Flamingo Research Group
CalTec's security research group. We look at systems the way an attacker would, then work on the same side as the people who run them.
What we do
FRG works as a purple team: the attacker's view and the defender's view at the same table. What we find turns into a fix, not a report that sits in a drawer.
Most of our work is commissioned: a review of a web application, a network or a cloud setup, with the owner's permission and an agreed scope. When we come across a problem in a system we do not own, we tell the owner privately and help them fix it.
How we handle what we find
- 1.
The owner hears first, and privately. We send what we found, the evidence for it, and how to fix it.
- 2.
Nothing is published while a problem is open. Not the details, and not the name of the system.
- 3.
A write-up appears only with the owner's written agreement, after the fix, and it explains how the problem worked so that others can learn from it.
- 4.
Other people's details stay out. Where personal information appears in our evidence, we mask it, and we do not keep it.
- 5.
We show a problem once, to the owner, and hand over the fix. We do not share tools to exploit it.
Talk to us
If you would like your systems looked at, or you think you have found a problem in one of ours, write to us and put FRG in the subject line.
support@caltecbahamas.com