Red Teaming service can be effective for organizations who have deployed adequate security measures and are willing to go further than regular VAPT assessments. This service delivers real life attacks, the same as an APT group targeting an organization. The service is not the same as a typical blackbox VAPT service.
Blackbox PT covers a specific technical scope like, Network devices, Servers, Applications and IT Hardware, Software. Red Teaming also covers the technical scope, However, Red Teaming is holistic cyber security testing that is technically more aggressive and also includes exploitation of loopholes that may be present in People, Process & Technology Implementation in an organization.
Using Techniques like social engineering, phishing, vishing, smishing etc, an employee’s cyber security awareness as well as the processes implemented inside the organization against a business unit can also be tested.
1. Typical Approach & Attack Strategies Employed
1.1 Initial Compromise is covered by Social Engineering and Attacking Internet facing applications via
- Employee Contact
- BYOD device Compromise
- Application Compromise
- Network Service Compromise
- Custom MS Word / PDF or Other Malicious Document Payloads
- Rubber Ducky
- Wireless Network Compromise
- Wireless device compromise (Wireless Mice, Keyboard etc.)
- USB drop attacks
- Other Side Channel attacks
1.2 Lateral Movement and Internal Exploitation are covered through
- Advanced AD Forest Trust Attacks,
- Powershell, VBScript, Bash script attacks
- Network Pivoting
- Secure & insecure Tunneling Attacks
1.3 Privilege Escalation attacks are covered through
- Custom Mimikatz deployment
- Pass the hash
- AD exploits
- Windows Server Compromise
- SMB Relay Attacks
1.4 Exfiltration attacks are covered through
- DNS Exfiltration
- Payload Custom Encryption
- Custom Protocol exfiltration
- Secure Tunnelling
2. Why Red Teaming?
Organizations that already have engaged in continuous VAPT, Compliance Audit, Internal Testing and participation in regular hardened processes of their systems still face a dilemma:
- Am I completely secured now ?
- How can I improve the penetration testing results further ?
The common approaches won’t deliver results for well-defended organizations. Commodity vulnerability assessment tools or off-the-shelf attacks and exploits will not be effective. Successful testing requires advanced attacks by security experts.
A penetration test with a very specific or narrow scope over a two-to-three week period of time does not adequately allow for this to occur. However, the cost of conducting a multi-month assessment isn’t part of many organizational budgets. This is where our offering of Breach Attack Simulation exceeds expectations of our customers.
The services are made both cost-effective and at the same time promises delivery of successful exploitation.
The advanced attack simulation is for very specific environments where the security teams of the organization are expected to be mature enough to justify this level of vulnerability assessment. However, if you are increasingly frustrated with finding an assessment team that can handle your environment, this may be the perfect fit for you.
3. Results & Reporting
Report constitutes the following
- Information Gathered
- Weak Human & Technology Links
- Attacks Launched
- Infrastructure attacked
- Vulnerabilities Used
- Custom Exploit Code
- Successful Attacks
- Data Extracted ( Actual Data & Screenshots )