Seeing Red In Your Future?

Seeing red in your future?

Ian AmitDirector of Services, IOActive

Hello

whoami?

$ id

uid=501(iamit) gid=20(ioactive) groups=12(hack),33(research),61(dev),79(red_team),80(sexy_defense),81(exil),98(idf),100(dc9723),204(/dev/null)

So, you think you can red team...

As in get your organization a proper red team assessment

First things first.

What is a “Red Team Test”?

!pentest

!social_engineering

“A red team is an independent group that challenges

an organization to improve its effectiveness”

wikipedia

But wait! what about security?

Right... that’s part of the deal...

Security is PART of running an organization!

So how do we go about it?

Agenda

Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)

Map

Map

CISO CIO

CFO CRO

Compliance

Audit GeneralCounsel

Agenda

Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)

Identify

Identify

Identify

Identify

Agenda

Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)

Recruit

Audit

Recruit

Six SigmaSix Sigma

Agenda

Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)

Target

How do I look from the outside?

How do I look from the outside?

Legal

How do I look from the outside?

Legal

Research & Development

How do I look from the outside?

Legal

Research & Development

Procurement

How do I look from the outside?

Legal

Research & Development

Procurement

Information Sources

How do I look from the outside?

Legal

Research & Development

Procurement

Information Sources

Supply Chain

How do I look from the outside?

Legal

Research & Development

Procurement

Information Sources

Supply Chain

Human Resources

How do I look from the outside?

Legal

Research & Development

Procurement

Information Sources

Supply Chain

Human Resources

Sales

How do I look from the outside?

Legal

Research & Development

Procurement

Information Sources

Supply Chain

Human Resources

Sales

Financials

Agenda

Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)

Assemble

Skillz!

Electronic Social

Physical

Electronic Social

Physical

Electronic Social

Physical

Electronic Social

Physical

Electronic Social

Physical

Electronic Social

Physical

Electronic Social

Physical

Agenda

Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)

Scope

Threat model

Threat model

Assets

Threat model

AssetsProcesses

Threat model

AssetsProcesses

Controls

Threat model

AssetsProcesses

Controls

People

Threat model

AssetsProcesses

Controls

People

Technology

Threat model

AssetsProcesses

Controls

People

Technology

Location

Threat model

AssetsProcesses

Controls

People

Technology

Location

Culture

Threat model

AssetsProcesses

Controls

People

Technology

Location

Culture

Adversaries

Agenda

Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)

Monitor

Agenda

Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)

Execute

Execute

Can you hear me now?

Yes

Whazzzzzzup?

Whazzzzzzzzzzuuuuuppp?

What are you wearing?

Hello?

Still there?

Stay in control

of the escalation processes...

Agenda

Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)

Pre-report

IDS

IDS

System Logs

IDS

System Logs

Firewalls

IDS

System Logs

Firewalls

Access controls

IDS

System Logs

Firewalls

Access controls

Call records

IDS

System Logs

Firewalls

Access controls

Call records

Web traffic

IDS

System Logs

Firewalls

Access controls

Call records

Web traffic

DNS

IDS

System Logs

Firewalls

Access controls

Call records

Web traffic

DNS

Social Media

Agenda

Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)

Gap

Example 1: Dumpster Diving Olympics

Example 1: Dumpster Diving Olympics

Example 1: Dumpster Diving Olympics

•Personnel training

Example 1: Dumpster Diving Olympics

•Personnel training•Process changes

Example 1: Dumpster Diving Olympics

•Personnel training•Process changes•Technical controls

Example 1: Dumpster Diving Olympics

•Personnel training•Process changes•Technical controls•Change management

Example 1: Dumpster Diving Olympics

•Personnel training•Process changes•Technical controls•Change management•R&D practices

Example 1: Dumpster Diving Olympics

•Personnel training•Process changes•Technical controls•Change management•R&D practices•3rd party sw security

Example 1: Dumpster Diving Olympics

•Personnel training•Process changes•Technical controls•Change management•R&D practices•3rd party sw security•Physical security routines

Agenda

Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)

Fix

Example 2: Incident Response from HellProcess:Incident response kicks in on any malware with a signature from the past week, or with a generic/heuristic detection.In meantime, malware (APT!?) is left to run (actually ok...)

Problem:High number of incidents in a short time can create a queue. Queue is predictable if IR analysis consists of C&C traffic as well :-)Queue can be exploited...

Example 3: Eager Sales

Example 3: Eager SalesOrganization is a security contractor (build big guns).

Example 3: Eager SalesOrganization is a security contractor (build big guns).R&D, production, testing, management, sales, all in the same location (HQ).

Example 3: Eager SalesOrganization is a security contractor (build big guns).R&D, production, testing, management, sales, all in the same location (HQ).Sales are global, controlled from HQ.

Example 3: Eager SalesOrganization is a security contractor (build big guns).R&D, production, testing, management, sales, all in the same location (HQ).Sales are global, controlled from HQ.Extreme perimeter security, high-end physical security.

Example 3: Eager SalesOrganization is a security contractor (build big guns).R&D, production, testing, management, sales, all in the same location (HQ).Sales are global, controlled from HQ.Extreme perimeter security, high-end physical security.

Sales... few targeted emails, reverse shell home. Network is done. DA on production machines (mfg.), sales ledgers, major diplomatic incident potential...

Example 3: Eager SalesOrganization is a security contractor (build big guns).R&D, production, testing, management, sales, all in the same location (HQ).Sales are global, controlled from HQ.Extreme perimeter security, high-end physical security.

Sales... few targeted emails, reverse shell home. Network is done. DA on production machines (mfg.), sales ledgers, major diplomatic incident potential...

Process breakdown from physical security (USB drops), through separation of duties, network segmentation, egress data management.

Preparing for a red team (map)Locate business critical assets (identify)Getting buy-in (recruit)Defining goals (target)Finding a team (assemble)Define scenarios and RoE (scope)Establish white/blue team (monitor)Hang on tight (execute)Analyze (pre-report)Identify areas of improvement (gap)Create plan for remediation (fix)

mapidentifyrecruittargetassemblescopemonitorexecutepre-reportgapfix

mapidentifyrecruittargetassemblescopemonitorexecutepre-reportgapfix

mapidentifyrecruittargetassemblescopemonitorexecutepre-reportgapfix

RED TEAM READINESS

This isn’t rocket science

It’s not about who’s got the biggest one...

It’s about challenging an organization to improve its effectiveness

It’s about challenging an organization to improve its effectivenessyourself

It’s about challenging an organization to improve its effectivenessyourselfyour peers

It’s about challenging an organization to improve its effectivenessyourselfyour peersyour assumptions

It’s about challenging an organization to improve its effectivenessyourselfyour peersyour assumptions...

There is no certificate at the end :-(

There is no certificate at the end :-(

no CPEs

There is no certificate at the end :-(

no CPEs

no medals

There is no certificate at the end :-(

no CPEs

no medals

Just hard work :-)

And a better ROI than any other test/engagement the organization has ever gone through before

until the next red team...

Questions? Discussion!

map

ide

nti

fyre

cru

itta

rge

tas

sem

ble

sco

pe

mo

nit

or

exe

cute

pre

-re

po

rtga

pfi

x

Questions? Discussion!

Thank You!

Ian Amit@iiamit

ian.amit@ioactive.com