly used for e when After gaining initial access, the attacker gains more permissions and expands the network expansion capabilities of the results

0 - The base is the end point, no continuous network expansion capability

1 - The identity and location of the base can be confirmed through information collection, and useful intelligence information can be obtained

2 - On the basis of the former, it can conduct non-perceptual intranet spying, find a lateral mo path or target to move

3 - On the basis of the former, access credentials can be obtained and the credentials can be successfully used for lateral mo

4 - On the basis of the former, non-perceptual lateral mo is realized through complex technical means such as puddles, social work, and supply chains.

##### AI-Assisted Offensi[AIOC]

AI-Assisted Offensi mainly e the attacker's ability to le AI/LLM technology to assist attacks, including AI-generated phishing content, mining, automated penetration, etc.

0 - No use of AI technology to assist attacks

1 - Use basic AI tools (such as ChatGPT) to generate phishing emails or simple attack scripts

2 - Use AI for analysis, code review, or generate complex attack payloads

3 - Use AI for automated penetration testing, intelligent e of security detection

4 - Able to develop or use AI-dri attack systems to achie automated APT operations

##### Supply Chain Attack Capability[SCAC]

Supply Chain Attack Capability mainly e the attacker's ability to carry out attacks through software supply chains, third-party components, or de tool chains

0 - No supply chain attack capability

1 - Able to exploit known in third-party components or open source libraries

2 - Able to tamper with public software packages or inject malicious code into open source projects

3 - Able to infiltrate target suppliers or partners to carry out targeted supply chain attacks

4 - Able to infiltrate target core suppliers or de en to implement ad persistent supply chain attacks (such as SolarWinds level)

##### Cloud Nati Capability[CNAC]

Cloud Nati Capability mainly e the attacker's attack capability against cloud infrastructure, containers, K8s, and cloud service misconfigurations

0 - No cloud nati capability

1 - Able to exploit basic cloud service misconfigurations (such as S3 bucket permissions, exposed cloud databases)

2 - Able to attack container escape, Docker/K8s misconfigurations

3 - Able to exploit cloud platform IAM permission escalation, cross-tenant attacks

4 - Able to carry out ad cloud nati, including cloud control plane attacks, service mesh hijacking, etc.

Target Reach[TR]

Target Reach consists of 3 parts, such as Goal Achie Time[GAT], Goal Achie Cost[GAC], Goal Action Ability[GAA]. The calculation algorithm is:

> Target Reach[TR] = ( GAT * 1 + GAC * 1 + GAA * 1 )/3

##### Goal Achie Time[GAT]

Goal Achie Time mainly used for e when The minimum time to achie control of the target by an attacker.

0 - The breakout control of the target system has not been completed within the set time

1 - The target breakthrough was not completed within the set time, but the breakthrough control of multiple core systems

2 - Complete the breakthrough control of some targets within the set time

3 - Complete the main core target breakthrough control within 1-3 weeks

4 - Complete the main core target breakthrough control within 1-3 days

##### Goal Achie Cost[GAC]

Goal Achie Cost mainly used for e when The work cost of weapons, manpower, , etc. that the attacker needs to pay in order to achieve the goal

0 - Se making ends meet

1 - great cost (nuclear 0day, etc.)

2 - Larger cost (generic 0day, etc.)

3 - lower cost

4 - almost no cost

##### Goal Action Ability[GAA]

Goal Action Ability mainly used for e when The attacker's ability to maximize the ability to achieve the ultimate goal after gaining access to the target

0 - Unable to achie action on target

1 - Partial data leakage to target can be achieved

2 - A partial operational impact on the target can be achieved

3 - Full data leakage to the target can be achieved

4 - Full data exfiltration can be accomplished without perception, or with long-term lasting effects

Pre Level[PL]

Pre Le of 10 parts, such as Information Event Management Capability[IEMC], Software Update Management Capability[SUMC], Threat Identification Blocking Capability[TIBC], Baseline Security Management Capabilities[BSMC], Account Security Management Capabilities[ASMC], Pri Security Management Capability[PSMC], Network Access Control Capability[NACC], Zero Trust Architecture Capability[ZTAC], Cloud Security Management Capability[CSMC], API Security Capability[APSC]. The calculation algorithm is:

> Pre Level[PL] = ( IEMC * 1 + SUMC * 1 + TIBC * 1 + BSMC * 1 + ASMC * 1 + PSMC * 1 + NACC * 1 + ZTAC * 1 + CSMC * 1 + APSC * 1 )/10

##### Information Event Management Capability[IEMC]

Information Event Management Capability mainly used for e when Defender's ability to manage logs and events

0 - The implementation of log management specifications is not in place, and a large number of logs are missing

1 - Decentralized logging and event tracing capabilities

2 - There is a centralized security log and event management system

3 - Ability to classify and summarize log events, identify, rate and alert on threats

4 - Comprehensive and systematic log incident response and automated security operations capabilities

##### Software Update Management Capability[SUMC]

Software Update Management Capability mainly used for e when The defender's management capabilities for software, systems, components, and dependencies.

0 - No software update management capabilities, with a large number of long-term critical

1 - Timely security updates can be made to the operating system patches of production servers

2 - On the basis of the former, the software commonly used in de, operation and maintenance, and employee office terminal software can be managed in a unified manner and updated safely in a timely manner

3 - On the basis of the former, management and timely security updates can be performed on the system, container service programs, and middleware

4 - On the basis of the former, management and timely security updates can be performed on the components that the application relies on and references

##### Threat Identification Blocking Capability[TIBC]

Threat Identification Blocking Capability mainly used for e when Ability to identify and block threats on internal and external networks and terminals.

0 - No threat identification blocking facility

1 - There are border traffic protection and blocking facilities

2 - On the basis of the former, there are internal traffic protection and blocking facilities

3 - On the basis of the former, there are endpoint protection and blocking facilities

4 - On the basis of the former, there are security orchestration and automated response facilities

##### Baseline Security Management Capabilities[BSMC]

Baseline Security Management Capabilities mainly used for e when The defender's baseline security management capability for systems and applications.

0 - No baseline security management capability

1 - With service security configuration and audit log baseline management

2 - Based on the former, there is access control baseline management

3 - On the basis of the former, there are account permissions and authentication authorization baseline management

4 - On the basis of the former, there are security testing and e processes for services, networks, and supply chains

##### Account Security Management Capabilities[ASMC]

Account Security Management Capabilities mainly used for e when Defenders ha management of accounts and dynamic threat identification capabilities.

0 - no unified identity management capability

1 - Unified account management and authentication

2 - More secure authentication techniques (go password or MFA etc.)

3 - Unified Identity Management Based on Trusted Devices

4 - Dynamic Adaptive and Continuous Authentication

##### Pri Security Management Capability[PSMC]

Pri Security Management Capability mainly used for e when Defenders ha access and dynamic management and control capabilities for accounts.

0 - no authority unified management capability

1 - Unified functional granularity rights management (authorization, authentication, etc.)

2 - Ongoing E and Online Go of Pri Minimization

3 - Unified data granularity rights management

4 - Continuous E and Dynamic Control of Pri Abuse Pre

##### Network Access Control Capability[NACC]

Network Access Control Capability mainly used for e when Access control and granularity between networks and terminals inside and outside the enterprise.

0 - the network does not perform any access control

1 - The office network is isolated from the production network and accessed through the bastion machine

2 - On the basis of the former, there is network isolation between external customer service and internal employee service

3 - On the basis of the former, there is network isolation between different application services

4 - On the basis of the former, there are more fine-grained micro-isolation capabilities

##### Zero Trust Architecture Capability[ZTAC]

Zero Trust Architecture Capability mainly e the enterprise's zero trust security architecture construction and implementation level, including identity , least pri, continuous , etc.

0 - No zero trust architecture construction

1 - Has basic identity authentication and access control capabilities (such as MFA, VPN)

2 - Has implemented zero trust network access (ZTNA) for some core systems

3 - Has built a relatively complete zero trust architecture co identity, device, network, and application layers

4 - Has implemented a dynamic adaptive zero trust architecture with continuous risk assessment and automated policy adjustment capabilities

##### Cloud Security Management Capability[CSMC]

Cloud Security Management Capability mainly e the enterprise's cloud security posture management (CSPM), cloud workload protection (CWPP), and cloud nati protection (CNAPP) capabilities

0 - No cloud security management capability

1 - Has basic cloud resource in and configuration compliance checking capabilities

2 - Has cloud security posture management (CSPM) capabilities, able to discover and fix cloud misconfigurations

3 - Has cloud workload protection (CWPP) capabilities, able to protect containers and machines

4 - Has complete cloud nati protection platform (CNAPP) capabilities, achieving full lifecycle cloud security management

##### API Security Capability[APSC]

API Security Capability mainly e the enterprise's API asset discovery, risk assessment, runtime protection, and full lifecycle security management capabilities

0 - No API security management capability

1 - Has basic API in and documentation management

2 - Has API security testing and scanning capabilities

3 - Has API runtime protection capabilities (such as API Gateway, rate limiting, authentication)

4 - Has complete API security lifecycle management, including discovery, testing, monitoring, and threat protection

Detection Level[DL]

Detection Le of 10 parts, such as External Threat Traffic Awareness[ETTA], External Harpoon Attack Awareness[EHAA], Proximity Penetration Attack Awareness[PPAA], Intranet Threat Traffic Awareness[ITTA], Endpoint Malware Awareness[EMA], Endpoint Abnormal Behavior Awareness[EABA], Threat Detection Rate[TDR], Threat Identification Timeliness Rate[TITR], Extended Detection and Response Capability[XDRC], Threat Intelligence Platform Capability[TIPC]. The calculation algorithm is:

> Detection Level[DL] = ( ETTA * 1 + EHAA * 1 + PPAA * 1 + ITTA * 1 + EMA * 1 + EABA * 1 + TDR * 1 + TITR * 1 + XDRC * 1 + TIPC * 1 )/10

##### External Threat Traffic Awareness[ETTA]

External Threat Traffic Awareness mainly used for e when Threat traffic awareness of an enterprise when it is attacked by an external network.

0 - almost no perception

1 - has a small amount of perception

2 - has moderate perception

3 - has a lot of perception

4 - almost all perception

##### External Harpoon Attack Awareness[EHAA]

External Harpoon Attack Awareness mainly used for e when Threat perception and handling capabilities of an enterprise when it is attacked by an external spear.

0 - no perception

1 - Perceives an attack event and is able to capture attack samples

2 - On the basis of the former, it is possible to trace out all the fished persons and alert them

3 - On the basis of the former, it is possible to sense that employees are recruited by phishing, extract terminal samples, and restore the attack method

4 - On the basis of the former, the landing, execution and online actions of the fishing Trojan can be quickly sensed, and can be blocked in time

##### Proximity Penetration Attack Awareness[PPAA]

Proximity Penetration Attack Awareness mainly used for e when The ability of enterprises to perceive and deal with threats when they are subjected to near-source on-the-spot attacks and physical penetration.

0 - almost no perception

1 - After a successful attack, determine the path of the near-source penetration attack through source tracing.

2 - Successfully found traces of near-source penetration through technical monitoring and administrati, including but not limited to collecting U disks, capturing HID attacks, wifi blasting, etc.

3 - On the basis of the former, it can analyze in detail the attack methods and attack processes used by the attackers, including but not limited to the analysis of attack methods against wifi and the analysis of Trojan horses

4 - On the basis of the former, it has independent near-source perception capabilities to quickly detect near-source attacks and block them in time.

##### Intranet Threat Traffic Awareness[ITTA]

Intranet Threat Traffic Awareness mainly used for e when Threat-traffic awareness of an enterprise under attack from the inside.

0 - almost no perception

1 - Can percei full intranet scanning behavior, identify abnormal points and quickly locate the scanning source IP

2 - Based on traffic characteristics, small-scale intranet scans such as C segment can be captured, and the target and purpose can be restored.

3 - On the basis of the former, perception of partial credential exploitation and lateral mo behavior, or data exfiltration behavior

4 - Perception of almost the entire attack process, and the encrypted C2 channel used by the attacker

##### Endpoint Malware Awareness[EMA]

Endpoint Malware Awareness mainly used for e when The threat perception capability of enterprise personal office computers, servers and other terminal devices when they are attacked by malware.

0 - almost no perception

1 - There is a smooth feedback channel for employee security issues, and terminal attacks are quickly detected

2 - Ability to sense endpoint attacks through endpoint detection responses, threat traffic analysis

3 - Capable of capturing attack samples, extracting effecti or host IOC and implementing monitoring and blocking capability deployment

4 - Complete automated sandbox analysis, threat identification intelligence and strategies, security orchestration and automated threat handling mechanisms

##### Endpoint Abnormal Behavior Awareness[EABA]

Endpoint Abnormal Behavior Awareness mainly used for e when The threat perception ability of enterprise personal office computers, servers and other terminal equipment to dangerous operations and abnormal behaviors.

0 - almost no perception

1 - Able to percei network scanning behavior for this machine and alert

2 - Able to perceive the network password blasting behavior against this machine and give an alarm

3 - On the basis of the former, it can perceive the abnormal operation behavior of pri accounts, sensiti and processes on the terminal

4 - On the basis of the former, it can percei remote access behavior between terminals

##### Threat Detection Rate[TDR]

Threat Detection Rate mainly used for e when The co rate of high-risk threats actually identified by the defender through manual or other means after the system detects the threat.

0 - no threat detected (within 12 hours)

1 - detection rate: 0 < N <= 25%

2 - Detection rate: 25% < N <= 50%

3 - Detection rate: 50% < N <= 80%

4 - Detection rate: 80% < N <= 100%

##### Threat Identification Timeliness Rate[TITR]

Threat Identification Timeliness Rate mainly used for e when The timely rate of high-risk threats actually identified by the defender through manual or other means after the system detects the threat.

0 - Threat not identified in time (within 12 hours)

1 - Timely rate: 0 < N <= 25%

2 - Timeliness: 25% < N <= 50%

3 - Timeliness: 50% < N <= 80%

4 - Timeliness: 80% < N <= 100%

##### Extended Detection and Response Capability[XDRC]

Extended Detection and Response Capability mainly e the enterprise's XDR/SOAR platform construction level, achieving unified detection and automated response across endpoints, networks, and cloud

0 - No XDR or SOAR capability

1 - Has basic security event aggregation and correlation analysis capabilities

2 - Has XDR capabilities, able to correlate and analyze threats across endpoints, networks, and cloud

3 - Has SOAR orchestration capabilities, able to automate some response processes

4 - Has complete SOAR automated orchestration and response capabilities, achieving automated threat handling closed loop

##### Threat Intelligence Platform Capability[TIPC]

Threat Intelligence Platform Capability mainly e the enterprise's threat intelligence production, consumption, and operation capabilities, including intelligence source access, IOC linkage, and attacker profiling

0 - No threat intelligence capability

1 - Has basic external threat intelligence source subscription and consumption capabilities

2 - Has threat intelligence platform, able to aggregate multiple intelligence sources and perform IOC matching

3 - Has threat intelligence production capabilities, able to extract and share internal threat intelligence

4 - Has complete threat intelligence operation capabilities, including attacker profiling, TTPs analysis, and threat hunting

Response Level[RL]

Response Le of 3 parts, such as Threat Handling Capability[THC], Threat Disposal Timely Rate[TDTR], Threat Analysis Capability[TAC]. The calculation algorithm is:

> Response Level[RL] = ( THC * 1 + TDTR * 1 + TAC * 1 )/3

##### Threat Handling Capability[THC]

Threat Handling Capability mainly used for e when Threat disposition co by defenders after a threat is detected.

0 - No action taken (within 12 hours)

1 - Disposal rate: 0 < N <= 25%

2 - Disposal rate: 25% < N <= 50%

3 - Disposal rate: 50% < N <= 80%

4 - Disposal rate: 80% < N <= 100%

##### Threat Disposal Timely Rate[TDTR]

Threat Disposal Timely Rate mainly used for e when The defender's timely threat resolution rate after a threat is detected.

0 - No timely disposal (within 12 hours)

1 - Timely rate: 0 < N <= 25%

2 - Timeliness: 25% < N <= 50%

3 - Timeliness: 50% < N <= 80%

4 - Timeliness: 80% < N <= 100%

##### Threat Analysis Capability[TAC]

Threat Analysis Capability mainly used for e when Defender's ability to identify, analyze, and reverse threats

0 - no threat analysis capability

1 - Ability to accurately identify threats and extract valid IOCs

2 - Has automated threat analysis and intelligence sharing mechanisms

3 - Able to perform complex threat analysis, restore attack methods and targets

4 - With automated threat analysis technology and professional reverse analysis capabilities, a complete analysis report can be formed

Traceability Level[TL]

Traceability Le of 3 parts, such as Intrusion Path Traceability Capability[IPTC], Attacker Traceability and Countermeasure Capability[ATCC], Deception and Entrapment Capabilities[DEC]. The calculation algorithm is:

> Traceability Level[TL] = ( IPTC * 1 + ATCC * 1 + DEC * 1 )/3

##### Intrusion Path Traceability Capability[IPTC]

Intrusion Path Traceability Capability mainly used for e when The ability of the defender to trace the intrusion path of the intruder

0 - no intrusion path traceability

1 - Attack path restoration 0 - 25%

2 - Attack path restoration 25% - 50%

3 - Attack path restoration 50% - 80%

4 - Attack Path Recovery 80% - 100%

##### Attacker Traceability and Countermeasure Capability[ATCC]

Attacker Traceability and Countermeasure Capability mainly used for e when The ability of the defender to trace the source to the attacker

0 - hardly any useful information can be traced back to the source

1 - Attacker's C2 server IP or springboard IP is traced

2 - Attackers commonly use identities or real IPs in China to be traced

3 - Attacker's attack asset or computer is re controlled

4 - The real identity information of the attacker is traced to the source

##### Deception and Entrapment Capabilities[DEC]

Deception and Entrapment Capabilities mainly used for e when Enterprise honeypot honeynet construction, and the ability to deceive and trap attackers

0 - no deception trapping ability

1 - Build a high-fidelity honeypot in the network

2 - A highly simulated honeynet is built in the network, which can introduce attackers into the honeynet

3 - Dynamic honeynet capability, which can direct all attacker traffic into the honeynet from the production en

4 - It has perfect secret spraying, honey tagging and honey application customization, honey farm management capabilities, and can realize acti, dynamic adaptation and anti-trapping capabilities

String

With reference to the C framework, RTASS also uses " strings" to record the scoring process and to transmit RTASS indicator information. The RTASS string starts with the label "RTASS:" and the digital representation of the current (for example 1.0.5). The indicator information appears in the form of a set of indicators, each indicator is preceded by a forward slash "/" as a separator. Each indicator is composed of an abbre indicator name, colon, and indicator value. The abbre are defined earlier in this specification (in parentheses after each factor name) and are summarized in the table below.

Factor

| Factor Name | Possible Value |
| ------------------------------------ | -------------- |
| Offensi[OL] | 0-4 |
| Offensi[OD] | 0-4 |
| Target Reach[TR] | 0-4 |
| Anti-traceability Level[AL] | 0-4 |
| Pre Level[PL] | 0-4 |
| Detection Level[DL] | 0-4 |
| Response Level[RL] | 0-4 |
| Traceability Level[TL] | 0-4 |
| Disco[VD] | 0-4 |
| Exploitability[VE] | 0-4 |
| Lethality[VL] | 0-4 |
| Disclosure Window[VDW] | 0-4 |
| Loss of Confidentiality[LC] | 0-4 |
| Loss of Integrity[LI] | 0-4 |
| Loss of A[LA] | 0-4 |
| Financial Damage[FD] | 0-4 |
| Reputation Damage[RD] | 0-4 |
| Compliance Impact[CI] | 0-4 |
| De Life Circle[DLC] | 0-4 |
| Operation Life Circle[OLC] | 0-4 |
| Employment Security Awareness[ESA] | 0-4 |

Ability

> Note: In the RTASS Base scoring mode, the ability factor is not required; in the RTASS Plus scoring mode, the ability factor is required.

| Ability Name | Possible Value |
| --------------------------------------------------------- | -------------- |
| Intelligence Reconnaissance Capability[IRC] | 0-4 |
| Weaponization Capability[WC] | 0-4 |
| Mining and Exploitation Capability[VMEC] | 0-4 |
| Anti Threat Detection Capability[ATDC] | 0-4 |
| Social Engineering Capability[SEC] | 0-4 |
| Permission Persistence Capability[PPC] | 0-4 |
| Tunnel Construction Capability[TCC] | 0-4 |
| Lateral Mo Capability[LMC] | 0-4 |
| AI-Assisted Offensi[AIOC] | 0-4 |
| Supply Chain Attack Capability[SCAC] | 0-4 |
| Cloud Nati Capability[CNAC] | 0-4 |
| Goal Achie Time[GAT] | 0-4 |
| Goal Achie Cost[GAC] | 0-4 |
| Goal Action Ability[GAA] | 0-4 |
| Information Event Management Capability[IEMC] | 0-4 |
| Software Update Management Capability[SUMC] | 0-4 |
| Threat Identification Blocking Capability[TIBC] | 0-4 |
| Baseline Security Management Capabilities[BSMC] | 0-4 |
| Account Security Management Capabilities[ASMC] | 0-4 |
| Pri Security Management Capability[PSMC] | 0-4 |
| Network Access Control Capability[NACC] | 0-4 |
| Zero Trust Architecture Capability[ZTAC] | 0-4 |
| Cloud Security Management Capability[CSMC] | 0-4 |
| API Security Capability[APSC] | 0-4 |
| External Threat Traffic Awareness[ETTA] | 0-4 |
| External Harpoon Attack Awareness[EHAA] | 0-4 |
| Proximity Penetration Attack Awareness[PPAA] | 0-4 |
| Intranet Threat Traffic Awareness[ITTA] | 0-4 |
| Endpoint Malware Awareness[EMA] | 0-4 |
| Endpoint Abnormal Behavior Awareness[EABA] | 0-4 |
| Threat Detection Rate[TDR] | 0-4 |
| Threat Identification Timeliness Rate[TITR] | 0-4 |
| Extended Detection and Response Capability[XDRC] | 0-4 |
| Threat Intelligence Platform Capability[TIPC] | 0-4 |
| Threat Handling Capability[THC] | 0-4 |
| Threat Disposal Timely Rate[TDTR] | 0-4 |
| Threat Analysis Capability[TAC] | 0-4 |
| Intrusion Path Traceability Capability[IPTC] | 0-4 |
| Attacker Traceability and Countermeasure Capability[ATCC] | 0-4 |
| Deception and Entrapment Capabilities[DEC] | 0-4 |

RTASS Base Mode ector string Example:
RTASS:1.0.5/OL:4/OD:0/TR:4/AL:3/PL:1/DL:4/RL:4/TL:1/VD:3/VE:2/VL:4/VDW:4/LC:0/LI:2/LA:2/FD:2/RD:3/CI:1/DLC:2/OLC:2/ESA:3

RTASS Plus Mode ector string Example:
RTASS:1.0.5/OL:1/OD:4/TR:0/AL:3/PL:1/DL:2/RL:4/TL:3/VD:4/VE:4/VL:4/VDW:2/LC:4/LI:1/LA:3/FD:4/RD:1/CI:2/DLC:1/OLC:3/ESA:2/IRC:2/WC:1/VMEC:0/ATDC:1/SEC:1/PPC:2/TCC:1/LMC:0/AIOC:1/SCAC:1/CNAC:1/GAT:3/GAC:2/GAA:4/IEMC:2/SUMC:1/TIBC:3/BSMC:0/ASMC:1/PSMC:0/NACC:0/ZTAC:2/CSMC:2/APSC:1/ETTA:1/EHAA:4/PPAA:0/ITTA:0/EMA:4/EABA:0/TDR:0/TITR:2/XDRC:2/TIPC:1/THC:0/TDTR:1/TAC:3/IPTC:1/ATCC:0/DEC:4

The string should contain all the indicators shown in the table abo any order of measurement. If the string contains the same metric multiple times, the last metric shall prevail.

One Thing About RTASS

In the RTASS framework, the process score is calculated through the basic factors, and then the final score is calculated through the process score. The algorithm reser for future expansion, but in the case of insufficient data at this stage, the modulus of the factor is basically 1.

In solving this problem, C the method of manually constructing a set of lookup tables corresponding to the se of real through the C Interest Group (SIG), and then adjusting the parameters in turn. Finally, it is ensured that the de between the manual e score and the C e score is less than 0.5.

Due to the difference between red and blue confrontation exercises and , it is currently impossible to adjust parameters through a large number of ready-made samples. However, we will continue to collect new samples, through manual e and reference to updated methodology, to make the RTASS score more accurate. This also requires more participation and strong support from you who read this specification.

Collaborate And Contribute

This framework uses JSON format for system description, see "/src/RTASS.json" file for details, where:

The ability score is placed in the "abilities" object, including Chinese and English from 0 to 4 for each factor Score description.

Scoring factors are placed in the "factors" object, including a description of each factor's scores in Chinese and English from 0 to 4.

Process scores are described by "processScores", where "algorithm" is the scoring algorithm.

Final scores are described by "finalScores", where "algorithm" is the scoring algorithm.

The "levels" object stores the correspondence between the scores and the extremes, highs, mediums, and lows.

The "factorGroups" object stores the corresponding relationship between the two groups of offensive and defensi and business factors and the process score.

Collaborators can cooperate with us to develop the system framework by modifying the description of each scoring factor and scoring algorithm in the RTASS.json file.

Thanks

Thanks to devils for his contribution to the competency e model.

Thanks to makato for the comments on each rating item.

Thanks to vf3ng for metrics and comments on the accuracy of the framework e.

References

OWASP, OWASP Risk Rating Methodology

FIRST CVSSv3, CVSSv3.1 Specification Document

Wikipedia, Common Scoring System

RTASS Online Calculator

!calculator-cn

Online Calculator: <

项目信息

开发语言：Vue

Star 数：220

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕红蓝对抗量化评估系统（Red Team Assessment Scoring System）展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	RTASS - 红蓝对抗量化评估系统（Red Team Assessment Scoring System）
所属分类	红蓝攻防
发布作者	admin
发布时间	2026-10-06 00:46:44
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	160
讨论数量	0
主题状态	正常讨论中

RTASS - 红蓝对抗量化评估系统（Red Team Assessment Scoring System）

项目说明

Red Team Assessment Scoring System (RTASS) 1.0.5

Introduction

Background

Methods

Offensi[OE, Offensi]

Defensi[DE, Defensi]

Business Risk[BR, Business Risk]

Enterprise Risk[ER, Enterprise Risk]

Score Factor

Confrontation Factors

Business Factors

Score Ability

Offensi[OL]

Target Reach[TR]

Pre Level[PL]

Detection Level[DL]

Response Level[RL]

Traceability Level[TL]

String

Factor

Ability

One Thing About RTASS

Collaborate And Contribute

Thanks

References

RTASS Online Calculator

项目信息

技术要点

使用与学习建议

免责声明

怎么获取这个资源？

下载链接失效了怎么办？

可以转载或二次发布吗？

下载链接

同分类推荐