Red Team Development and Operations: A Practical Guide

✍ Scribed by Joe Vest, James Tubberville

• Publisher: redteam.guide
• Year: 2020
• Tongue: English
• Leaves: 179
• Series: 1
• Category: Library

✦ Synopsis

This book is the culmination of years of experience in the information technology and cybersecurity field. Components of this book have existed as rough notes, ideas, informal and formal processes developed and adopted by the authors as they led and executed red team engagements over many years. The concepts described in this book have been used to successfully plan, deliver, and perform professional red team engagements of all sizes and complexities. Some of these concepts were loosely documented and integrated into red team management processes, and much was kept as tribal knowledge. One of the first formal attempts to capture this information was the SANS SEC564 Red Team Operation and Threat Emulation course. This first effort was an attempt to document these ideas in a format usable by others. The authors have moved beyond SANS training and use this book to detail red team operations in a practical guide. The authors’ goal is to provide practical guidance to aid in the management and execution of professional red teams. The term ‘Red Team’ is often confused in the cybersecurity space. The terms roots are based on military concepts that have slowly made their way into the commercial space. Numerous interpretations directly affect the scope and quality of today’s security engagements. This confusion has created unnecessary difficulty as organizations attempt to measure threats from the results of quality security assessments. You quickly understand the complexity of red teaming by performing a quick google search for the definition, or better yet, search through the numerous interpretations and opinions posted by security professionals on Twitter. This book was written to provide a practical solution to address this confusion. The Red Team concept requires a unique approach different from other security tests. It relies heavily on well-defined TTPs critical to the successful simulation of realistic threat and adversary techniques. Proper Red Team results are much more than just a list of flaws identified during other security tests. They provide a deeper understanding of how an organization would perform against an actual threat and determine where a security operation’s strengths and weaknesses exist.Whether you support a defensive or offensive role in security, understanding how Red Teams can be used to improve defenses is extremely valuable. Organizations spend a great deal of time and money on the security of their systems. It is critical to have professionals who understand the threat and can effectively and efficiently operate their tools and techniques safely and professionally. This book will provide you with the real-world guidance needed to manage and operate a professional Red Team, conduct quality engagements, understand the role a Red Team plays in security operations. You will explore Red Team concepts in-depth, gain an understanding of the fundamentals of threat emulation, and understand tools needed you reinforce your organization’s security posture.

✦ Table of Contents

Introduction......Page 12
Red Team engagements focus on specific goals and objectives .......Page 18
Red Teams in Security Testing......Page 22
Engagement Planning......Page 30
Cost and Funding......Page 31
Scope......Page 32
Duration......Page 33
Personnel Labor Cost......Page 34
Equipment and Software Cost......Page 35
Travel Cost......Page 36
Pre - and Post - Engagement Cost......Page 37
Frequency......Page 38
Engagement Notifications......Page 40
Roles and Responsibilities......Page 42
Rules of Engagement ( ROE )......Page 46
Managing Risk......Page 48
Threat Planning......Page 50
Threat Profile......Page 53
Creating a Threat Profile by Decomposing a Threat......Page 57
A review of a blackhat's tradecraft......Page 60
Threat Perspective......Page 64
Threat Scenario......Page 66
Threat Emulation......Page 67
Scenario Models......Page 68
Indicators of Compromise......Page 70
Engagement Concepts......Page 72
Deconfliction......Page 77
Data Handling......Page 80
Engagement Execution......Page 85
Data Repository......Page 86
Data Collection......Page 89
Tradecraft......Page 93
General Guidance......Page 94
Execution Concepts......Page 99
Tools and Tool Examples......Page 103
Command and Control ( C2 )......Page 108
Engagement Culmination......Page 120
Sanitization and Cleanup......Page 121
Operator Log Verification......Page 123
Pre - Report Briefings......Page 124
Engagement Reporting......Page 131
Attack Flow Diagrams......Page 132
Observations vs . Findings......Page 134
Risk Rating and Metrics......Page 135
Risk Matrices Comparison......Page 136
Attack Narrative......Page 145
Conclusion......Page 153