Penetration Testing is a common capability that companies utilise to assess the security of their digital systems. However, there are several limitations with the typical approach. For example, Penetration Tests generally assess systems in isolation (e.g., assessing applications, infrastructure, and the risk from techniques such social engineering separately). Additionally, these assessments are usually done in the full knowledge of the technical team, meaning while they can be effective at finding security vulnerabilities, they will not be able to assess an organisation’s ability to effectively respond to a realistic attack.
Red Teaming is a type of advanced security assessment which goes further than typical Penetration Tests. Firstly, by utilising a methodology that more broadly assesses an organisation’s systems and secondly by being able to be performed in such a way that a limited number of key individuals within an organisation are aware of the assessment – allowing the organisation’s response to be assessed as well.
Additionally, full Red Team assessments are typically multi-technique, including technical, physical, and social engineering capabilities as part of the assessment. However, these assessments can take significant project management and can be time consuming and expensive due to these complex aspects.
An alternative approach, which reduces some of this complexity, is to perform a Targeted Breach Assessment. These are essentially Red Team assessments that are limited to technical capabilities and do not include physical security assessments or social engineering techniques. They still offer the benefit of being broader assessments than penetration testing but are reduced in scope allowing them to be delivered more quickly with less complexity and less significant project management requirements.
These are an ideal service for companies that already have effective penetration testing in place, or who would like the assessment to more accurately reflect the typical activities of a realistic threat group.
To ensure that defence in depth is appropriately tested, this methodology can be combined with an Assumed Breach approach, where if the assessing team are unsuccessful in one stage of the assessment, then access is manually granted to allow the assessment to continue. This would avoid a situation where a very weak internal network combined with a very strong perimeter goes unnoticed.
These assessments will give an organisation a thorough understanding of the risk posed by their systems as well as detailed remediation guidance to ensure that the highlighted issues can be addressed and that systems can be hardened against any potential attack. It will also allow the organisation to determine how effective their response capability is, depending on whether the attack attempts are successfully detected, triaged, or prevented.
Targeted Breach Methodology Summary
Network Mapping
We will review the full attack surface before continuing onto the security assessment, ensuring that all potential methods for gaining access to applications or internal network connections is considered.
Network Vulnerability Discovery
We review the in-scope systems for the presence of vulnerabilities that are likely to allow further system access. The assessment will aim to focus on high impact vulnerabilities such as code injection, command execution, and file upload vulnerabilities.
Analysis and Exploitation
Where a vulnerability is discovered, exploitation will be attempted in order to determine the real-world risk of the vulnerability and to escalate access. Additionally, each discovered issue will include a full breakdown of the potential for exploitation and give the steps to replicate the vulnerability to ensure that your technical teams fully understand each issue.
Propagation and Privilege Escalation
Where a foothold into an internal network is achieved, propagation and privilege escalation activities will be conducted to extend the level of access to demonstrate the potential for a broad compromise.
Full Compromise
Depending on the type of threat group we are tasked with emulating, a full compromise will be demonstrated using a technique appropriate to the target threat group. For example, if ransomware is the organisation’s concern, then access to a large number of devices and backups will be attempted. If instead the theft of confidential data is the concern, then access to data stores will be attempted.
Remediation
We don’t just focus on vulnerability discovery, but we also give significant detail on remediating discovered vulnerabilities and importantly, on hardening systems against exploitation.
Purple Team Debrief
A red team engagement is only truly valuable if it delivers learning value to the defensive team. Therefore, at the end of the engagement there will be a “purple team debrief” – this can either be a presentation from the red team to discuss what was found, how the assessment progressed, and any “lessons learned” that don’t fit neatly into the formal report.
Alternatively, it could be a workshop session including the blue team to allow both sides to review their actions, limitations, and issues during testing. The approach can be decided towards the end of the engagement depending on how the assessment has gone and the types and numbers of findings raised.