RED TEAMING ATTACK SIMULATION

Often, the potential business impact of vulnerabilities identified during penetration testing will be conditional or hypothetical, requiring additional chained activities for the exploit to lead to a genuine business impact. Unlike penetration testing, red team exercises are far wider in scope, simulating an end-to-end attack across the network as opposed to assessing the security of individual or smaller groups of assets.

Additionally, red team exercises do not focus on technical vulnerabilities alone, as they look to abuse legitimate functionality and business processes in order to perform malicious actions with an associated business impact. During a red team exercise, the attacker is not constrained to a narrow scope, and has the freedom to interact with a broad range of assets in order to progress an attack towards a high-impact technical goal.

While the goal of a penetration test is to uncover vulnerabilities and configuration issues for remediation, the goal of a Red Team exercise is to assess and demonstrate whether the business can be harmed through a cyber-attack.

Red Team exercises are conducted using a phased delivery approach:

• Reconnaissance – Performing reconnaissance activities to obtain information on the target organisation and aide in the preparation of targeted campaign scenarios. Open Source Intelligence (OSINT) information gathering techniques are used to profile the organisation while avoiding attribution and remaining undetected. This phase could include target user profiling, external attack surface mapping, and identifying exposed vulnerable interfaces.
• Staging – Based on the information gathered, staging platforms are developed, supporting infrastructure and campaign scenarios. These platforms are then used to execute agreed upon scenarios.
• Exploitation – Using tactics, techniques and procedures (TTPs) of advanced threat actors access is gained to the target the organisation through systematic and controlled exploitation (e.g. spear phishing, targeted USB drops, physical access). This activity is performed in-line with the project engagement scoping to manage risk.
• Control and Movement – After a successful compromise, the access obtained is used to move from foothold systems to further vulnerable or high value systems. Reuse of the access obtained can be used to identity, enumerate and access target systems. New and emerging techniques are used to avoid detection and to test an organisation’s ability to respond to emerging threats.
• Actions On Target – After achieving the necessary level of access, the engagement’s goals are pursued by acquiring access on previously agreed target systems, information or data. This phase is performed based on the agreed scope and risk appetite and approved by the target organisation.
• Persistence and Egress – Maintaining access in the environment throughout the extended timeline of a simulated attack. Persisting when necessary and exfiltrating data if appropriate for the engagement goals.

Attackers are sophisticated and use many techniques to infiltrate target environments and compromise target systems. The threat landscape is continuously changing as new exploits emerge, new tooling is created, and tradecraft evolves. The tactics, techniques and procedures (TTPs) used by JUMPSEC are continually developed to emulate sophisticated threat actors and stay up to date with the latest threats.

JUMPSEC leverages its proprietary threat intelligence platform alongside vital first-hand experience delivering offensive and defensive security services. JUMPSEC routinely defends clients from advanced cyber-attacks as part of its managed security services, monitoring client environments for malicious activity and continuously hunting for signs of compromise; deploying incident responders to contain and neutralise threats where required. This exposure to how attackers operate is fed into offensive security services, enabling JUMPSEC to simulate TTPs consistent with those observed in the wild.

JUMPSEC utilise the latest tools and technology when delivering Red Team exercises. We often write bespoke scripts and tooling to craft malware designed to specifically target the organisation’s systems and processes, emulating the behaviours of a persistent, skilled and motivated attacker in reacting to the target environment and adapting to overcome any controls in place.

JUMPSEC create bespoke attack scenarios, informed by your organisation’s threat profile and business context. Example attack scenarios can include:

• Conducting an external spear phishing campaign to gain access to critical systems or sensitive data.
• Compromising physical hardware to gain direct access to internal systems and physical devices.
• Simulating insider threats by adopting the position of a disgruntled employee trying to abuse legitimate access to sabotage internal systems or deface external ones.
• Assessing the risk posed by ransomware attacks by evaluating the effectiveness of security controls in preventing and detecting known ransomware types.

JUMPSEC can simulate a range of breach activities to gain an initial foothold on the target network. This includes:

• Compromise of external-facing web applications or infrastructure components to pivot to adjacent internal systems
• Spear-phishing of a specific sub-set of users with requisite levels of user account privilege to progress the attack
• Infiltrating a physical facility to bypass digital controls by gaining direct access to physical devices and/or remotely interfacing with the internal network 
• Orchestrating attacks from the point of a compromised machine or ‘sacrificial system’ to represent the risk of insider threat
• Utilising a watering hole attack to acquire user credentials or infect their devices with malware by directing users to a malicious site controlled by JUMPSEC.

Attacks which would incur unacceptable disruption or destruction to business operations and systems respectively will not be simulated. Attacks such as DDOS can instead be table-topped to safely ascertain the risk without the attendant risks of a live exercise.

No. With enough time and resources a skilled attacker is likely to gain access to the network through one or more of the methods described elsewhere. However, within the constraints of a simulated exercise, it may not be possible to achieve one or more of the staged goals during the exercise – for example, achieving a foothold on the network.

At this point, JUMPSEC recommends that the attack is de-chained to allow the remainder of the attack stages to play out, while recognising that the organisation’s controls were suitably robust to prevent the activity’s successful simulation under test conditions. This does not mean that an attacker in the wild without the constraints of a simulation exercise would also be unable to complete the action.

De-chaining a stage of the attack means that the sequence is artificially progressed. For example, granting the tester access to a sacrificial system to represent an end-user that was successfully phished, resulting in malware running on their machine.

De-chaining therefore allows the organisation to gain maximum value from the exercise by enabling all defensive layers to be assessed, and more comprehensive and insightful improvement recommendations to be made.

Tests can be performed in either a black, grey or white box manner:

• Black box approaches represent a typical Red Team; these are designed to be authentic and covert, and rely on the attacker using only information gathered during reconnaissance to progress the attack. While the most realistic, this approach is likely to have the widest scope and require the greatest delivery effort, as more in-depth reconnaissance will have to be performed (both external and internal) to plan and execute an attack.
• Grey box approaches may involve the attacker being granted privileged information to guide the attack toward specific assets or goals, and reduce the amount of time dedicated to reconnaissance.
• White box approaches which involve the simulation of malicious activities in full view of the organisation’s Blue Team. This type of exercise can also be described as a Purple Team approach, whereby the goal of the exercise is to simulate a broad range of attacker TTPs to test and improve detection capability, as opposed to validating whether an attacker is able to achieve a specific goal.

For organisations looking to reduce costs, exercises can be conducted from an assumed breach perspective, with the exercise beginning from a sacrificial system. This approach assumes that a skilled attacker will be able to gain a foothold to the network and enables more scrutiny to be applied to assessing internal preventive and detective controls. This is likely to result in a more streamlined and cost-efficient test, for example omitting the need for the creation of phishing campaigns and malware, and reconnaissance of the environment.

• Red Team – Offensive security consultants delivering the attack simulation.
• Blue Team – The security team defending the network.
• White Team – A selection of trusted personnel responsible for performing project governance and risk management.

A Red Team exercise is designed to identify whether an attacker can compromise critical business processes (and the digital assets which support them) using attacker TTPs relevant to the organisation’s threat profile. It is designed to prove or disprove that an attacker can achieve goals which would result in critical business impact.

A Purple Team exercise is designed to generate capability improvements in the security team’s ability to detect malicious activity. It assesses the organisation’s logging and detection activities to identify areas of deficiency across people, process and technology.

A Gold Team exercise is designed to rehearse an organisation’s business continuity and disaster recovery plans for a high-risk cyber attack scenario. It simulates business-wide communications and decision making in a tabletop setting to assess the preparedness of the organisation to respond to, and mitigate the impact of a cyber breach.

JUMPSEC’s Red Team is CREST STAR (Simulated Targeted Attack and Response) accredited, giving you the assurance that our Red Teaming Service maintains the highest standards.