It’s been said that businesses should adopt the attitude of “when” rather than “if” a cyberattack will occur. An effective wat to prepare for such an occurrence is a penetration or “red team” test.
A typical penetration test is a simulated cyberattack on a computer system performed to identify vulnerabilities that could be exploited by unauthorized parties to gain access to your systems and data. Vulnerability testing involves scanning the network to identify known weaknesses and flaws that require patching.
Although important and necessary, neither testing procedure is specifically designed to identify the assets an intruder could access once they gain access to the system, nor do they aid in assessing the security infrastructure’s effectiveness at resisting current attacks, since they don’t include the tools used by a real attacker such as malware, social engineering, exfiltration of information and persistence.
Supplementing your regular scanning and penetration testing program by simulating real attack scenarios provides your security team with a look at your existing cybersecurity readiness and actionable intelligence for improving cyber defenses.
Red teams are external entities brought in to independently test the effectiveness of your security program. They’re hired to emulate the behaviors and techniques of likely attackers to make it as realistic as possible. The main objective of the red team engagement is to gain access to specific data or targets that are discussed prior to engagement kickoff. Overall, this type of test is designed to demonstrate the potential effect of an actual breach and let you know which of your data stores are vulnerable.
A red team digital attack simulation is similar to traditional penetration testing except the scope is more defined and the focus of the exercise is on demonstrating what a hacker would do once they breach your internal network. In addition, a red team uses a number of different nonbusiness-impacting tactics to bypass the organization’s defenses. This approach allows the red team to simulate, as closely as possible, an attacker targeting the subject organization under controlled conditions.
Intelligence from a red team simulation provides these benefits:
• Simulates attack scenarios based on real-world threats.
• Demonstrates true offensive techniques to organizations.
• Helps identify return on investment for cybersecurity solutions.
• Provides a true “quantitative” risk analysis.
• Focuses on what’s valuable — data and assets.
• Is designed to improve your security team.
And with a red team simulation, you still receive the penetration test report plus insightful guidance.
Rick Lucy is a director at BKD CPAs and Advisors.