What is Red Team Testing?

Introduction

With each day, bad actors and hackers are expanding their methods of attacking businesses. As such, it’s important for cybersecurity to get better as well. One of the best ways to counter against these bad actors is through Red Team Testing. These tests are crucial to any company’s cybersecurity posture, considering they’re the best way to prevent vulnerabilities from being used against a system or network.

There are plenty of different penetration tests that a business can get to test their network’s security. The government requires these to be done in some manner, depending on the size of the business, like assets and employees. This is especially true for financial institutions like banks and credit unions, but if you store customer information, you should want to protect that. Businesses who don’t take their customers’ information seriously will cause customers to lose faith in the business.

What is a Red Team Test?

A red team test is a type of penetration test that simulates an all-out attack on a business’s network. It is much more in-depth and is much more intense than a normal internal penetration test or external penetration test. It is a combination of observation and information gathering, social engineering, and penetration testing. It is a test that can go over several weeks to get all the information about the network’s vulnerabilities and resistance to threats.

A Red Team test is one of many different types of similar penetration tests. The major differences that set the Red Team Test apart is the intensity and knowledge used in the simulated attacks. Red Team Tests are strictly on the side of the cybersecurity firm performing testing, where a Purple Team Test is a combination of the firm and the business making an effort to work together to find vulnerabilities in the system.

In a Red Team test, a security analyst, or team of analysts, will use the tools available to most bad actors trying to get into your system. This includes anything available on the internet itself and gather the information that is publicly available. Many people are sometimes unaware about just how much information is freely available. Names, contact info, titles, IP addresses, and more are usually public information, depending on how your company handles it.

It is important to have this information available, however. There is a fine line between having information and putting out too much information—customers need a way to contact the business if they need to. However, bad actors can use these same connections to get deeper into a network or into an employee’s attention. In a world with Google, LinkedIn, tools that can scan email signatures, and more, it can be difficult to keep specific things out of reach.

With these methods, a red team, which is usually a cybersecurity firm’s security analyst team, will try to get into a company’s network. It is a full-scale attack that will replicate what a real attack would look like. These campaigns can be dangerous in an uncontrolled environment, especially because employees are the greatest risk a company can have. One small click on a phishing email can bring a company down for days and can cause irreparable damage.

Red Team Testing Process

Because Red Team tests are so intensive, there are a few things that are done differently from other penetration tests. These tests usually last over a few weeks, so there is plenty of time to get the information that is necessary. However, despite the test’s intensity, it shouldn’t interrupt any of the business’s procedures.

Scoping the Test

Before anything is done, the first step is scoping out the actual process. This usually involves figuring out how big the business is, including asset size, employee amount, control points, and various other pieces of information. Since Red Team tests are so intensive, there is a lot of specific information necessary and will likely be more expensive than most other penetration tests. This will also be the time to discuss scheduling and durations of each part.

Blind Reconnaissance

The first step of the test is to get as much information as the security analyst can get. They usually get it from areas that already exist online, usually from company websites, directories, email signatures, official channels, and sometimes from the employees themselves. Depending on how open the business is and what the websites contain, this information can be easily found. Security analysts will get things like employee names and titles and eventually use these things to try to socially engineer employees later.

However, there are other pieces of information that can be of use, too. After getting names and other things, it is possible for the security analyst to also get personal information, especially if the person has a presence on the internet. This includes things like social media like Facebook and Twitter where a security analyst can find friends and family. With this information, security analysts can make the social engineering like phishing and vishing a bit more personal.

Penetrating the Network

With the on-going social engineering campaign, the security analyst will use the information obtained to try to get into the business’s network. It is possible that an employee may have given the security analyst some sensitive information with the phishing and vishing, but they will also manually try to get in with password crackers and various vulnerability scans that are available to most bad actors.

These scans will usually tell the security analyst if there are any holes or missing security updates. If there are, it is possible that the analyst will be able to get in from that. They will exploit anything that they can in the simulated attack, eventually finding what they can. Hopefully they won’t be able to get into the system, but it is always possible that they might succeed.

Inside the Network

If the security analyst can get into the network, that in itself is a red flag for a business. There is usually an internal aspect of a red team test, depending on what was agreed upon. Regardless of how the security analyst gets in, there is a second portion to see what a bad actor or hacker can get while inside the initial penetration. Normally, these are an external penetration test and an internal penetration test.

This section of the Red Team Test deals with everything a hacker might have access to when getting into a business’s network. Employees and administrators should have different levels of access, which means that a higher level of employee could lead to more things compromised if hacked. These are researched and reviewed to make sure that even these deeper access points are protected properly. Getting through those defenses can spell disaster for a business.

Reporting the Test

After all of the Red Team test is finished, which can take up to a month of time, a report is supplied by the cybersecurity firm. These reports are usually very detailed, explaining all of the vulnerabilities and threats that are found during the test. There may be multiple ones, depending on the amount of testing and the number of networks that are tested in it.

The security analyst will likely sit down with the business and go over the findings. There will probably be a few that are found, but there will be a scale of minor and major levels of threat. They will likely make suggestions on remediation, but third-party cybersecurity firms usually don’t remediate themselves. With the report and information in hand, it is up to the business to fix the threats and vulnerabilities.

Retesting the System

Retesting is an important part of any penetration test, including Red Team tests. While the retest likely won’t be as deep or intense as the normal Red Team test, it will provide a proper report to show that the threats have been taken care of. This is a report that will be given to your examiner as well, showing that your business is up to regulations and standards that the government has set.

Depending on the size and number of networks being tested, there may be multiple tests that can be done. Some are included, but these tests can be done at any time. If a business wants more retests, it is simply a matter of contacting the security analyst or sales person that is in charge of your account. Retests are usually recommended, but aren’t necessary.

Conclusion

Red Team tests are intense simulated attacks simulated attacks where a cybersecurity firm will act like a real bad actor or hacker. A security analyst will use real-world techniques that hackers use and try to find vulnerabilities that may be hidden in the network’s system. It can be a relatively expensive test to get, but it’s important for bigger businesses and companies that deal with sensitive information.

Not all businesses will need a Red Team test, but it is a good option to look into regardless. There are a lot of different steps when it comes to these types of penetration tests, so be sure to plan ahead and get a timeline for yours.