Red Team Assessment Features

A red team assessment is a goal-based adversarial activity that requires a big-picture, holistic view of the organization from the perspective of an adversary. This assessment process is designed to meet the needs of complex organizations handling a variety of sensitive assets through technical, physical, or process-based means. The purpose of conducting a red teaming assessment is to demonstrate how realworld attackers can combine seemingly unrelated exploits to achieve their goal. It is an effective way to show that even the most sophisticated firewall in the world means very little if an attacker can walk out of the data center with an unencrypted hard drive. Instead of relying on a single network appliance to secure sensitive data, it’s better to take a defense in depth approach and continuously improve your people, process, and technology

What Is Red Teaming?

The Red Teaming process involves extensive covert reconnaissance to build a highly tailored arsenal of attack techniques to identify even the most obscure security gaps in an organization’s people, processes, technology, and physical security controls. Similar to all penetration testing methodologies, the ultimate goal of Red Team assessments is to gain unauthorized access to sensitive systems and data or otherwise gain an advantageous position to cause damage using a risk-controlled methodology.

By removing many of the limitations that typically govern a penetrating test engagement, Red Teaming provides more assurance that an organization’s security controls can withstand highly targeted attacks associated with advanced persistent threat (APT) adversaries. As such, Red Teaming is the ultimate test of a company’s ability to detect, respond, and maintain its resilience to the most sophisticated, persistent, and targeted offensive campaigns. Perhaps most importantly, it simulates attacks from positions inside an organization’s physical premises, targets personnel directly, and leverages advanced social engineering techniques developed from direct observation of an organization’s internal operations. 

To maximize value, Red Team engagements may also define specific operational goals for Red Team ethical adversaries, such as gaining domain admin access, unauthorized payroll data access, compromising critical network components, deploying ransomware on test data, or accessing credit card or sensitive PHI information.

Typical goals of a Red Team assessment include:

• Helping an organization gain hands-on experience managing a cyber breach scenario by putting your defenders to the ultimate test
• Simulating the tactics, techniques, and procedures (TTP) of advanced persistent threats and organization insiders in a risk-controlled manner
• Evaluating the likelihood of a remote compromise via phishing or physical access breach
• Evaluating a Blue Team’s detection, alerting, and response capabilities during an active cyber-breach
• Testing the effectiveness of Incident Response Plans (IRP) and Disaster Recovery Plans (DRP) to quickly and completely recover from active cyber-breaches
• Finding hidden attack paths to the most critical assets
• Identifying internal staff that are vulnerable to persistent targeted social engineering attacks
• Testing the resiliency of an organization’s defenders during an emergency response
• Evaluating the resilience of defense-in-depth layered security controls in the face of a cyber breach scenario

Who Will Benefit From This Guide?

This guide will benefit an organization’s leaders such as CEOs, CTOs, and CISOs, as well as other senior team leaders including security engineers, network engineers, and administrators. This guide can also help to inform other IT professionals such as MSPs, IaaS, PaaS, and SaaS providers.

• C-level executives that deal with IT security (CISOs/CSOs/VP of security)
• Other high-level management (CEO/Business Owner/ Business Executive)
• Managed Service Providers (MSP)
• Cybersecurity Architects, Network Architects, and Network Administrators

What are some common Red Team tactics?

Red teaming uncovers risks to your organization that traditional penetration tests miss because they focus only on one aspect of security or an otherwise narrow scope. Here are some of the most common ways that red team assessors go beyond the test:

• Email and phone-based social engineering.With a little bit of research on individuals or organizations, phishing emails become a lot more convincing. This low hanging fruit is frequently the first in a chain of composite attacks that lead to the goal.
• Network service exploitation. Exploiting unpatched or misconfigured network services can provide an attacker with access to previously inaccessible networks or to sensitive information. Often times, an attacker will leave a persistent back door in case they need access in the future.
• Physical facility exploitation. People have a natural inclination to avoid confrontation. Thus, gaining access to a secure facility is often as easy as following someone through a door. When is the last time you held the door open for someone who didn’t scan their badge?
• Application layer exploitation. Web applications are often the first thing an attacker sees when looking at an organization’s network perimeter. Exploiting Web application vulnerabilities (e.g., cross-site scripting, SQL injection, cross-site request forgery, etc.) can give an attacker a foothold from which to execute further attacks.

Additional Context To Red Teaming

Red Team exercises may also involve collaboration with the target organization’s own IT security team responsible for defending the organization’s assets, also known as the “Blue Team”.

This collaborative approach, known as a “Purple Team” exercise, fosters direct knowledge transfer from experienced attackers to defenders, resulting in a deeper understanding of how attackers assess the target’s IT environment, what elements are more attractive to attackers, and leading to a more effective and actionable defensive security posture.

Special Considerations For Red Team Targets

Due to the intense nature of Red Team assessments, targets need to consider several important factors before the start of an engagement.

Some special considerations for Red Team targets include:

• Clear Objectives: Clearly define the objectives of the Red Team engagement. This includes selecting which assets, systems, or data the Red Team should focus on to ensure the assessment aligns with the target organization’s specific security concerns.
• Engagement Scope: Determine the scope and duration of the Red Team assessment. Decide whether the Red Team should have access to the physical premises and direct access to personnel, and identify any areas that should be off-limits. 
• Provide Testers With Formal Authorization: Because Red Team assessments involve pentesters working covertly within the target organization’s physical premises, they must be provided with documented evidence that their activities have been authorized. If a pentester is confronted by personnel, security guards, or law enforcement, the “get-out-of-jail-free” evidence can help de-escalate the situation.  
• Legal And Ethical Considerations: Address any legal and ethical considerations related to the Red Team assessment. Ensure that the engagement adheres to relevant regulations and does not cause harm to the organization, its personnel, stakeholders, or potentially harm bystanders.
• Post-Engagement Activities: Plan for post-engagement activities, including a debriefing session with the Red Team to discuss findings, recommendations, and lessons learned. Use the assessment results as a roadmap for enhancing the organization’s security posture.

What are 3 questions to consider before a Red Teaming assessment?

Every red team assessment caters to different organizational elements. However, the methodology always includes the same elements of reconnaissance, enumeration, and attack. Before conducting a red team assessment, talk to your organization’s key stakeholders to learn about their concerns. Here are a few questions to consider when identifying the goals of your upcoming assessment:

1. What could happen in my organization to cause serious reputational or revenue-based damage (e.g. ex-filtration of sensitive client data or prolonged service downtime)?
2. What is the common infrastructure used throughout the organization (consider both hardware and software)? In other words, is there a common component on which everything relies?
3. What are the most valuable assets throughout the organization (data and systems) and what are the repercussions if those are compromised?

The Importance Of Red Teaming Assessments

In today’s threat landscape, adversaries are becoming more sophisticated, making it essential for high-risk organizations to thoroughly assess their security posture from the perspective of an APT adversary. Cybersecurity researchers have uncovered daunting statistics that relay the true risk of being caught unprepared for a cyber attack:  

• Companies are experiencing 31% more cyberattacks, with that percentage growing by the year
• 70% of SMB owners report not feeling ready for a cyberattack if one hits
• Globally, 72% of both state and local governments attacked by ransomware had had their data encrypted
• 40% of polled CEOs reported that hybrid work IT infrastructures were the most difficult aspects of cybersecurity to implement
• 47% of healthcare breaches originate from third-party insiders and 43% of all security breaches are perpetrated by insider threats

Red Teaming is an advanced type of security assessment that is tailored to organizations that have already employed traditional Penetration Testing to specifically identify non-technical IT security vulnerabilities. As such, Red Team pentesting is an important component of a high-assurance cybersecurity strategy. It provides the most realistic evaluation of an organization’s security readiness, empowering them to identify and mitigate risks before real attackers exploit them. Organizations that hold high-severity risk require the deepest insight into potential security gaps across their entire organization, including highly targeted social engineering attacks, attacks launched from insider positions, and attempts to breach physical security controls. 

Red Teaming also promises to provide target organizations with tangible experience detecting, and responding to cyberattacks in order to assess their true ability to quickly and completely recover and improve disaster recovery plans with actionable insights. Red Teaming offers an organization the opportunity to evaluate its defenses against a “no holds barred ” offensive campaign that uses more “outside the box” techniques than a traditional pentest. 

The combination of this in-depth and targeted approach to security testing is important for organizations that are highly likely to experience attacks from nation-state threat actors or Advanced Persistent Threats (APT) who are willing to spend significant time and resources to covertly infiltrate an organization in order to steal data, reap financial gains, or cause irreparable damage. 

Benefits of a Red Team assessment include:

• Identifying the risk and susceptibility of attack against confidential information, denial of service (DOS) attacks, ransomware, attacks that seek to destroy data, and more
• Identifying security weaknesses in an organization’s technology, processes, and people
• Assessing an organization’s ability to detect, respond, and prevent second-stage attacks that occur after an initial breach
• Identifying critical personnel or whole departments that are susceptible to targeted depth-based attack campaigns
• Developing first-hand experience to enhance the capabilities of defending against advanced adversarial attacks

How Is Red Teaming Different From Other Cybersecurity Assessments?

Red Teaming extends the testing scope to include a wider set of attack scenarios that more rigorously test an organization’s processes, people, and physical security to covertly gain unauthorized access. Traditional penetration testing focuses primarily on the technical aspects of cybersecurity vulnerabilities within an organization and typically follows a predefined methodology that can be conducted remotely. 

Although Red Teaming does test an organization’s technology such as public-facing IP addresses, the wider scope of Red Teaming attack techniques means that tactics and techniques specially designed for covert infiltration are used to test defenses. Overall, Red Teamingen encompasses a broader range of attacks, including social engineering, physical security breaches, and advanced persistent threat (APT) simulations, and involves testing activities that take place on an organization’s premises.

The key differences between Red Team pentesting and traditional pentesting are:

• Depth-based Scope: Red Teaming makes a more intensive assessment of physical, and human security aspects, whereas traditional pentesting typically concentrates on technical vulnerabilities and applies a coverage-based scope.
• Approach: Red Teaming adopts a covert adversarial approach, mimicking the strategy of highly targeted APT attack campaigns, while traditional pentesting takes a more structured approach.
• Goals: Traditional pentesting focuses on identifying and fixing technical vulnerabilities, while Red Teaming aims to uncover systemic weaknesses in an organization’s processes, people, and physical controls to assess the effectiveness of an organization’s security.
• Engagement Duration: Red Team engagements are often longer and may be ongoing over an extended period. They typically involve multiple phases and iterations to ensure a deep evaluation of an organization’s priority targets.
• Reporting: Red Team reports include a narrative of the overall attack path, including the tactics used, the potential impact, and recommendations for improving security posture against social engineering and physical security controls while traditional Pentesting reports focus on detailing technical vulnerabilities discovered, their severity, and recommendations for remediation.
• Resource And Skill Requirements: Red Team assessments typically require a higher level of skill and expertise in various domains, including social engineering, physical security, and advanced attack techniques. By contrast, traditional penetration testing primarily requires technical expertise in specific areas of cybersecurity, such as network or application security.

Red Team assessments include more targeted TTP to exploit a target organization and involve direct engagement with an organization’s physical premises and its members. Some Red Team tactics and techniques that are not typically employed during a traditional penetration test include:

• Lockpicking and other physical techniques
• Covert interaction with personnel at the target organization
• Dropping or installing physical devices on the target’s premises to gain remote access
• Using targeted social engineering techniques as an entry point to gaining remote access to the target’s networks