Red Teaming

• Technology: applications, networks, appliances, etc.
• People: staff, support, external contractors, third parties, etc.
• Physical: offices, data centers, properties, etc.
• Processes: defence controls, incident response, remediation flows, etc.

• Training the Blue Team in an adaptative manner.
  Usually the staff building a Blue Team are concerned about the judgment of their work and keep a defensive position in regard to the assessment. We have a constructive approach and dynamically adapt our TTPs to their capabilities. By gradually increasing the complexity of the attacks to optimize the learning curve of the Blue Team our Red Team helps to enhance the general security level of your organization.
• Providing a snapshot of the security level of your organization.
  Big enterprises invest a lot of money for staff/security solutions and appliances that are usually not tested in real-world situations. Our Red Team assessments help them to gain a realistic view of the current security state and make sure that they are on track with their Return of Investment (RoI).
• Understanding the severity of a breach and the potential business impact that it could have.
  SEC Consult Red Team assessments highlight the high impact of a real attack. So, the management board of your organization will understand the importance of an accordingly endowed security budget to fix the issues spotted during the test and improve the global security level of your company.
• Verifying that all the necessary defensive processes are in place.
  Attacks are inevitable but implementing effective (and tested) strategies makes the difference between a regular assault and a complete disaster in business terms. The attack scenario only represents the beginning of the Red Teaming process, following steps may involve testing how effective the Incident Response strategies are.
• Increasing the security level of an organization in any way possible.
  During the assessments our Red Teams usually spot many different issues that sometimes are “invisible” for your company due to different reasons

All Red Teaming projects and services follow previously agreed on rules between your company and SEC Consult. Experts with different specialty areas implement these attack simulation scenarios in a thoroughly structured, safe and smart way. The SEC Consult Red Team has the full clout of an international team of experts at their disposal – which inevitably leads to impressive results.

The SEC Consult Red Team challenges the Blue Teams to respond to cybersecurity incidents, identifies vulnerabilities in their cyber defence strategy, and evaluates them. To do so, SEC Consult’s experts mimic the behavior of real cybercriminals and use a variety of possible attack patterns and attack vectors: from collecting open source intelligence (OSINT) to social engineering, (spear-)phishing with customized malware, to physical infiltration and compromise of the organization.

1. Planning: In close coordination with you SEC Consult’s Red Team defines the basics of the assessment (objective, scope, timeframe, communication, etc.)
2. Reconnaissance: We gather information about your company, infrastructure, staff, etc.
3. Weaponization: Based on the information obtained, we make a plan, target some objectives and generate the malicious payloads that will infect/exploit the targets.
4. Delivery: Our Red Team will use the necessary (legal) methods to execute the malicious payloads/exploits within the environment. In this phase we often use social engineering.
5. Command and Control: We establish a reliable communication with the attack infrastructure. Our Red Team will act dynamically and with stealth to be able to counteract the detection or block methods of the Blue Team.
6. Lateral Movement: Having established the first foothold, the attack will be expanded through other layers of your organization – as far as possible but always in the direction of the agreed objectives.
7. Escalating Privileges & Persistence: Privilege escalation on the systems is usually required to accomplish the objectives. Persistence is also necessary to avoid repeating the initial phases.
8. Completing the mission: Our Red Teams accomplish the mission by exfiltrating data or performing the necessary actions agreed in the planning phase.
9. Documentation and post-mortem: SEC Consult’s Red Team experts report all the methods they used in each phase, also documenting a clear timeline. This allows the Blue Team to investigate the incidents from its perspective. It is very useful to reserve some time for this phase: In some cases, it will be necessary to clarify multiple concepts or repeat interesting cases with the Blue Team.

• The MITRE ATT&CK Framework is used for threat modelling for most of our customers. This way, the actions of our Red Team can easily be identified by your Blue Team and the manager responsible for the IT of your company during the assessment.
• The Red Team: Our Red Team also uses the “Adversarial Attack Simulation Exercise Guidelines for the Financial Industry in Singapore”. This set of cybersecurity assessment guidelines provides financial institutions with best practices and guidance on planning and conducting Red Teaming exercises to enhance their security testing.
• The TIBER-EU FRAMEWORK (the European Framework for Threat Intelligence-based Ethical Red Teaming) is used as it is the first Europe-wide framework for controlled and bespoke tests against cyberattacks in the financial market. Read more in our blog: 
  • TIBER-DE: SEC Consult Helps The Financial Sector To Strengthen Its Cyber-resilience
  • TIBER-DE: Attack Simulations To Ensure Greater Resilience Against Cyber-Attacks In The Financial Sector
  • TIBER-DE: Identify Vulnerabilities In The Cyber Defense Strategy With The Red Teaming Test

Depending on the variation, typically between 1 and 3 months, sometimes more, if necessary.

• Performing a Red Team assessment is the only way to avoid damages!
• Our experienced team will only execute the necessary attacks (i.e. take the shortest path to the objective) to avoid compromising assets unnecessarily or cause collateral damage.
• SEC Consult Red Teams comply with all laws, regulations, and policies.
• Our specialists act with common sense in sensitive environments based on every customer’s specific business.
• We use tested tools, tactics and procedures.
• Our experts only use encrypted communications in a safe/temporal environment, reports after the assessment are also encrypted.