If you're still on,
"what's the red team tool again?" This parts for you. Obviously they're
tools that red teams use, but what does that mean?
What about pen testers, are they invited to the party?
Certainly, but let's do a quick review of who sits where
at the offensive cyber security table.
And, of course, what is the real business case?
Because as super cool and fun as all of this stuff is,
if it isn't actually helping the business or organization either
make or protect money or mission, or both,
then there's really no purpose.
So here's the thing. I have here before you a modified version of
the functions of NIST Cybersecurity Framework.
I call it modified because I've added some functions,
notably emulate, and intel around which all the other functions operate.
This is the security organization circle of life, the iterative process
that keeps organizations the safest they possibly can be, pending
process implementation, people, and budget. Now,
while an argument can be made for this to fall into identify or
even detect from a purely pen test perspective,
emulate is required for full adversary simulation,
and it closes the loop, verifying any protections or detections held
within the other functions, and without verification,
there can be no trust, or something like that.
Now the argument for the identify or the detect function to hold some of
the business use case for the tools in this path comes in where a
product security team wants to have their product tested, and whether
that is an external facing application, an actual installable piece of
software, or just the security team viewing their externally facing
security as a product,
they want to see and/or identify what gets through or where the
problems are that they have not yet themselves identified.
Sometimes this comes in the form of a vulnerability scan.
Sometimes it's more customized or in depth, but either way,
identifying these holes from the outside in is really what I'm
looking at as pen testing, and that is different from red teaming
by definition of the word, emulation.
Now many have tried,
and many have been overly scrutinized for their definition of
pen‑testing vs red‑teaming, but this is my hole to die on now.
To be clear, both have their place,
and I'm not attempting to depict one is better than the other,
they simply perform different functions.
Pen testing focuses on testing all aspects of a application,
network or organization for vulnerabilities and the
ability to exploit those vulnerabilities by attempting any
and all possible attack vectors.
Generalizing, this is the sawed‑off shotgun of offensive security.
On the other hand,
red team operations is going to run an op over a longer period of time,
attempting to emulate a specific adversary after specific end results.
They're going to replicate adversary techniques over the full lifecycle of
a compromise, and depending on their implementation,
provide a lot of good back and forth feedback with the security
admins and analyst to tune up defenses to ensure the organization
is in tip‑top shape to prevent or detect attacks from the
adversary that's being emulated.
It's often that the adversaries organizations are concerned about are advanced
persistent threats, and red team operations will likely be more focused on
advanced attack capabilities on the cutting edge.
That being said, these tools are still for pen testers and red teamers alike,
It's really just one big party,
but we're not solely focused on pen testing because of the two key points,
right?
First, the emulation aspect, and second, it's all about the full lifecycle.
So you're going to see something like this in each of these courses that show
you where this tool fits in the lifecycle of an attack.
And I know there's many takes on this kill chain,
but, this is the one that we're going to go with that provides a good general
idea. Where as your vulnerability testers are going to be looking at recon and
exploit, the next level or next gen pen testers,
pen testers NG, will be looking at all of that same stuff,
plus exploit and escalate, and maybe even lateral
movement if they're feeling frisky.
Red team,
by definition, for sure focuses on the full
lifecycle through action on objectives,
testing defenses at each point according to a specific technique.
So these tools are useful for everyone, but the coverage
is for any and all red team operations.