Red Team Fundamentals
Red Team Fundamentals: phishing-resistant MFA review
Evaluates phishing-resistant MFA deployments, FIDO2 edge cases, and how attackers narrate failures when secure key integrations are done well.
Description
You will attempt scripted attacks against deliberately weak configurations, then compare outcomes once mentors flip switches to hardened states. The debrief centers on how to document residual risk without shaming product teams.
Features
- FIDO2 lab keys on loan with nightly inventory checks
- Scripted assets only for OTP interception demos in isolated browsers
- Panel on enterprise client procurement realities for token rollouts
- Writing clinic for policy links that point to authoritative internal docs
- Breakout on incident records when users lose hardware tokens
Outcomes
- Produce a before/after risk paragraph suitable for architecture review boards
- Demonstrate two secure key integrations patterns that block cloned prompts
- List three user education moments that measurably reduce help-desk load
FAQ
Do I keep the hardware token?
Loaners must be returned; discounts on personal purchase partners are listed in the welcome packet.
Accessibility?
Contact us for tactile labeling options; we will coordinate before the lab.
What is excluded?
We do not cover SMS-based OTP except as a negative example.
Participant notes
Phishing-resistant MFA review lab clarified how we should phrase residual risk after secure key integrations—language our risk coverage partners accepted quickly.
— Noah Feld , Identity architect · BlueRiver Group