What is red teaming in cybersecurity?

Cybersecurity has become more sophisticated — but so have hackers. Every year, organizations report billions of dollars in losses due to cyberattacks, a number that experts predict will keep climbing. Organizations must be vigilant about their cybersecurity practices, and red teaming is one way they are trying to do that.

Red teaming is a cybersecurity exercise that simulates a cyberattack on an organization’s system to determine where its vulnerabilities lie. The term was first used in military strategizing, when U.S. military and intelligence agencies created groups that act as the enemy in war games.

While it’s similar to penetration testing, also called pen testing, and vulnerability assessments, each exercise is distinctive:

• Vulnerability assessment: Reviews a target’s security against well-known security threats but doesn’t involve exploitation
• Penetration testing: Exploits security measures to find weaknesses but isn’t scenario-based
• Red teaming: Measures the effectiveness of security response mechanisms in specific situations

The exercises are typically quite elaborate and can accomplish a variety of purposes. First, they test a security team’s incident response time to cyberattacks. Second, they check whether firewalls and monitoring tools block malicious behavior as they’re supposed to and expose hidden weaknesses. Third, they can help a company’s leaders determine where to invest time and money to strengthen their cybersecurity.

This exercise typically has five stages:

1.    Reconnaissance and threat modeling: The team gathers information about the organization, much the same way a malicious attacker would look for weak points in the defense system. This could include scraping public employee data, mapping out the infrastructure and studying third-party relationships. Then, the team creates a digital model of potential attack methods.

2.    Initial access into IT infrastructure: Team members attempt to breach network security through realistic simulation methods such as spear phishing, social engineering or session hijacking.

3.    Privilege escalation and lateral movement: Once the team gains access to the system, it attempts to increase its privileges within that sphere, often by impersonating specific users. This stage tests whether the system has defenses to keep bad actors from obtaining credentials.

4.    Exploitation and objective execution: Organization leaders assign the team a specific objective, such as stealing intellectual property. During this stage, team members attempt to accomplish that goal.

5.    Reporting and blue team collaboration: After the exercise, the red team works with the in-house defense, called the blue team, to improve its overall processes.

It can be helpful to put together a rules of engagement, or RoE, document that clearly defines the scope, boundaries and limitations of a red teaming exercise. Otherwise, the practice could get out of hand and cause more harm than good.

For example, if a security team is performing such an exercise for a hospital, it’s vital that the exercise does not affect patient safety. The RoE may limit the scope to just administrators and nonclinical staff and specify the disruptions that are acceptable.

A comprehensive RoE document includes:

• The methodology and scope of the exercise
• A description of the activities that may be performed
• Types of hardware and software that may be used
• Roles and responsibilities of each group involved
• Levels of threat available
• References to appropriate legal requirements

The RoE document ultimately can protect everyone who is involved with the exercise and ensure continuation of business.

Organizations may find it difficult to imagine they are vulnerable to a cyberattack. If they have an active security plan, they may be overconfident about that plan’s ability to counter an attack.

The exercise puts those beliefs to the test. Company leaders can get an attacker’s perspective on their defense system and view a simulated real-world attack and its repercussions. If they have been investing a substantial amount of money in security, this is their chance to see its impact.

It also gives them an opportunity to test their internal incident response capabilities. Sometimes it may be difficult to prevent a cyberattack, but a well-prepared organization can shut it down soon after it begins.

Members of the attacking team are in a unique position, as they are outside the planning process and therefore more easily able to identify flaws in the system. They can also foster healthy debate among stakeholders within the company, prompting discussions that promote a culture of problem-solving.

In a red teaming exercise, white hat hackers are not the only involved parties. There are often three distinct functions: red, blue and purple.

• Red: Acts as the attacker by performing ethical hacking, penetration testing and social engineering simulations.
• Blue: Operates as the internal defense mechanism protecting networks, systems and sensitive data.
• Purple: Functions less as a stand-alone permanent department and more as a cooperative operational model. It bridges the gap between offensive and defensive units by sharing attack telemetry and tuning detection rules in real time.

Red, blue and purple teams complement each other through offense, defense and collaboration. The red team attacks to find weak spots, the blue team defends and monitors systems, and the purple team bridges the gap to share knowledge and fix gaps fast.

Whether a company chooses to create these groups largely depends on its resources, and whether it has enough budget and staff members who can take time away from their duties to act as the purple team.

Before the attack begins, the individuals on the red side of the equation need to gather information. They may use several methods of reconnaissance:

• Passive reconnaissance: This involves gathering information without directly interacting with the target. Would-be attackers use public sources such as search engines, public records and OSINT, or open-source intelligence, data.
• Active reconnaissance: Team members interact directly with the network, using tools to perform network mapping and vulnerability assessments.
• Social reconnaissance: Details are collected about employees through social media and company directories, identifying targets for phishing.

The ensuing attack could include:

• Phishing: Using the results of their social reconnaissance, team members send emails to targeted employees, baiting them with legitimate-looking links that will allow them access to the network.
• Privilege escalation: Attackers can exploit a system’s vulnerabilities to expand their access to sensitive data.
• Lateral movement: After escalating their privileges, attackers move laterally across the network to reach their objectives. If an organization is well-segmented, this will be difficult for them to achieve.

After the exercise, leaders will need to measure just how effective their defenses were. They can do this through analyzing:

• Time-to-detection (TTD): The number of hours or days from initial red team execution to the first high-fidelity security alert
• Time-to-mitigation/containment (TTC): How long defenders took to isolate compromised hosts and cut off lateral movement vectors
• Alert-to-analyst ratio: Evaluates if red team activity generated actionable alerts or got lost in benign security log noise
• Telemetry visibility gaps: The specific security data sources or logs that failed to record the red team's malicious actions

If a company is serious about embarking on a red teaming exercise, it should take sufficient time to prepare. First, it will need to assemble its red team, which could consist of internal employees, external contractors or a mix of both.

The red team has various roles, including:

• Operators: Execute attacks, including phishing, social engineering and lateral movement
• Planners: Design scenarios based on real-world attacks and set the rules of engagement and objectives
• Coordinators: Act as the link between the team and the company’s management, ensure safety and deliver final reports

As the company prepares for the exercise, its leaders will want to take a close look at their policies and communication plans.

After the exercise the attacking team will report its results to management and translate its findings into actionable risk insights for executives. The point of the process is to make improvements so this type of attack is less likely to happen in real life.

Red teaming is just one of the tools people in the cybersecurity field use to protect systems from corruption. Curious to learn more about cybersecurity practices? University of Phoenix offers IT programs including:

• Associate of Science in Cybersecurity
• Bachelor of Science in Cybersecurity
• Advanced Cybersecurity Certificate (Undergraduate)
• Cyber and Network Defense Certificate (Undergraduate)
• Master of Science in Cybersecurity

For more information, contact University of Phoenix.