Everybody in this particular video we're going to go over a pretty high level on what a red team is.
So like I said in the previous video we're going to go the whole Red Team blueprint is based around
the red team.
So we will go to all of this in more detail but this is just a quick overview.
So red team in a nutshell is we identify and exploit issues in an organization's environment so we don't
do the run a scan vulnerability scan find out.
OK.
This particular services is vulnerable to this.
And then just report it.
So what we do is we actually go out and exploit the actual issue to see whether or not it's real how
it affects organization inside of this we also will check new exploits that come out against the organization
to see if they are valid.
Do they fit in our organization.
We simulate external internal threats.
So this could be a disgruntled employee hacker from a different country.
So we try to simulate both sides of the fence here.
There's a lot of internal threats just as are external threats.
Each of their own negatives and positives as far as like what can be done.
We also provide cyber awareness training so this can be phishing training password cracking training
around use of weak passwords or reuse of passwords in a general sense.
This may or may not be under a different team depending on the organization.
However and in some cases where phishing is the is owned by the red team as it is in my particular case
we handle the awareness training around what you can can't do how to identify things.
So it's more of a full a full feedback loop which is important of a slap on the wrist.
Knowing what you did wrong how to fix it etc. We'll go into that a little bit later around.
When I go over some phishing in detail so we also test the organization's response to active threats
so whether when we're doing an engagement of some kind we could be throwing off alerts that the blue
team would be getting.
So seeing how they handle it because in some cases we want to test something without the blue team knowing
that it's being tested.
So because of this we check their actions how they how well did they how did they do in terms of how
long did it take for them to actually identify that we were there and we were doing something malicious.
So a good a good red team needs to understand the defensive side as well as the offensive.
The problem with that is there's a lot of people that come up and they just learn the offensive side.
Now that will get you far however to be well rounded.
You need to be able to understand that yes you could exploit this particular issue.
But how do you fix that particular issue when it's not just telling somebody to patch something something's
out of date.
Well maybe there's a regular expression that failed which allowed you to inject commands for example.
How do you deal with that and provide them detail on how they can fix the problem.
Where was the reg LAX where was it weak.
How to tighten it up a little bit.
It's important to be well rounded in terms of offensive and defensive because without knowing what the
defenses could be in place if you're attacking from a unknown perspective as in you're not a lot you're
not letting them know you're going to set off so many alarms just something as simple as throwing a
port scan in default settings is enough to trip of most intrusion detection systems and alerting software
that they'll know immediately that you're there.
So there's a lot of stuff that you'd have to know ahead of time on the defensive side.
So why are we needed.
There's a lot of reasons why a red team is needed in most cases or worse semi or a subject matter expert
on attacks attack scenarios data infiltration exfiltration as well any type of attack that the organization
could could happen could happen to an organization.
We need to be able to be there to interject and figure out whether it's a real threat or not realistically
testing scope of an attacker's effectiveness in situations.
So just because there is an issue of somebody has a type of injection attack on their web that if there's
no sanitization on it that's that's a problem in and of itself.
But if you allow that through and then the let's say the development team doesn't think it's a big issue
because you have to be authenticated.
Well getting authenticated access to a web app through it there's there's a lot of ways to do that.
So relying on something being behind authentication is not necessarily goods a good spot.
And just because they have access to that and we exploit it.
Were we able to gain a execution on the machine from that machine where we able to infiltrate the rest
of the network.
So not just taking it from a finding but to a full scope of what you're trying to do.
We also provide risk analysis on attacks and vulnerabilities that can hinder the company in organization.
So we're able to take certain types of attacks more specifically vulnerabilities as well provide a risk
matrix for them to be able to them as an E staff and the executives and managers in the organization
as a whole to be able to tell them that this is this.
This is the risk that you're taking when you allow this type of configuration or this type of service
to be on patched.
So and that's a very big thing to have.
So our is the red team required.
Yes and no.
So in a larger organization.
Most definitely yes.
There's there's way too much moving parts with too many moving parts way too many developers over top
of each other.
There's there's way too much that can go on that could go wrong in an organization.
So we definitely need it in a larger organization now a smaller organization that's maybe 100 people
50 people maybe even 150 200 people in a general sense a lot of people in those companies wear multiple
hats so to speak.
So one guy could be the software developer network administrator and security guy that kind of does
everything.
I've been in those roles before we're at smaller companies you kind of where 10 15 different job roles
all at once.
So in this particular case it might not be needed because you might be able to get the one one guy or
gal that can can perform those actions not necessarily on the scale of a full team but enough of the
scale to get away with the task needed at that point in time.
So the team structure this is a more of a generic structure for a red team in general and the size of
the team can vary depending on the size of the organization.
So as I said you know you might have one person on the red team quote unquote red team if you're at
like one hundred 250 people at a company with two thousand three thousand ten thousand twenty thousand
people you're going to see something similar to this where there's a manager I didn't add it under this
particular slide but there's normally a director once you start getting into the five six ten thousand
point companies there's normally a director a red team director a manager there may be a senior manager
in there as well and possibly even a V.P..
So from an organizational standpoint you normally have a manager you have one manager one to two leads
possibly three depending on the situation majority of your task force is going to be mid-level which
is Level Two through about three or four.
Once you start hitting four or five you start creeping into the lead the entry level is normally up
for debate.
So most Red Team hours are not entry level per say they may be entry level to red team but they should
not be entry level in general.
So as an example you wouldn't grab somebody who is fresh out of school and never touched I.T. before
in their lives to bring them onto an enterprise level red team.
Now it does happen with internships which is also included in this entry level.
However most people that are entry level and Red Team have been system administrators they've done I.T.
support desk they've done some other sort of task of I.T. before they happen to make it to the red team.
So this is a quick overview of what the team kind of looks like why we're here what we do.
A lot of this I'll go into more detail to the rest of the blueprint.