How to prioritize Red Team Findings? Presenting CRTFSS: Common Red Team Findings Score System

Red team assessments often produce more findings than defenders can remediate, and building detections for each one takes time. Existing approaches are a poor fit: some depend on CVE identifiers, which many red team findings lack, and others prioritize techniques in general rather than the specific findings from a given engagement. The speaker presents CRTFSS, a scoring method that rates each finding using how often real-world threat actors use the mapped MITRE ATT&CK technique, how hard the technique is to execute, and how hard it is for the blue team to remediate or detect.

The process starts by gathering trend data on frequently observed techniques from threat intelligence. The speaker's implementation uses MITRE's top attack techniques dataset, though any source can be substituted. Each finding is mapped to its ATT&CK ID, frequency is looked up, exploitability and remediation complexity are assigned from reference tables, and the resulting severity is converted into a score for ranking. A worked example follows a fictional firm's simulated assessment, covering phishing, a keylogger, credential dumping, lateral movement and cloud-based exfiltration, and shows how the findings are ordered.

The method is meant for findings from internal or external red teams that were actually demonstrated, not for theoretical issues, and it does not calculate risk. The speaker notes that one technique can appear in several findings and that no single detection covers every variant of a technique. The main takeaway is to use current, real-world intelligence so that limited defensive resources go to the most critical findings first.