Red Team Operations
Simulated attacks through a red team engagement enhance your information security program. NetSPI’s red team operations put your organization’s security controls, security policies, incident response, and cybersecurity training to the test.
Our Red Team Operations
Our red team operations aim to gain unauthorized access to your environment while avoiding detection and maintaining access for a pre-determined period of time to test your incident response team’s ability to identify and respond to threats. A red team engagement uses penetration testers and red team tools to help you assess risk to IT assets, benchmark current security capabilities, justify security investments, sharpen the skills of your team, and improve detective controls.
Red Team Operation Models
Assumed breach | Black box testing
Test Your Organization’s Ability to Identify and Respond to Threats with NetSPI Red Team Operations
All organizations face the possibility of being targeted by organized, sophisticated, and determined attackers, so it’s imperative to learn everything you can to improve your organization’s security posture. NetSPI’s red team operations leverage tactics, techniques, and procedures used by real-world attackers to help better understand exposures and your ability to respond to threats.
During our red team operations, NetSPI works with you to define the rules of engagement and project objectives to ensure clear expectations are set and met.
What Is Red Teaming?
Despite the large investments many companies have made in detective controls, they often struggle to detect tactics, techniques, and procedures used by real-world threat actors during sustained and sophisticated attack campaigns.
RED TEAM ATTACKS
BLUE TEAM DEFENSES
Red Team + Blue Team = Purple Team
How Can a Red Team Avoid Detection?
- Do not perform large scanning operations.
- Do not perform online dictionary attacks.
- Perform recon locally and on the network.
- Perform targeted attacks based on recon data.
- Do not use common attack tools, especially on disk. Use custom attack tools whenever possible.
- Stay off memory and off disk when possible.
- Blend in with your environment. Try to behave as a normal user or application.
- Try to use native technologies to access the environment remotely without a command and control (C2). If C2 is required, use beaconing, tunneling, and side channels.
- Do not change major configuration states.
- Do not create accounts or modify group memberships.
- Understand employed endpoint detection and response (EDR) solutions and tailor attacks to avoid or bypass those controls.
How Can a Blue Team Detect Less-Skilled Attackers?
- Create and maintain a security controls inventory to ensure there is an understanding of available data sources and preventative/detective capabilities.
- Understand all the layers of your environment and define clear detective control boundaries.
- Map out data and logging at each layer and identify indicators of access (IoA) and indicators of compromise (IoC).
- Find detective control solutions or write your own tools. Canaries are especially effective and low cost.
- Be creative. For example, many endpoint protection suites can detect common scanning activity in the absence of network-based intrusion detection system (IDS).
- Audit for high-impact security events, including the most common IoAs and IoCs at each layer in your environment.
- Work with your red team to test your controls. Red and blue teams should work together to understand attacks in depth.
Pentesting Research and Tools
Learn about penetration testing on our blog, our open source penetration testing toolsets for the infosec community, and our SQL injection wiki.
