seeing red in your future?
DESCRIPTION
Derbycon 2013 - Seeing Red in Your Future? This talk is designed to complement the “Fifty Shades of Red” talk tomorrow, and provide context for organizations who either think about engaging in a red team test, or have been doing red teaming and want to see more value out of it. In this talk we’ll cover some of the basic elements of what red teaming is, and specifically how it benefits an organization engaging in such a practice. Red teaming by itself is a high-interaction test. Unlike many other tests (namely penetration testing, compliance engagements, vulnerability assessments and other IT related practices), red team is not limited to the technical scope of the organization’s security infrastructure. As such, it is imperative to be able to extract as much value out of a red team engagement as possible, and see return on that investment in as many different areas of the organization as possible. Based on years of experience in conducting red team tests, training and helping organizations improve their security through red teaming, these insights will be applicable to everyone who is seeing red in their future (and you all should in order to really address security in an organization that has people working in it and not just machines).TRANSCRIPT
![Page 1: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/1.jpg)
Seeing red in your future?
Ian AmitDirector of Services, IOActive
![Page 2: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/2.jpg)
Hello
![Page 3: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/3.jpg)
whoami?
$ id
uid=501(iamit) gid=20(ioactive) groups=12(hack),33(research),61(dev),79(red_team),80(sexy_defense),81(exil),98(idf),100(dc9723),204(/dev/null)
![Page 4: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/4.jpg)
So, you think you can red team...
![Page 5: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/5.jpg)
As in get your organization a proper red team assessment
![Page 6: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/6.jpg)
First things first.
What is a “Red Team Test”?
![Page 7: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/7.jpg)
!pentest
![Page 8: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/8.jpg)
!social_engineering
![Page 9: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/9.jpg)
“A red team is an independent group that challenges
an organization to improve its effectiveness”
wikipedia
![Page 10: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/10.jpg)
But wait! what about security?
![Page 11: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/11.jpg)
Right... that’s part of the deal...
Security is PART of running an organization!
![Page 12: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/12.jpg)
So how do we go about it?
![Page 13: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/13.jpg)
Agenda
Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)
![Page 14: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/14.jpg)
Map
![Page 15: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/15.jpg)
Map
CISO CIO
CFO CRO
Compliance
Audit GeneralCounsel
![Page 16: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/16.jpg)
Agenda
Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)
![Page 17: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/17.jpg)
Identify
![Page 18: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/18.jpg)
Identify
![Page 19: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/19.jpg)
Identify
![Page 20: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/20.jpg)
Identify
![Page 21: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/21.jpg)
Agenda
Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)
![Page 22: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/22.jpg)
Recruit
Audit
![Page 23: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/23.jpg)
Recruit
Six SigmaSix Sigma
![Page 24: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/24.jpg)
Agenda
Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)
![Page 25: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/25.jpg)
Target
![Page 26: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/26.jpg)
![Page 27: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/27.jpg)
How do I look from the outside?
![Page 28: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/28.jpg)
How do I look from the outside?
Legal
![Page 29: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/29.jpg)
How do I look from the outside?
Legal
Research & Development
![Page 30: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/30.jpg)
How do I look from the outside?
Legal
Research & Development
Procurement
![Page 31: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/31.jpg)
How do I look from the outside?
Legal
Research & Development
Procurement
Information Sources
![Page 32: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/32.jpg)
How do I look from the outside?
Legal
Research & Development
Procurement
Information Sources
Supply Chain
![Page 33: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/33.jpg)
How do I look from the outside?
Legal
Research & Development
Procurement
Information Sources
Supply Chain
Human Resources
![Page 34: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/34.jpg)
How do I look from the outside?
Legal
Research & Development
Procurement
Information Sources
Supply Chain
Human Resources
Sales
![Page 35: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/35.jpg)
How do I look from the outside?
Legal
Research & Development
Procurement
Information Sources
Supply Chain
Human Resources
Sales
Financials
![Page 36: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/36.jpg)
Agenda
Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)
![Page 37: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/37.jpg)
Assemble
![Page 38: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/38.jpg)
![Page 39: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/39.jpg)
Skillz!
![Page 40: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/40.jpg)
Electronic Social
Physical
![Page 41: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/41.jpg)
Electronic Social
Physical
![Page 42: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/42.jpg)
Electronic Social
Physical
![Page 43: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/43.jpg)
Electronic Social
Physical
![Page 44: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/44.jpg)
Electronic Social
Physical
![Page 45: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/45.jpg)
Electronic Social
Physical
![Page 46: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/46.jpg)
Electronic Social
Physical
![Page 47: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/47.jpg)
Agenda
Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)
![Page 48: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/48.jpg)
Scope
![Page 49: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/49.jpg)
![Page 50: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/50.jpg)
Threat model
![Page 51: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/51.jpg)
Threat model
Assets
![Page 52: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/52.jpg)
Threat model
AssetsProcesses
![Page 53: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/53.jpg)
Threat model
AssetsProcesses
Controls
![Page 54: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/54.jpg)
Threat model
AssetsProcesses
Controls
People
![Page 55: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/55.jpg)
Threat model
AssetsProcesses
Controls
People
Technology
![Page 56: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/56.jpg)
Threat model
AssetsProcesses
Controls
People
Technology
Location
![Page 57: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/57.jpg)
Threat model
AssetsProcesses
Controls
People
Technology
Location
Culture
![Page 58: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/58.jpg)
Threat model
AssetsProcesses
Controls
People
Technology
Location
Culture
Adversaries
![Page 59: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/59.jpg)
Agenda
Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)
![Page 60: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/60.jpg)
Monitor
![Page 61: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/61.jpg)
Agenda
Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)
![Page 62: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/62.jpg)
Execute
![Page 63: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/63.jpg)
Execute
![Page 64: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/64.jpg)
![Page 65: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/65.jpg)
Can you hear me now?
Yes
Whazzzzzzup?
Whazzzzzzzzzzuuuuuppp?
What are you wearing?
Hello?
Still there?
![Page 66: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/66.jpg)
Stay in control
of the escalation processes...
![Page 67: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/67.jpg)
Agenda
Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)
![Page 68: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/68.jpg)
Pre-report
![Page 69: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/69.jpg)
![Page 70: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/70.jpg)
IDS
![Page 71: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/71.jpg)
IDS
System Logs
![Page 72: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/72.jpg)
IDS
System Logs
Firewalls
![Page 73: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/73.jpg)
IDS
System Logs
Firewalls
Access controls
![Page 74: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/74.jpg)
IDS
System Logs
Firewalls
Access controls
Call records
![Page 75: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/75.jpg)
IDS
System Logs
Firewalls
Access controls
Call records
Web traffic
![Page 76: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/76.jpg)
IDS
System Logs
Firewalls
Access controls
Call records
Web traffic
DNS
![Page 77: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/77.jpg)
IDS
System Logs
Firewalls
Access controls
Call records
Web traffic
DNS
Social Media
![Page 78: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/78.jpg)
Agenda
Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)
![Page 79: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/79.jpg)
Gap
![Page 80: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/80.jpg)
Example 1: Dumpster Diving Olympics
![Page 81: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/81.jpg)
Example 1: Dumpster Diving Olympics
![Page 82: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/82.jpg)
Example 1: Dumpster Diving Olympics
•Personnel training
![Page 83: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/83.jpg)
Example 1: Dumpster Diving Olympics
•Personnel training•Process changes
![Page 84: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/84.jpg)
Example 1: Dumpster Diving Olympics
•Personnel training•Process changes•Technical controls
![Page 85: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/85.jpg)
Example 1: Dumpster Diving Olympics
•Personnel training•Process changes•Technical controls•Change management
![Page 86: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/86.jpg)
Example 1: Dumpster Diving Olympics
•Personnel training•Process changes•Technical controls•Change management•R&D practices
![Page 87: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/87.jpg)
Example 1: Dumpster Diving Olympics
•Personnel training•Process changes•Technical controls•Change management•R&D practices•3rd party sw security
![Page 88: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/88.jpg)
Example 1: Dumpster Diving Olympics
•Personnel training•Process changes•Technical controls•Change management•R&D practices•3rd party sw security•Physical security routines
![Page 89: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/89.jpg)
Agenda
Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)
![Page 90: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/90.jpg)
Fix
![Page 91: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/91.jpg)
Example 2: Incident Response from HellProcess:Incident response kicks in on any malware with a signature from the past week, or with a generic/heuristic detection.In meantime, malware (APT!?) is left to run (actually ok...)
Problem:High number of incidents in a short time can create a queue. Queue is predictable if IR analysis consists of C&C traffic as well :-)Queue can be exploited...
![Page 92: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/92.jpg)
Example 3: Eager Sales
![Page 93: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/93.jpg)
Example 3: Eager SalesOrganization is a security contractor (build big guns).
![Page 94: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/94.jpg)
Example 3: Eager SalesOrganization is a security contractor (build big guns).R&D, production, testing, management, sales, all in the same location (HQ).
![Page 95: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/95.jpg)
Example 3: Eager SalesOrganization is a security contractor (build big guns).R&D, production, testing, management, sales, all in the same location (HQ).Sales are global, controlled from HQ.
![Page 96: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/96.jpg)
Example 3: Eager SalesOrganization is a security contractor (build big guns).R&D, production, testing, management, sales, all in the same location (HQ).Sales are global, controlled from HQ.Extreme perimeter security, high-end physical security.
![Page 97: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/97.jpg)
Example 3: Eager SalesOrganization is a security contractor (build big guns).R&D, production, testing, management, sales, all in the same location (HQ).Sales are global, controlled from HQ.Extreme perimeter security, high-end physical security.
Sales... few targeted emails, reverse shell home. Network is done. DA on production machines (mfg.), sales ledgers, major diplomatic incident potential...
![Page 98: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/98.jpg)
Example 3: Eager SalesOrganization is a security contractor (build big guns).R&D, production, testing, management, sales, all in the same location (HQ).Sales are global, controlled from HQ.Extreme perimeter security, high-end physical security.
Sales... few targeted emails, reverse shell home. Network is done. DA on production machines (mfg.), sales ledgers, major diplomatic incident potential...
Process breakdown from physical security (USB drops), through separation of duties, network segmentation, egress data management.
![Page 99: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/99.jpg)
Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)
![Page 100: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/100.jpg)
mapidentifyrecruittargetassemblescopemonitorexecutepre-reportgapfix
![Page 101: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/101.jpg)
mapidentifyrecruittargetassemblescopemonitorexecutepre-reportgapfix
![Page 102: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/102.jpg)
mapidentifyrecruittargetassemblescopemonitorexecutepre-reportgapfix
RED TEAM READINESS
![Page 103: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/103.jpg)
This isn’t rocket science
![Page 104: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/104.jpg)
It’s not about who’s got the biggest one...
![Page 105: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/105.jpg)
It’s about challenging an organization to improve its effectiveness
![Page 106: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/106.jpg)
It’s about challenging an organization to improve its effectivenessyourself
![Page 107: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/107.jpg)
It’s about challenging an organization to improve its effectivenessyourselfyour peers
![Page 108: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/108.jpg)
It’s about challenging an organization to improve its effectivenessyourselfyour peersyour assumptions
![Page 109: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/109.jpg)
It’s about challenging an organization to improve its effectivenessyourselfyour peersyour assumptions...
![Page 110: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/110.jpg)
There is no certificate at the end :-(
![Page 111: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/111.jpg)
There is no certificate at the end :-(
no CPEs
![Page 112: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/112.jpg)
There is no certificate at the end :-(
no CPEs
no medals
![Page 113: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/113.jpg)
There is no certificate at the end :-(
no CPEs
no medals
Just hard work :-)
![Page 114: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/114.jpg)
And a better ROI than any other test/engagement the organization has ever gone through before
![Page 115: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/115.jpg)
until the next red team...
![Page 116: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/116.jpg)
Questions? Discussion!
![Page 117: Seeing Red In Your Future?](https://reader034.vdocuments.mx/reader034/viewer/2022042623/540d5ce48d7f728d7e8b48c1/html5/thumbnails/117.jpg)
map
ide
nti
fyre
cru
itta
rge
tas
sem
ble
sco
pe
mo
nit
or
exe
cute
pre
-re
po
rtga
pfi
x
Questions? Discussion!