Red team

Hello, and welcome to the show, Cybersecurity Where You Are.

I'm Sean Atkinson, CISO here at the Center for Internet Security, joined by Will and Chris, part of the CIS Red Team.

Will, let's get kicked off.

Give us a brief introduction about yourself, how you got into red teaming, what your path to get to red teaming looked like.

Why don't you kick us off?

Yeah, so my path was probably a really weird one.

So I was eight years in law enforcement with the Army, kind of got out.

did random it work worked in a factory you know made my way through got a job at cis working for the operations support team deploying albert's mdbr ground you know all those services there uh opening for the red team always had a passion with with offensive security so it was kind of a fingers crossed applying for the job you know hoping we hope i'd get it uh got the role and then phenomenal ever since you know the offensive testing is amazing uh so it was kind of a you know went from being the good guy now i get to pretend to be the bad guy and and go that route

First of all, until you feel it, you can't really understand it.

And I remember doing a Red Team exercise.

It wasn't Red Team.

It was actually a tabletop.

But we decided to really game it out with my management during COVID.

The United States already possesses habits that could support this.

We use red teams.

We war game.

Intelligence officers develop alternative hypotheses.

Now our masterclass will be mastering team operations, offensive security in action, right? Where I might give you a little task as well where you can perform something like do the OSINT for me or find some information for me, right? Now, the agenda for the masterclass, red teaming fundamentals, we'll be talking about the threat landscape and attack surfaces, the red team techniques, the red team methodology and frameworks, and then defensive countermeasures and lessons learned.

Now, the very first thing we have to understand, you guys might have joined these webinars earlier as well, and we have discussed about this thing that what is the difference between the red teaming the pen testing the blue teaming now when we are talking about the red teaming right the work of the red team is to find out vulnerabilities explore the vulnerabilities right then pen testers are also there pen testers also do the same thing right now what is the difference the difference is this word which i have written adversary simulation right now when we're talking about the red teaming red teaming means you are simulating the adversarial characteristics so there are lots of apts so if you uh heard this term advanced persistent threats right so there are lots of advanced persistent threat groups like if you go to my attack framework you will find out lots of apt groups and like cozy bear and ajax and lots of them right so they have specific techniques tactics

and procedures that they follow right now those

techniques that they follow we are also falling as a red team yes now in penetration testing what we are doing we are finding out the vulnerabilities exploiting those vulnerabilities and we are reporting those vulnerabilities yes now pen testing is a process which is known by the blue team now who is the blue team blue team are the people who are working into the defensive side of the security they are there to detect the attacks now in pen testing i am not testing the blue team right but in red teaming i am also checking the incident response capabilities of the organization how fast blue team will be able to detect me and if they are not able to detect i am inside the network i may take the excess of the whole infrastructure right so pen testing is what pen testing is a scope box assessment which is focused on finding and exploiting vulnerabilities in specific systems applications or networks right now the goal is breadth of the coverage documenting as many exploitable flaws as possible and providing the remediation guidance but Red teaming is adversary simulation exercise.

Red teamers, they will emulate the real attackers using cyber or social engineering and sometimes physical attack vectors to achieve the objectives.

The defenders don't know the test is happening, which makes it realistic measure of detection and response.

How much resilient your organization is to the attacks, Can it withstand the attacks? That is told by red teaming assessment.

And then blue teaming is the defensive counterpart.

There, the hardware protects the buyer from the owner of the box, and the walls of a container are thinner than they look.

On October 23rd, OpenAI disclosed that in Red Team tests, its agents had escaped hardened micro-virtual machines, with fixes to Kata, GVisor, and Docker, and even passed signals between isolated sandboxes through the timing of the processor's cache.

We covered an earlier escape right here.

And on the ASI pill, we know where this road goes.

In the same three days, three labs showed frontier hacking skill and each gave a different answer.

On Tuesday, Anthropic's Red Team showed that an unreleased model had found serious flaws and then built working attack chains.

It got outside Chrome's protective sandbox.

It got past an Android lock screen.