WHAT IS A RED TEAM ATTACK SIMULATION?

Often, the potential business impact of vulnerabilities identified in the course of penetration testing will be conditional or hypothetical, requiring additional chained activities for the exploit to lead to a genuine business impact. Unlike Penetration Testing, Red Team exercises are far wider in scope, simulating an end-to-end attack across the network as opposed to assessing the security of individual or smaller groups of assets. 

Further, Red Team exercises do not focus on technical vulnerabilities alone, but look to abuse legitimate functionality and business processes in order to perform malicious actions with an associated business impact. During a Red Team, the attacker is not constrained to a narrow scope, and has the freedom to interact with a broad range of assets in order to progress an attack towards a high-impact technical goal. 

While the goal of a penetration test is to uncover vulnerabilities and configuration issues for remediation, the goal of a Red Team exercise is to assess and demonstrate whether the business can be harmed through a cyber attack. 

Red Team exercises are conducted using a phased delivery approach:

• Reconnaissance – Perform reconnaissance activities to obtain information on the target organisation and aide in the preparation of targeted campaign scenarios. Use of Open Source Intelligence (OSINT) information gathering techniques to profile the organisation while avoiding attribution and remaining undetected. This phase could include target user profiling, external attack surface mapping, and identifying exposed vulnerable interfaces.
• Staging – Based on the information gathered, develop staging platforms, supporting infrastructure and campaign scenarios. The platforms will be used to execute agreed upon scenarios.
• Exploitation – Using tactics, techniques and procedures (TTPs) of advanced threat actors gain access to the target organisation through systematic and controlled exploitation (e.g. spear phishing, targeted USB drops, physical access). This activity is performed in-line with the project engagement scoping to manage risk.
• Control and Movement – After a successful compromise, the access obtained is used to move from foothold systems to further vulnerable or high value systems. Reuse of the access obtained can be used to identity, enumerate and access target systems. New and emerging techniques are used to avoid detection and tests an organisations ability to respond to emerging threats.
• Actions On Target – After achieving the necessary level of access, pursue the goals of the engagement by acquiring access on the previously agreed target systems, information or data. This phase is performed based on the agreed scope and risk appetite and approved by the target organisation.
• Persistence and Egress – Maintain access in the environment throughout the extended timeline of a simulated attack. Persist when necessary and exfiltrate data if appropriate for the engagement goals.

Attackers are sophisticated and use many techniques to infiltrate target environments and compromise target systems. The threat landscape is continuously changing as new exploits emerge, new tooling is created, and tradecraft evolves. The TTPs used by JUMPSEC are continually developed to emulate sophisticated threat actors and stay up-to-date with the latest threats.

JUMPSEC leverages its proprietary threat intelligence platform alongside lessons learned from delivering offensive and defensive security services. JUMPSEC routinely defends clients from advanced cyber attacks as part of its managed security services, monitoring client environments for malicious activity and continuously hunting for signs of compromise; deploying incident responders to contain and neutralise threats where required. This exposure to how attackers operate is fed into offensive security services, enabling JUMPSEC to simulate TTPs consistent with those observed in the wild.

JUMPSEC utilise the latest tools and technology when delivering Red Team exercises. We often write bespoke scripts and tooling to craft malware designed to specifically target the organisation's systems and processes, emulating the behaviours of a persistent, skilled and motivated attacker in reacting to the target environment and adapting to overcome any controls in place.

JUMPSEC craft bespoke attack scenarios informed by the target organisation’s threat profile and business context. Example attack scenarios can include:

• Conducting an external spear phishing campaign to gain access to critical systems or sensitive data.
• Compromising physical hardware to gain direct access to internal systems and physical devices.
• Simulate insider threat by adopting the position of a disgruntled employee trying to abuse legitimate access to sabotage internal systems or deface external ones.
• Assess the risk posed by ransomware attacks by assessing the effectiveness of security controls in preventing and detecting known ransomware types.

JUMPSEC can simulate a range of breach activities to gain an initial foothold on the target network. This includes:

• Compromise of an external-facing web application or infrastructure components to pivot to adjacent internal systems
• Spear-phishing of a specific sub-set of users with requisite levels of user account privilege to progress the attack
• Infiltrating a physical facility to bypass digital controls by gaining direct access to physical devices and/or remotely interfacing with the internal network
• Utilising a watering hole attack to acquire user credentials or infect their devices with malware by directing users to a malicious site controlled by JUMPSEC

Attacks which would incur unacceptable disruption or destruction to business operations and systems respectively will not be simulated. Attacks such as DDOS can instead be table-topped to safely ascertain the risk without the attendant risks of a live exercise.

Attacks can also originate from the point of a compromised machine or ‘sacrificial system’ to represent the risk of insider threat.

No. With enough time and resources a skilled attacker is likely to gain access to the network through one or more of the methods described elsewhere. However, within the constraints of a simulated exercise, it may not be possible to achieve one or more of the staged goals during the exercise - for example, achieving a foothold on the network. 

At this point, JUMPSEC recommends that the attack is de-chained to allow the remainder of the attack stages to play out, while recognising that the organisation's controls were suitably robust that the activity could not be successfully simulated under test conditions. This does not mean that an attacker in the wild without the constraints of a simulation exercise would also be unable to complete the action. 

De-chaining a stage of the attack means that the sequence is artificially progressed. For example, granting the tester access to a sacrificial system to represent an end-user that was successfully phished, resulting in malware running on their machine.  

De-chaining allows the organisation to gain maximum value from the exercise by enabling all defensive layers to be assessed, and more comprehensive and insightful improvement recommendations to be made.