Source: Acunetix
Red Teaming ("red team" attack) is a comprehensive simulation of real attacks aimed at assessing the cybersecurity of systems. The "red team" is a group (specialists performing penetration testing on the system). They can be hired externally or be employees of your organization, but in all cases, their role is the same - to simulate the actions of malicious actors and attempt to penetrate your system.
Alongside red teams, there are several others in cybersecurity. For instance, the "blue team" works with the red team but focuses on enhancing system infrastructure security from within. The "purple team" acts as a link, assisting the two other teams in developing attack strategies and protective measures. However, red teaming remains one of the least understood methods of cybersecurity management, and many organizations still hesitate to adopt this practice.
In this article, we will explain in detail what Red Teaming is and how implementing practices of comprehensive simulation of real attacks can help improve your organization’s security. The goal of the article is to demonstrate how this method can significantly enhance the security of your information systems.
Red Teaming: Overview
Although today "red" and "blue" teams are primarily associated with IT and cybersecurity, these concepts were originally coined by the military. In fact, I first heard about these concepts in the army. Working as a cybersecurity analyst in the 1980s was vastly different from today: access to encrypted computer systems was much more restricted than it is now.
Overall, my first experience with military games—modeling, simulation, and organizing interactions—was very similar to today’s comprehensive attack simulation process that has become common in cybersecurity. Just like now, significant attention was given to using social engineering methods to convince employees to provide "the enemy" with unauthorized access to military systems. Therefore, although technical attack simulation methods have significantly advanced compared to the 1980s, it is worth noting that many of the core tools of the competitive approach, particularly social engineering techniques, largely remain platform-independent.
The primary value of comprehensive simulations of real attacks has also not changed since the 1980s. By simulating an attack on your systems, you can more easily identify vulnerabilities and understand how they might be exploited. While previously red teaming was mainly used by "white hat" hackers and cybersecurity specialists seeking vulnerabilities through penetration testing, this method has now found broader applications in the fields of cybersecurity and business.
The key aspect of red teaming is understanding that you cannot truly assess the security of your systems until they are attacked. Instead of risking an attack from actual malicious actors, it is much safer to simulate such an attack using a "red team."
Red Teaming: Use Cases
A simple way to understand the basics of red teaming is to look at a few examples. Here are two of them:
- Scenario 1. Imagine that a pentest has been conducted on a customer service website and the assessment passed successfully. This would seemingly indicate that everything is in order. However, later, through a comprehensive attack simulation, the "red team" discovers that, although the customer service application is fine, the third-party chat function cannot accurately identify individuals, allowing it to deceive customer support representatives into changing the email address on the account (resulting in a new person, the attacker, gaining access).
- Scenario 2. As a result of the penetration test, it was found that all means of VPN and remote access management are secured. However, a representative of the 'red team' then easily passes by the reception desk and takes a laptop belonging to one of the employees.
In both of the cases mentioned above, the 'red team' assesses not only the reliability of each individual system but also the entire system as a whole for vulnerabilities.
Who needs comprehensive attack simulation?
In short, practically any company can benefit from red teaming. As shown , a disturbingly large number of organizations are under the false impression that they have complete control over their data. For example, we found that on average, 22% of a company's folders are accessible to every employee, and 87% of companies have over 1000 outdated confidential files in their systems.
If your company does not operate in the technology sector, it may seem that red teaming will not bring you much benefit. But that is not the case. Cybersecurity is not just about protecting confidential information.
Malicious attackers equally seek to gain access to technologies regardless of the industry of the company. For instance, they may aim to access your network to use it to conceal their actions in taking over another system or network somewhere else in the world. In this type of attack, your data is not what they desire. They want to infect your computers with malware to turn your system into a botnet.
For small companies, it can be difficult to find the resources to conduct red teaming. In this case, it makes sense to outsource this process to a third-party contractor.
Red Teaming: Recommendations
The optimal time to conduct red teaming and its frequency depend on the sector in which you operate and the maturity of your cybersecurity measures.
In particular, you should automate tasks such as asset discovery and vulnerability analysis. Your organization should also combine automated technologies with human oversight, regularly conducting comprehensive penetration testing.
After completing several business cycles of penetration testing and vulnerability assessment, you can proceed to a comprehensive simulation of a real attack. At this stage, red teaming will provide you significant benefits. However, attempting to conduct this before establishing a solid cybersecurity foundation will yield minimal results.
A ‘white hat’ team will likely be able to compromise an unprepared system so quickly and easily that you will gain too little information to take further action. To achieve a real effect, information obtained by the ‘red team’ must be correlated with previous penetration tests and vulnerability assessments.
What is penetration testing?
Comprehensive simulation of a real attack (Red Teaming) is often confused with , but these two methods are slightly different. More specifically, penetration testing is just one of the methods of red teaming.
The role of a pentester The work of pentesters is divided into four main stages: planning, information discovery, attack, and reporting. As you can see, pentesters do more than just look for software vulnerabilities. They try to put themselves in the hackers' shoes, and once they gain access to your system, their real work begins.
They identify vulnerabilities and then conduct new attacks based on the information gathered, moving through the directory hierarchy. This is what distinguishes penetration testers from those hired solely to find vulnerabilities using port scanning or virus detection software. An experienced pentester can determine:
- where hackers might direct their attack;
- the method hackers will use to attack;
- how your defenses will respond;
- the potential scale of the breach.
Penetration testing aims to identify vulnerabilities at the application and network levels, as well as opportunities to breach physical security barriers. While automated testing may uncover some cybersecurity issues, manual penetration testing additionally considers the business's vulnerability to attacks.
Red Teaming vs. Penetration Testing
Certainly, penetration testing is important, but it is only one part of a larger set of activities conducted during red teaming. The activities of the "red team" have much broader objectives than those of penetration testers, who often simply aim to gain access to the network. Red teaming typically involves more people, resources, and time, as red team specialists dig deeply to fully understand the true level of risk and vulnerability in technologies as well as in the organization's human and physical assets.
Moreover, there are other differences. Red teaming is generally utilized by organizations with more mature and developed cybersecurity measures (although, in practice, this is not always the case).
Typically, these are companies that have already conducted penetration testing and fixed most identified vulnerabilities, and are now looking for someone who can attempt to access confidential information again or breach defenses by any means.
This is why red teaming relies on a team of security experts focused on specific objectives. They target internal vulnerabilities and employ both electronic and physical social engineering methods towards the organization's employees. Unlike penetration testers, red teams are not rushed during their attacks, aiming to avoid detection as a real cybercriminal would.
Benefits of Red Teaming
Comprehensive attack simulations offer numerous benefits, with the most significant being that this approach provides a complete picture of the organization's cybersecurity level. A typical comprehensive attack simulation process includes penetration testing (network, application, mobile phone, and other devices), social engineering (in-person engagement, via phone calls, email, or through text messages and chats), and physical intrusion (lock bypassing, identifying dead zones of surveillance cameras, circumventing alarm systems). If there are vulnerabilities in any of these aspects of your system, they will be uncovered.
Once vulnerabilities are identified, they can be addressed. An effective penetration testing procedure does not end after the detection of vulnerabilities. After security weaknesses have been clearly identified, you will want to work on fixing them and re-testing. In fact, the real work often begins after the 'red team's' intrusion, when you conduct a forensic analysis of the attack and aim to mitigate the discovered vulnerabilities.
In addition to these two main advantages, red teaming also offers a variety of others. For instance, the 'red team' can:
- identify risks and vulnerabilities to attacks in key business information assets;
- simulate the methods, tactics, and procedures of real attackers in a controlled and limited risk environment;
- assess your organization’s capability to detect, respond to, and prevent sophisticated targeted threats;
- foster close cooperation with cybersecurity departments and 'blue teams' to ensure significant mitigation of consequences and conduct thorough practical workshops based on identified vulnerabilities.
How does Red Teaming work?
A great way to understand how red teaming works is to look at how it typically unfolds. The usual process of comprehensive attack simulation consists of several stages:
- The organization coordinates with the 'red team' (internal or external) the target of the attack being conducted. For example, this objective may involve extracting confidential information from a specific server.
- Then the 'red team' conducts reconnaissance on the target. As a result, a blueprint of the target systems is created, including network services, web applications, and internal employee portals.
- After that, vulnerabilities are searched for in the target system, which are typically exploited through phishing or XSS attacks.
- Once access tokens are obtained, the 'red team' uses them to explore further vulnerabilities.
- Upon discovering additional vulnerabilities, the 'red team' will aim to elevate their access level to the necessary height to achieve their objective.
- When access to the target data or asset is obtained, the attack task is considered complete.
In reality, an experienced 'red team' specialist will employ a vast array of methods to navigate each of the outlined steps. However, the key takeaway from the above example is that minor vulnerabilities in individual systems can escalate into catastrophic failures when chained together.
What should be considered when engaging with the 'red team'?
To get the most out of red teaming, thorough preparation is essential. The systems and processes used by each organization differ, and a high-quality level of red teaming is achieved when it targets vulnerabilities specific to your systems. For this reason, it's important to take several factors into account:
Know what you're looking for
First and foremost, it's important to understand which systems and processes you want to test. You might know that you want to test a web application, but not fully grasp what that really entails and what other systems are integrated with your web applications. Therefore, it's crucial to have a good understanding of your own systems and to address any obvious vulnerabilities before initiating a comprehensive simulation of a real attack.
Know your network
This relates to the previous recommendation but focuses more on the technical specifications of your network. The better you can quantitatively assess the testing environment, the more accurately and specifically your 'red team' will operate.
Know your budget
Red teaming can be conducted at various levels, but simulating the full spectrum of attacks on your network, including social engineering and physical intrusion, can be an expensive endeavor. For this reason, it is important to understand how much you can spend on such an assessment and, accordingly, outline its scope.
Know Your Risk Level
Some organizations may tolerate quite a high level of risk within their standard business procedures. Others, however, will need to restrict their risk level to a much greater extent, especially if the company operates in a highly regulated industry. Therefore, when conducting red teaming, it is essential to focus on the risks that genuinely pose a threat to your business.
Red Teaming: Tools and Tactics
When implemented correctly, the 'red team' will carry out a full-scale attack on your networks using all the tools and methods employed by hackers. This includes, among other things:
- Application Penetration Testing — aimed at identifying vulnerabilities at the application level, such as cross-site request forgery, input validation flaws, poor session management, and many others.
- Network Penetration Testing — aimed at identifying vulnerabilities at the network and system level, including misconfigurations, wireless network vulnerabilities, unauthorized services, and much more.
- Physical Penetration Testing — assesses the effectiveness, as well as the strengths and weaknesses of physical security controls in real-world settings.
- Social Engineering — targets the exploitation of human weaknesses and nature, testing individuals' susceptibility to deception, persuasion, and manipulation through email phishing, phone calls, and text messages, as well as through physical on-site contact.
All of the above are components of red teaming. This is a full-scale, multi-layered attack simulation designed to determine how well your people, networks, applications, and physical security controls can withstand a real attacker.
Continuous Development of Red Teaming Methods
The nature of complex real attack simulations, where 'red teams' attempt to find new vulnerabilities in security systems while 'blue teams' try to fix them, leads to the continuous evolution of testing methods. For this reason, it's challenging to compile a current list of modern red teaming techniques as they quickly become outdated.
Therefore, most specialists conducting red teaming will spend at least some of their time studying new vulnerabilities and methods of exploitation, utilizing numerous resources provided by the 'red team' community. Here are the most popular of these communities:
- is a subscription service offering online video courses primarily focused on penetration testing, as well as courses on operating system forensics, social engineering tasks, and assembly language for information security.
- is a 'cybersecurity operator' who regularly blogs about methods of complex real attack simulations and is a good source of new approaches.
- Twitter is also a great source if you're looking for up-to-date information on red teaming. You can find it through hashtags. and .
- is another experienced red teaming specialist who publishes a newsletter and , runs a and writes extensively about current trends in 'red teams'. Among his recent articles: and .
- is a web security newsletter sponsored by PortSwigger Web Security. It is a good resource for learning about developments and news in red teaming — hacks, data breaches, exploits, web application vulnerabilities, and new security technologies.
- is a 'white hat' hacker and penetration testing specialist, who regularly discusses new 'red team' tactics in his .
- MWR labs is a good, although extremely technical, source for news about red teaming. They publish useful information for red teams. , their contains tips for troubleshooting issues faced by security testing professionals.
- — a lawyer and 'white hat' hacker. His Twitter feed features methods useful for 'red teams', such as writing SQL injections and forging OAuth tokens.
- (ATT & CK) is a curated knowledge base on adversarial behavior. It tracks the lifecycle phases of adversaries and the platforms they target.
- is a playbook for hackers that, while somewhat dated, covers many fundamental techniques that still underpin comprehensive real-attack simulations. The author, Peter Kim, also has , in which he offers hacking tips and other information.
- SANS Institute is another major provider of cybersecurity training materials. Their , dedicated to digital forensics and incident response, features the latest news about SANS courses and expert tips.
- Some of the most interesting new insights on red teaming are published in . It includes technology-oriented articles, such as comparing Red Teaming to penetration testing, as well as analytical pieces like 'The Red Team Specialist Manifesto.'
- Finally, Awesome Red Teaming is a community on GitHub that offers of resources devoted to Red Teaming. It covers nearly all technical aspects of 'red team' activities, from initial access and malicious actions to data collection and extraction.
'Blue team' — what is it?
With so many 'colored' teams, it can be challenging to identify which type your organization needs.
One alternative to the 'red team', or rather another type of team that can work alongside the 'red team', is the 'blue team'. The 'blue team' also assesses network security and identifies any potential vulnerabilities in the infrastructure. However, its aim is different. Teams of this type are necessary to find ways to protect, modify, and regroup defense mechanisms to make incident response much more effective.
Like the 'red team', the blue team must have the same knowledge of attacker tactics, techniques, and procedures to create response strategies based on them. However, the responsibilities of the 'blue team' are not limited to merely defending against attacks. It also participates in strengthening the entire security infrastructure by using, for example, an intrusion detection system (IDS) that provides continuous analysis of unusual and suspicious activity.
Here are some of the steps that the 'blue team' takes:
- security auditing, particularly DNS auditing;
- log and memory analysis;
- network data packet analysis;
- risk data analysis;
- digital footprint analysis;
- reverse engineering;
- DDoS testing;
- risk implementation scenario development.
Differences Between Red and Blue Teams
A common question for many organizations is which team they should use—red or blue. This question is often accompanied by friendly rivalry between people working 'on different sides of the barricades'. In reality, however, neither team makes sense without the other. So, the correct answer to this question is that both teams are important.
The 'red team' attacks and is used to test the preparedness of the 'blue team' for defense. Sometimes the 'red team' may find vulnerabilities that the 'blue team' completely overlooked, and in this case, the 'red team' must demonstrate how these vulnerabilities can be fixed.
For both teams, it is vital to work together against cybercriminals to enhance information security.
For this reason, there is no point in choosing just one side or investing only in one type of team. It is important to remember that the goal of both sides is to prevent cybercrime.
In other words, companies need to establish mutual cooperation between both teams to ensure a comprehensive audit — with logs of all attacks and checks performed, and records of identified features.
The 'Red Team' provides information about the operations they performed during the attack simulation, while the Blue Team offers insights into the actions they took to fill gaps and address identified vulnerabilities.
The importance of both teams cannot be underestimated. Without their continuous security audits, penetration testing, and infrastructure improvements, companies would remain unaware of their security status. At least until a data breach occurs, making it painfully clear that security measures were insufficient.
What is the 'Purple Team'?
The 'Purple Team' emerged from attempts to combine the Red and Blue Teams. The 'Purple Team' is more of a concept than a distinct type of team. It is better viewed as a combination of the Red and Blue Teams, engaging both to help them work together.
The 'Purple Team' can assist security services in enhancing their capabilities for vulnerability detection, threat discovery, and network monitoring by accurately modeling common threat scenarios and aiding in the development of new detection and prevention methods.
Some organizations engage the 'Purple Team' for one-off, targeted initiatives where security objectives, timelines, and key results are clearly defined. This includes acknowledging shortcomings in attack and defense, as well as identifying future training and technology needs.
An alternative approach gaining traction is to view the 'Purple Team' as a conceptual model that operates throughout the organization, fostering a culture of cybersecurity and its continuous improvement.
Conclusion
Red Teaming, or comprehensive attack simulation, is a powerful method for testing an organization's security vulnerabilities, but it should be applied with caution. In particular, for its application, you need to have sufficient , otherwise it may not meet your expectations.
Red Teaming can uncover vulnerabilities in your system that you may not even have suspected, and help eliminate them. By employing a competitive approach between blue and red teams, you can simulate the actions of a real hacker if they aimed to steal your data or damage your assets.
Source: habr.com
