When is a Red Team a Red Team
0 likes82 views
1. The document discusses a red team engagement conducted by Nettitude for a large stock exchange to test the security of its real-time trading system. 2. Through targeted phishing, the red team was able to compromise the workstation of a database administrator and gain access to information and systems related to the trading platform. 3. A detection and response assessment found that the blue team failed to detect several of the red team's actions during the simulated attack.
![Agenda
[+] Introductions 1m
[+] Setting the Stage 5m
[+] Tales from the Trenches 13m
[+] Conclusion 1m](https://image.slidesharecdn.com/nettitude-cybermeetup-whenisaredteamaredteam-220606131845-c648319a/85/When-is-a-Red-Team-a-Red-Team-2-320.jpg)
When is a Red Team a Red Team
- 1. When is a Red Team a Red Team? M AY 2 0 1 9
- 2. Agenda [+] Introductions 1m [+] Setting the Stage 5m [+] Tales from the Trenches 13m [+] Conclusion 1m
- 3. > whoami • Sanjiv Kawa • Penetration Tester and Red Teamer • I Lead Nettitude's Penetration Testing Team kawabungah skahwah
- 4. > whois Nettitude • 160 security professionals • Global presence • Significant Industry Influence
- 5. Nettitude’s Research and Zero Days
- 7. Confusion • What is Red Teaming? • Who is it for? • What does it achieve? • Why is it important?
- 8. The Current State of Technical Assurance
- 9. The Current State of Technical Assurance
- 10. What is a Red Team Engagement? PenTest+
- 11. Purpose of a Red Team Engagement Holistically test your organization against a real world breach scenario Driven from real world threats Focus on Depth and not Breadth Exercise your Blue Team People Process Technology https://www.flaticon.com/free-icon/team_476700 https://www.flaticon.com/free-icon/settings_126472 https://www.flaticon.com/free-icon/laptop_114734
- 12. What Does a Red Team Engagement Look Like?
- 13. What Does a Red Team Engagement Look Like?
- 14. What Does a Red Team Engagement Look Like?
- 15. Why is Red Teaming Important? Exercise Your Blue Team People Process Technology
- 16. Tales from the Trenches
- 17. Some of our Achievements • We get to work with some awesome clients • We have an extremely high success rate in reaching objectives
- 18. Some of our Achievements • We get to work with some awesome clients • We have an extremely high success rate in reaching objectives https://www.flaticon.com/free-icon/bank_1066122 https://www.flaticon.com/free-icon/medical-history_1685819 https://www.flaticon.com/free-icon/benefits_1369921 https://www.flaticon.com/free-icon/family_1396773
- 19. Tales from the Trenches I’m going to walk you through a red team engagement we did for a stock exchange
- 20. Tales from the Trenches Disclaimer: Some areas have been replaced with fictitious people, other areas are heavily redacted to protect the identity of the Client and their employees …
- 21. Engagement Particulars Client: Large Stock Exchange Objective: Integrity of Real Time Trading System (TS) Assessment: Threat Intelligence Scenario 1: External Threat Scenario 2: Insider Threat Assessment: Detection and Response Capabilities
- 22. Threat Intelligence Mitre ATT&CK Group ID: G0032 AKA: Lazarus Group North Korea
- 23. Threat Intelligence: Lazarus Group Based on TI: Initial entry is going to be a targeted phish
- 24. Threat Intelligence: Recon If I had 8 hours to chop down a tree, I would spend 6 of those hours sharpening my axe Many, many, many tools ...
- 25. Threat Intelligence: Finding Targets to Phish • In-house developed, publicly available tool • Checks HIBP for breaches • Name, email, title, etc
- 26. Threat Intelligence: Building Pretext • Find target employees who work with TS • Senior Trader at Stock Company • Works with TS • A+ candidate to phish!
- 27. Threat Intelligence: Building Pretext
- 28. Threat Intelligence: Building Pretext Priority Target at Stock Exchange Position Pretext from LinkedIn 1 Rey Oakley Senior Trader Joseph Thompson – Capital Ventures 2 Mike Cortes IT Support Sarah Cho – Computer Stop 3 Karen Hayes Database Admin John Smith – DevShop 4 Stacy Chan Project Manager Mike Jacklin – Logistics R Us • Don’t stop at one, maximize your chances.
- 29. Handover At this point, the TI Team hands over a “target pack” to the Red Team
- 33. External Threat: Delivery and Execution • Pretext: Recruitment and Career Opportunities • Delivery: Targeted Phishing (4 users) • Objective: Impact the Integrity of TS 0 1 2 3 4 5 Users Targeted Emails Confirmed Opened Links Clicked Command and Control Obtained Targeted Phishing Statistics
- 34. External Threat: Execution Execution? Target at Stock Exchange Position Pretext from LinkedIn ý Rey Oakley Senior Trader Joseph Thompson – Capital Ventures ý Mike Cortes IT Support Sarah Cho – Computer Stop þ Karen Hayes Database Admin John Smith – DevShop þ Stacy Chan Project Manager Mike Jacklin – Logistics R Us • Who’s workstation are we on?
- 35. External Threat: Acting on Objectives Karen Hayes
- 36. External Threat: Acting on Objectives þ Know where TS Lives þ Know users who access TS Karen Hayes Global File Share TS Documents Active Directory TS Users
- 37. External Threat: Acting on Objectives Compromised Workstation Trader Workstation
- 38. External Threat: Acting on Objectives Karen Hayes Karen Hayes Active Directory
- 39. External Threat: Acting on Objectives Karen Hayes Karen Hayes Citrix User
- 40. CVE-2018-6857: Sophos Safeguard Priv Esc 0-day
- 41. External Threat: Acting on Objectives Karen Hayes Citrix Administrator Workstation Administrator Other Citrix Servers
- 42. External Threat: Acting on Objectives Compromised Workstation Trader Workstation
- 43. External Threat: Acting on Objectives Compromised Workstation Trader Workstation Workstation Administrator
- 44. External Threat: Acting on Objectives Trader Workstation
- 46. Now What?
- 47. Detection and Response Assessment
- 48. Detection and Response Assessment Outcomes Blue Team had many chances to see what we did. What did they actually see? 1. Ascertain timeline of detected events
- 49. Detection and Response Assessment Outcomes Blue Team had many chances to see what we did. What did they actually see? 1. Ascertain timeline of detected events 2. How repeatable was the detection method and response? 3. Formal reporting to stakeholders 4. Tools and techniques used in response 5. Lessons learned
- 50. Detection and Response Assessment Outcomes 1. Attempt to identify weaknesses in people, processes and most importantly technology which is constraining the detection process 2. Identify areas of strength and significant capability 3. Work together to implement and test these changes
- 51. Conclusion
- 52. Conclusion • Test people processes and technology • Test Blue Teams ability to respond to a threat • Not a replacement for penetration testing • Assurance activities should be continuous • Improve security posture
- 53. Thank You
- 55. TITLE Insert content Insert Content • Insert Content
- 56. Purpose of a Red Team Engagement Holistically test your organisation against a real world breach scenario Strong / Weak Security Posture PROCESS PEOPLE TECHNOLOGY 56 • Measure IR/EDR Capability (Blue Team) • Focus on Depth and not Breadth • Driven from Real World Threats
- 57. External Threat: Acting on Objectives
- 58. Why is Red Teaming Important? A few examples where People, Process, and Technology fell down… 58