Red Team

High-level overview of considerations when building a Red Team

Purpose: The Red Team aims to enhance organizational cybersecurity resilience by simulating real threat actors' attacks on information systems. This process evaluates detection and response capabilities, identifies vulnerabilities, strengthens the organizations security, and raises awareness of the business impact of security issues.

Building:

• Capabilities: Tailor simulations to different adversaries (e.g., nation-states, criminal groups) based on their unique capabilities.

• Tooling: Employ a variety of tools, including implants, command and control systems, reconnaissance tools, phishing, and exploits.

• Attacker Infrastructure: Establish isolated networks for monitoring and communication between teams to track campaigns/exercises.

• Relationships and Stakeholders: Foster collaboration with key stakeholders, including leadership, detection and response teams, threat intel, legal, and product/IT teams.

• Safeguards: Define rules of engagement, address 0-day vulnerabilities, maintain activity logs to differentiate exercises from real threats.

Defining the Scope:

• Scope Overview: Clearly delineate the areas where Red Teams operate, encompassing digital security, physical security, abuse, reliability, and legal aspects. Include secondary scopes such as systems, people, and operational processes.

• Limitations: Acknowledge that exercises typically have no restrictions beyond Rules of Engagement (RoE), issues may not directly impact targeted systems, and exercises are not meant to be comprehensive vulnerability assessments.

• Use-Cases: Simulate threat actor attacks to test detection and response capabilities, identify infiltration methods, and emphasize the business impact of security issues.

Planning and Executing Exercises:

• Types of Exercises: Differentiate between frequent Red Team exercises and infrequent Red Cell exercises that emulate real adversaries.

• Planning: Ensure comprehensive coverage, define adversary scenarios, and align attacker goals with exercise goals.

• Execution: Notify stakeholders, conduct reconnaissance, exploit vulnerabilities, and achieve exercise goals. Post-execution involves reporting, presentations, sharing Tactics, Techniques, and Procedures (TTPs), and facilitating remediation.

Post-Exercise Reporting, Purple Team, What-we-learned:

• Structure: Provide executive summaries, high-level recommendations, attack narratives, detection analyses, identified issues, TTPs, and distribution lists.

• SOC: Share TTPs with the SOC team with detailed information to facilitate new detections, prioritized from an attacker's perspective.

• Remediation: Scope, gather commitments, track progress, distinguish vulnerabilities from opportunities for improvement, and seek support from security engineers.