1. CHOOSING TIERS BASED ON ATTACKER/THREAT CLASS
Which Tier is best for your environment?
Testing Tier
Attacker/Threat Class Description
1. Basic
Minimal skills
“Script kiddies”
2. Opportunistic
Motivated by profit
Focused on soft targets
3. Targeted
Well funded & sophisticated
High value targets
Patient, but profit driven
4. Advanced
Won’t stop until they’ve tried all angles of attack

2. CHOOSING TIERS BASED ON ENVIRONMENT
Which Tier is best for you?
Testing Tier
Environment Description
1. Basic
Minimum for PCI Compliance
Small environments
First test
2. Opportunistic
Highly segmented/constrained
Cloud environments
A few systems on one network
3. Targeted
Identifies strategic weaknesses
Multiple networks from a single location
Distributed franchises
4. Advanced
No constraints
Social engineering
Client-side attacks
Specialized attacks on customized devices

3. CHOOSING TIERS BASED ON METHODOLOGY
Let’s talk. Call Angela Gibson