Red Teaming

When vulnerabilities that seem small on their own are tied together in an attack path, they can cause significant damage.

Red teaming uncovers risks to your organization that traditional penetration tests miss because they focus only on one aspect of security or an otherwise narrow scope. Here are some of the most common ways that red team assessors go beyond the test:

• Email and phone-based social engineering. With a little bit of research on individuals or organizations, phishing emails become a lot more convincing. This low hanging fruit is frequently the first in a chain of composite attacks that lead to the goal.
• Network service exploitation. Exploiting unpatched or misconfigured network services can provide an attacker with access to previously inaccessible networks or to sensitive information. Often times, an attacker will leave a persistent back door in case they need access in the future.
• Physical facility exploitation. People have a natural inclination to avoid confrontation. Thus, gaining access to a secure facility is often as easy as following someone through a door. When is the last time you held the door open for someone who didn’t scan their badge?
• Application layer exploitation. Web applications are often the first thing an attacker sees when looking at an organization’s network perimeter. Exploiting Web application vulnerabilities (e.g., cross-site scripting, SQL injection, cross-site request forgery, etc.) can give an attacker a foothold from which to execute further attacks.

Every red team assessment caters to different organizational elements. However, the methodology always includes the same elements of reconnaissance, enumeration, and attack. Before conducting a red team assessment, talk to your organization’s key stakeholders to learn about their concerns. Here are a few questions to consider when identifying the goals of your upcoming assessment:

1. What could happen in my organization to cause serious reputational or revenue-based damage (e.g. ex-filtration of sensitive client data or prolonged service downtime)?
2. What is the common infrastructure used throughout the organization (consider both hardware and software)? In other words, is there a common component on which everything relies?
3. What are the most valuable assets throughout the organization (data and systems) and what are the repercussions if those are compromised?