During DEF CON 28 Safe Mode I have spoken at the DEF CON Groups VR Village, with a talk called Tactical Adversary: building a practical internal red team.
DEF CON was online that year, so the village ran in a virtual world, avatars and all. The talk introduced IRTOF, my framework for building an internal red team step by step, and how a small team can start running adversary simulation inside its own organisation.
What I covered
I started with the definitions, because that is where most of the confusion begins. A vulnerability assessment is not red teaming. A penetration test is not red teaming either. A red team is a group of skilled people who keep challenging the plans, defensive measures and security concepts of an organisation. There is even a slide in the deck about the sales pitch that sells pentests and vulnerability scans as a "red team" service.
The rest of the talk was the framework itself. It breaks the journey of an internal red team into five phases, named after how we learn to move.
- Phase 1, crawling. Budget approval, practical goals and objectives, the crown jewels and the people around them, rules of engagement and reporting, support from management and legal, understanding the current security posture, and hiring the team.
- Phase 2, getting on your feet. Red team infrastructure on DigitalOcean, GCP or AWS, open source and in-house tooling, business specific risks, making friends with the blue team, adversary emulation with Atomic Red Team and Caldera, validating defences against MITRE ATT&CK, manual campaigns against the organisation and its employees, external attack surface mapping, and a remediation process for what you find.
- Phase 3, walking. Better TTPs based on what you learned, fixing the findings around the crown jewels and people, testing the incident response process, automated emulation and campaigns, targeted APT emulation based on threat intel, and better process documentation.
- Phase 4, running. Continuous purple team exercises, enterprise tooling, targeted campaigns against the crown jewels and key people, overt physical security assessments, awareness for employees and key people, regular training for operators and defenders, and proactive remediation.
- Phase 5, flying. Mature red team operations, highly skilled operators, custom tooling, covert physical assessments, and continuous adversary simulation that keeps the defenders on their toes.
Key takeaways
- Get the definitions right before anything else. A red team that is measured like a pentest team will not get the time or the scope it needs.
- Phase 1 has almost nothing to do with tools. Budget, goals, crown jewels, rules of engagement and legal backing come first.
- Work with the blue team from day one. The whole point of the red team is a better defence.
- Plan in two layers: a long term strategic plan, delivered as a series of short tactical engagements. Management always needs updates, and the tactical plans give you something real to report.
What was shown
This was a slide talk with no live demo. The deck also has the Kalari Payattu artwork, a red team versus blue team drawing based on the martial art from Kerala, which shows up in my later talks as well.
Slides and recording
The slides are linked on this page, and the recording is on the webcast page. I gave an updated version of this talk two weeks later at The Diana Initiative, and a longer one at BSides Delhi 2020. Thanks to Jayson E Street, DEF CON Groups, DEF CON Group Delhi and the DC0471 members.