Red Team Attack Simulation
Organizations with mature security programs require a variety of methods to be employed in concert to discover the attack vectors that allow malicious adversaries to breach their environment. A Red Team Attack Simulation employs the full spectrum of tools and methods to find creative avenues of entry into the organization.
This engagement consists of three main phases:
Reconnaissance
The digital footprint of the organization on the internet is thoroughly researched to identify key digital, physical, and human assets which can be targeted for exploitation. At the discretion of the organization and based on availability, proprietary tools and/or breached data from the organization can be purchased on the dark web to facilitate the engagement.
Environment Penetration:
Tactics employed to infiltrate the organization include, but are not limited to:
Social: Spear phishing attacks, impersonation of vendors/partners/clients, and other tactics are used to gain information and access from organization personnel.
Digital: Exploitation of vulnerabilities in network devices and exposed applications are performed in order to compromise digital assets and locate sensitive information or avenues through which the organization could be harmed.
Physical: Physical location access controls to such as locked doors, back doors/windows, and electronic access control systems are utilized to gain access to the organization's assets. Rogue access points can be utilized to harvest credentials, or security badges cloned to gain physical access to the facility in order to access records or equipment or gain persistent remote access to the network.
Lateral Movement and Exfiltration
Any foothold gained internally within the organization will be used to further explore the environment and locate sensitive information. At the organizations discretion, exfiltration of information will be attempted.
During the engagement, utmost care is taken not to disrupt the normal functioning of the organization. Testing occurs within mutually defined time periods and adheres to any scoping restrictions should the organization choose to impose them.