As those relationships build, which is naturally a slow process, you must show that you can be trusted. The value of trust between red team members can’t be overstated.
How can someone gain red team skills without getting in trouble with the law?
I think this question is flawed. First and foremost, when people say “red team skills,” I feel like Inigo Montoya would say, “You keep using that word. I do not think it means what you think it means.” Red team skills aren’t anything more than working in a fast-paced team dynamic. The technical aspect of red teaming aside, you can get “red team skills” anywhere there is a fast-paced team dynamic, from McDonald’s to the military. Any time you’re required to work as a part instead of the whole, you’re working on red team skills. In fact, you’d have to go out of your way to gain these skills in an illegal manner with so many opportunities present. It’s just a matter of knowing where to look.
I’d be remiss if I didn’t talk about the technical aspect, though. This is where the trouble with the law caveat in the question comes from. Twenty years ago, in 1999, this would have been a real problem. However, it’s 2019. Access to labs, capture-the-flag (CTF) events, blogs, YouTube, a vibrant and social information security community, university degree programs, high school programs (CyberPatriot), college programs (Collegiate Penetration Testing Competition, National Collegiate Cyber Defense Competition, etc.), and even paid training programs exist. The resources are here in abundance. You can’t go 30 seconds on YouTube without a Udemy ad trying to teach you ethical hacking. Even with the physical security portion, at the SAINTCON conference in Utah, I proudly help run the The Vault, a physical security challenge that gives attendees an opportunity to practice attacks against physical security controls such as RFID cloning, lockpicking, request-to-exit bypasses, under- and over-the-door tools, alarm systems, biometrics, and so on. With all this information present, the bar to a technical skill set has been drastically lowered as compared to 20 years ago.
Why can’t we agree on what a red team is?
Spoiler alert: we can, and we have. However, there is a consumer education problem. Some in the information security industry want to do things “their way” or want to make new definitions for things to meet their abilities but add more markup to their services. This is unfortunate and contributes to the confusion of the consumer. Unfortunately, because the commercial sector doesn’t usually look to the government sector, many aren’t aware that the term red team has been defined for quite some time and is a very good definition.
In 2005 the Department of Defense released Manual 8570.01-M, which defines “red team” as
“An independent and focused threat based effort by a multi-disciplinary, opposing force using active and passive capabilities; based on formal; time bounded tasking to expose and exploit information operations vulnerabilities of friendly forces as a means to improve readiness of U.S. units, organizations, and facilities.”
In recent years, as this concept is expanded, I feel that this industry will naturally align with the 8570 definition much as PCI has helped drive the difference between vulnerability scan and penetration test.
What is one thing the rest of information security doesn’t understand about being on a red team?
Hot take: being on the offensive side doesn’t mean you’re on a red team. There is no red side. You’re confusing it with opposition forces (OPFOR). Stop saying you’re red or blue—this isn’t fucking gang territory, and you aren’t Bloods or Crips.
Many people think that a red team is a one-person show, which isn’t the case at all. A true red team has multiple team members and a lead. These team members work as a cohesive unit toward a common goal. There is no room to operate independently, which is difficult for many offensive testers as they are used to doing things their way at their pace.
“Many people think that a red team is a one-person show, which isn’t the case at all. A true red team has multiple team members and a lead.”
When should you introduce a formal red team into an organization’s security program?
While this is a gut feeling, it’s a pretty easy one to come by. Consider how a company isn’t going to get the right value they need out of a penetration test if they have never done a vulnerability assessment and also have no patch management process. An organization is ready for red team assessments once penetration tests have diminished in value.
How do you explain the value of red teaming to a reluctant or nontechnical client or organization?
I explain that the value from a red team comes from the team aspect. Typically, companies get penetration tests conducted by a single consultant who usually has a general skill set. A red team brings a group of individuals whose specific skill sets are aligned with the company’s infrastructure. The idea is that just because you’re on the team for this client doesn’t mean you will be on the team for the next. If your background is Linux penetration testing, there is no reason why you should be on the team against a target that is a full Windows shop. On the client side, having a penetration tester skilled in Linux is a waste of their money and will provide less value. Keep in mind, I’m not saying the Linux tester is not good and couldn’t learn, but we must remember that we are beholden to the client and not our pride.
Lastly, but equally important, red team engagements focus on targeted goals instead of a specific scope. Without a rigid scope, the red team can work naturally and pragmatically to attempt to achieve the goals in the best way they see fit, much as an actual attacker might.
Have you ever recommended not doing a red team engagement?
Absolutely. I’ve seen clients get sold on the buzzword red team and want one, but in reality, they still haven’t fixed their critical, high, or even medium findings from their last few penetration tests.
When a client requests a red team, I try to understand how they have been performing previous security assessments and how they are handling remediating the findings. If they are still doing vulnerability scans and haven’t moved to penetration testing, they aren’t ready for a red team. If they are doing penetration tests and not remediating findings, they aren’t ready for a red team.
What’s the most important or easiest-to-implement control that can prevent you from compromising a system or network?
This isn’t the answer you want but the answer you need: small and medium-sized businesses are typically solely focusing on building their business and scaling. As a result, their dollars are usually allocated to endeavors to facilitate this. The right answer is that you need a consultant. Just as most small and medium businesses outsource things such as accounting, human resources, and information technology, you need to outsource security as well. Hire a reputable consultant who can come in and look at your business holistically and consider all aspects of the business so that any recommendation keeps its impact to your business’s operations and tempo to a minimum, but also helps increase your security posture. Our industry often forgets that our goal isn’t to make an organization unhackable, but to help increase their security posture in a way that allows them to focus on the business’s mission and vision.
Why do you feel it is critical to stay within the rules of engagement?
Elementary, my dear Watson. You must always remember the three Ls: liability, liability, liability. Staying within the rules of engagement comes down to liability. If a client has specific requests (don’t target C levels, don’t touch these IPs, don’t go to
