Red Team Operation

Introduction to Red Team

Red Teaming comes under the amount of assessment in the information security domain. Red Teamers have to determine the risk to the network infrastructure of AN organization as a measure of pre-evaluation so that the execution of engagement will be carried properly. So as to see such risks, it’s the first responsibility of Red Team operators to recognize potential threats or vulnerability. Varied tools, whether open-source or commercial, can be used by Red Teamers to acknowledge vulnerabilities and to use them to their advantage. However, the Red Teaming approach is a lot of in-depth than what most potential attackers follow as a result of they’re making an attempt to find one vulnerability, whereas security professionals need to realize all possible vulnerabilities for a given infrastructure so as to assess the associated risk. Attackers usually only target one vulnerability for a particular exploit as a result of to do otherwise would increase the possibility for detection. Nevertheless, Red Teaming ought to check for every type of attack to supply an entire security assessment. Appropriate situational awareness of security infrastructure could be a result of careful Red Team analysis. However, the process of Red Team won’t be sufficient in identifying risk; the organization ought to continue maintaining the security measures from their finish so as to suitably manage risk and supply security protection.

What is the Red Team?

Red Team is a group of extremely trained pentesters that is summoned by a company to check their defense and improve its effectiveness. Basically, it’s the approach of utilizing methods, systems, and methodology to simulate real-world eventualities therefore as to prepare and measure the safety defenses of the organization. the target of the Red Team is to simulate the real-world attacks in order to measure the organization’s defenses and their incident response Team. Red Team follows the Roles of Engagement (RoE).

What are the aspects of the Red Team?

Threat Emulation

Operational Impacts

Comparing Red Team Engagement to alternative security testing varieties

Red Team Operator Traits

Threat Emulation: this is the method of mimicking the TTP’s of a specific threat. Emulation can be done of varied attacks like – zero attacks, script kiddie to the advanced adversary or a specific threat like botnets, ransomware, DDOS, etc. no matter what the situation, the TTP outline by the scenario drive the principles a Red Team should follow to perform an engagement. once creating the threat emulation situation, that threat’s key part should be outlined. when in practice it can be difficult to simulate the real-world situation in a definite manner. Therefore, the main focus of the Red Team is should be on the key component and then use their own TTP to fill within the gaps. the most important challenge in threat emulation is simulating the threat to tier wherever associate degree analyst believes the threat is real, Approaches range from using malware to developing custom malware that models a real vulnerability, to using tools that generate the indicators of compromise (IOCs) an attack from a real threat leaves behind. In any case, effective coming up with and determination of the critical components of a threat can result in better threat emulation design.

For Free Demo classes Call: 7798058777

Registration Link: Click Here!

Operational Impacts: Operational Impacts are processed against a target designed to demonstrate physical, informational or operational weaknesses in security. These effects can be as general as performing a denial of service attack or a lot of specific such as using high jacked ICS equipment to manage a city’s power system. it’s operational impacts that distinguish Red Teamer from others. Operational Impacts can be very effective in demonstrating realistic impacts against a target. the level of depth and of the impact can be as ‘painful’ as a corporation is willing to explore. These impacts are usually performed against live production systems to have the best level of fidelity but can be executed on test and development environments if they’re representative systems

What is the specialization of Red Teamer?

Red Teamers must understand and be an expert in a diverse set of technologies such as :

Different operating systems and software packages

Diverse networking protocols

Custom applications and protocols

Physical security defenses

Social interaction

Custom or specialized technologies

System Engineering

Networking

Software Development

Physical Attacks

Why do we need the Red Team?

To challenge the extent of an organisation’s defenses so when and if a real attack happens then they stay protected or come up with a counter measure. for instance, a group of hackers has a goal of stealing crucial information from a target. A targeted phishing attack check the end user’s awareness of the attack. The payload of the attack tests the network and host defenses against delivery of malware and ultimately code execution, If the attack does trigger a defense, the response tests the defender’s actions in distinctive, responding or stopping the attack. In any case, the whole scope of security defense is analysed. A extremely competent Red Teamer will tune their attacks to spot wherever the failure points area unit by turning up or down that ‘volume’ of associate degree attack.

For Free Demo classes Call: 7798058777
Registration Link: Click Here!

Red groups area unit is able to execute custom threat as a part of their engagement. It will check a set of security of latest threat kind or validate the effectiveness of security controls against a replacement or specific threat sorts. Threat emulation situations area unit a valuable distinguisher of Red Teaming from different styles of security assessments and may be wont to perceive however a corporation stands up to new zero-day attack.

How to handle client data?

Client information should be handled with extreme care. the data collected during associate engagement can be misused if fallen in the wrong hands.

Permission :

The ROE should determine permissions for Authorization :

Actions

Data collection

Data Leverage

Target space

User groups

Policy Controls :

It is implemented by the Red Team and it includes :

A Red Team non-disclosure agreement

Data training it means identifying and avoiding PII, PA data, etc.

Ethics training

Individual Background Checks

For Free Demo classes Call: 7798058777
Registration Link: Click Here!

Physical Controls :

There should be a multi-layer of physical controls applied to protect the engagement tools and operating system from any kind of loss. Therefore, Red Teamers ought to be accustomed to physical controls that are in place. Such security mechanisms include :

Tools, computing systems and customer data behold on within isolated space secured with cipher lock and controlled solely by Red Team.

Minimize contact between the Team and external entities.

When not in use, all data and equipment ought to be removed and placed into lockable cases, safes or storage cabinets.

During travel, laptops, and hard drives are secured at all times.

All visitors to Red Team should be escorted and signed in and out.

Customer information should only be handled by Red Team personnel with a need to know.

During the off-site engagement, the information should be encrypted for transmission.

Software Controls :

The list of  software controls are designed to ensure the confidentiality, anonymity and safety of information should always be employed in whatever context :

Each host and guest operating system should be encrypted and protected with a powerful password.

Each host and guest operating system should be used with a host-based firewall specific to the engagement.

Data and tools used during an engagement should be stored in an encrypted container and moved to the operating directory only needed.

All Red Team software  should be removed from the target environment at the end of the engagement.

All access, movement and use of data and tools should be added to the Operations Logs

If a tool isn’t required then it should be removed from the environment.

Common repository :

A common repository should be made available to all the Red Teamers assigned to engagement.

It should be stored among an encrypted volume

It should always be encrypted volume lives on centralized server/NAS/file share

It should be mountable or accessible only when authentication

Repository layout should be in Hierarchy.

For Free Demo classes Call: 7798058777
Registration Link: Click Here!

Data collection

Data collection is that the core of every engagement. data collection is directly proportionate to the success of engagement. in other words, the collection of data drives the value of the engagement. data assortment should be complete with the enabling of replication of activities and results. It should also help you to spot the things of significant interest to the operators. Final data sets should include :

Pre-event data

Execution data

Operator logs

Automated data collection and logs

Screenshots

Post event data (data archive, sale brief, final report)

Execution data requirements

Under this, the Team should check that every one data that’s being handled is safely logged. All activities related to Red Team operations should be logged as the engagement begins and only terminates after all the activity associated with the engagement is completed. The events that ought to be logged are :

• Scanning activities
• Exploiting events
• Stimulation efforts
• Deconfliction discovered
• Target data discovered
• Target acquired and lost
• System events
• Login attempts
• Credentials captured
• Credentials used
• File system notifications
• Modification or disabling of security controls
• Modifications or suppression of security alerts or logs
• Methods of persistence employed
• Methods access
• Methods of access
• Methods of persistence employed
• Command and control channels established
• Request to extend, decrease, pause activity
• ROE conflicts, request and modifications
• Operator Logs

As stated earlier, all the activity should be logged accurately and briefly. at the very least, the following data must be collected and logged for each action performed :

• Start Timestamp (UTC Recommended)
• End Timestamp (UTC Recommended)
• Source ip (Attack/Test System ip address)
• Destination ip (Target information science Address)
• Destination Port (Target Port)
• Destination System Name
• Pivot ip
• Pivot Port
• URL (Note, it’s important to capture the full url of the Target instance)
• Tool/Application
• Command (Full command)
• Description
• Output
• Result
• System Modification
• Comments
• Screenshot
• Operator Name

Automated data collection

Where ever the chance, the red team must use tools and scripts available to capture and consolidate engagement data. data collected by automated tools is not  enough for Red Team.

Terminal logs

All Red teams engagement systems should have automated collection of raw terminal data. each command should be prefixed with operator’s ip and utc timestamp. it is more important that information is accurately captured rather than being captured in a novel way.

Commercial tools

Most tools used for Red Team have some level of logging the activities, but the location of logs that will be maintained is different depending on the tool and many of them required the operator to trigger log generation. In any case it is quite handy to use business tools.

Consolidation

Daily transfer of those logs to the engagement repository is recommended. Preference should be to make a backup script that copies every set of logs to the repository when executed at the end of the day.

Screenshots

Details concerning Red Team actions are often met with inability. Even when the Team has undeniable evidence of access to extremely restrictive network or physical area, target personnel sometimes have issues conceding access was obtained.

For Free Demo classes Call: 7798058777
Registration Link: Click Here!

 

Author-
Manwar, Rajesh
SevenMentor Pvt Ltd

Call the Trainer and Book your free demo Class for now!!!

© Copyright 2019 | Sevenmentor Pvt Ltd.