no matter how irritating they may be. The last place you and your team want to be is at the receiving end of a lawsuit for breach of contract.
If you were ever busted on a penetration test or other engagement, how did you handle it?
This is a tricky one for me to answer because many times the client requests that I intentionally test until I get caught. What I mean by this is during physical security assessments, for example, I slowly escalate my methods and noise to determine at what point an employee stops to question me. These metrics have given my clients a huge understanding of how and when their employees respond. Yes, I can go in and try to be undetected (which is the goal while red teaming); however, while performing a physical assessment, why not test as much as possible? If you don’t, you’re doing a disservice to your client. Then, when I’m caught, my clients also get to see how their incident response process handles it. Why wouldn’t you want to test every employee’s detection and capabilities in a controlled manner?
However, I do have a time I was caught while not trying to be. A few years ago, I was performing a physical security assessment for a client. During the kickoff call and follow-up communication, they were acting slightly odd and continuously decreasing the scope, including shortening the assessment from three days to one. I’ve learned that these are usually warning signs of trouble afoot.
When I arrived on site, I was able to successfully gain access to one of their floors. I found their mailroom and proceeded to place a USB drive inside an employee’s mailbox. As soon as I was leaving the room, I was stopped by an employee who said, “Oh, I found you! We were told to be on the lookout all day for you and to turn you in right away.” After talking for a few minutes, I found out that the client had sent out an email to all employees saying that a female would be coming on site during the limited time window they gave me to test and to stop me immediately.
This client wanted good results and didn’t want me to succeed. To achieve that, they rigged the test. However, this left me in an ethically hard spot. How was I supposed to write my report? I decided to be truthful and document in my report that the employee who stopped me explained that they were notified ahead of time and tasked with attempting to find me. To this day, that engagement was the most expensive game of corporate hide-and-seek I’ve ever played.
What is the biggest ethical quandary you experienced while on an assigned objective?
I had a client ask me to leave out findings from a phishing assessment. A C-level employee provided their network credentials to my malicious website, and they didn’t want that information to be in the final report. On one hand, it would be an extremely easy piece of data to omit from the final report; no one would even know it was missing. On the other hand, I knew deep down that it was wrong. I ended up explaining to the client that I could not remove any findings and proceeded to deliver an honest final report.
How does the red team work together to get the job done?
My absolute favorite part of red teaming is the team aspect. I love the camaraderie that is developed during the engagement. We work together under a team lead who builds out a strict plan to execute, where everyone knows their role and target. The documentation and reporting are really just a matter of good record keeping. There isn’t a team member specifically tasked with the job of the scribe. However, working with the blue team is always a learning experience. It’s interesting when we do our debriefs, and they show us what they were able to catch and not catch and dive into the technical portions of some attacks. Both teams learn a lot, and it is one of the most critical elements of the engagement.
“My absolute favorite part of red teaming is the team aspect. I love the camaraderie that is developed during the engagement.”
What is your approach to debriefing and supporting blue teams after an operation is completed?
This is a question that we ask during kickoff calls with the client—to determine what they want. Some clients like to be very hands-on with daily calls, multiple after-engagement calls/demos with different departments, and so on, while other clients are just looking forward to the final report. It all comes down to delivering the value that the client needs from the engagement.
If you were to switch to the blue team, what would be your first step to better defend against attacks?
Don’t assume. One of the biggest benefits any new hire brings to an organization is a fresh set of eyes. However, you need to capitalize on this while they are still fresh. I would personally start at the beginning, going from policies and procedures to technologies and to roles and responsibilities. I would take stock of what was present in order to determine what was missing. Things are often put in place in the blue team to meet policy need but never touched or exercised. Additionally, over time complacency sets in and things move to the wayside that should still be actively monitored.
What is some practical advice on writing a good report?
I’ve written, reviewed, and read others’ reports, which means I’ve seen the good, the bad, and the ugly. I have some tips here.
Executive summary: This should be more than a single sentence (yes, I’ve seen that)! This section should include the high-level assessment details (who, what, when, where, and why). Additionally, this section is typically the only part of the report that is handed off to executives, so don’t get too technical here.
Findings: For every finding, you need to show the steps to re-create the finding and a risk rating to help the client prioritize the order of remediation.
Recommendations: Never provide findings without recommendations.
Review: Don’t forget to run spell-check. A client will start to question your work if they see grammar errors and misspellings in your report. Also, ensure your report is QA’d. Having a second set of eyes is always beneficial, no matter what. If your report comes back with red lines throughout, don’t take it personally. It’s not about you; it’s about the client.
What nontechnical skills or attitudes do you look for when recruiting and interviewing red team members?
Hands down, soft skills. I can teach you technical skills or send you to training, but I can’t teach you manners, how to be on time, how to talk to clients, how to respond to teammates, and so on. One of the most nontechnical skills used in red teaming is communication. You have to be able to communicate with both your teammates and the client to be successful.
“I can teach you technical skills or send you to training, but I can’t teach you manners, how to be on time, how to talk to clients, how to respond to teammates, and so on.”
What differentiates good red teamers from the pack as far as approaching a problem differently?
A good red teamer knows where they fit into a team and how they can provide value. They also need to be outside-the-box thinkers. Often during assessments things don’t always go to plan, so being able to throw out ideas with teammates to figure out the best next steps is valuable. ■
7 Mark Clayton
“Passion is what drives you to continue to learn and constantly take on challenges because they are more interesting than watching your favorite Netflix show.”
