Tribe of Hackers Red Team. Marcus J. Carey

team comes from the team aspect. Typically, companies get penetration tests conducted by a single consultant who usually has a general skill set. A red team brings a group of individuals whose specific skill sets are aligned with the company’s infrastructure. The idea is that just because you’re on the team for this client doesn’t mean you will be on the team for the next. If your background is Linux penetration testing, there is no reason why you should be on the team against a target that is a full Windows shop. On the client side, having a penetration tester skilled in Linux is a waste of their money and will provide less value. Keep in mind, I’m not saying the Linux tester is not good and couldn’t learn, but we must remember that we are beholden to the client and not our pride.

Lastly, but equally important, red team engagements focus on targeted goals instead of a specific scope. Without a rigid scope, the red team can work naturally and pragmatically to attempt to achieve the goals in the best way they see fit, much as an actual attacker might.

       Have you ever recommended not doing a red team engagement?

      Absolutely. I’ve seen clients get sold on the buzzword red team and want one, but in reality, they still haven’t fixed their critical, high, or even medium findings from their last few penetration tests.

      When a client requests a red team, I try to understand how they have been performing previous security assessments and how they are handling remediating the findings. If they are still doing vulnerability scans and haven’t moved to penetration testing, they aren’t ready for a red team. If they are doing penetration tests and not remediating findings, they aren’t ready for a red team.

       What’s the most important or easiest-to-implement control that can prevent you from compromising a system or network?

      This isn’t the answer you want but the answer you need: small and medium-sized businesses are typically solely focusing on building their business and scaling. As a result, their dollars are usually allocated to endeavors to facilitate this. The right answer is that you need a consultant. Just as most small and medium businesses outsource things such as accounting, human resources, and information technology, you need to outsource security as well. Hire a reputable consultant who can come in and look at your business holistically and consider all aspects of the business so that any recommendation keeps its impact to your business’s operations and tempo to a minimum, but also helps increase your security posture. Our industry often forgets that our goal isn’t to make an organization unhackable, but to help increase their security posture in a way that allows them to focus on the business’s mission and vision.

       Why do you feel it is critical to stay within the rules of engagement?

      Elementary, my dear Watson. You must always remember the three Ls: liability, liability, liability. Staying within the rules of engagement comes down to liability. If a client has specific requests (don’t target C levels, don’t touch these IPs, don’t go to this floor in our building, etc.), it is important to abide by those requests, no matter how irritating they may be. The last place you and your team want to be is at the receiving end of a lawsuit for breach of contract.

       If you were ever busted on a penetration test or other engagement, how did you handle it?

      This is a tricky one for me to answer because many times the client requests that I intentionally test until I get caught. What I mean by this is during physical security assessments, for example, I slowly escalate my methods and noise to determine at what point an employee stops to question me. These metrics have given my clients a huge understanding of how and when their employees respond. Yes, I can go in and try to be undetected (which is the goal while red teaming); however, while performing a physical assessment, why not test as much as possible? If you don’t, you’re doing a disservice to your client. Then, when I’m caught, my clients also get to see how their incident response process handles it. Why wouldn’t you want to test every employee’s detection and capabilities in a controlled manner?

However, I do have a time I was caught while not trying to be. A few years ago, I was performing a physical security assessment for a client. During the kickoff call and follow-up communication, they were acting slightly odd and continuously decreasing the scope, including shortening the assessment from three days to one. I’ve learned that these are usually warning signs of trouble afoot.

      When I arrived on site, I was able to successfully gain access to one of their floors. I found their mailroom and proceeded to place a USB drive inside an employee’s mailbox. As soon as I was leaving the room, I was stopped by an employee who said, “Oh, I found you! We were told to be on the lookout all day for you and to turn you in right away.” After talking for a few minutes, I found out that the client had sent out an email to all employees saying that a female would be coming on site during the limited time window they gave me to test and to stop me immediately.

      This client wanted good results and didn’t want me to succeed. To achieve that, they rigged the test. However, this left me in an ethically hard spot. How was I supposed to write my report? I decided to be truthful and document in my report that the employee who stopped me explained that they were notified ahead of time and tasked with attempting to find me. To this day, that engagement was the most expensive game of corporate hide-and-seek I’ve ever played.

       What is the biggest ethical quandary you experienced while on an assigned objective?

      I had a client ask me to leave out findings from a phishing assessment. A C-level employee provided their network credentials to my malicious website, and they didn’t want that information to be in the final report. On one hand, it would be an extremely easy piece of data to omit from the final report; no one would even know it was missing. On the other hand, I knew deep down that it was wrong. I ended up explaining to the client that I could not remove any findings and proceeded to deliver an honest final report.

       How does the red team work together to get the job done?

      My absolute favorite part of red teaming is the team aspect. I love the camaraderie that is developed during the engagement. We work together under a team lead who builds out a strict plan to execute, where everyone knows their role and target. The documentation and reporting are really just a matter of good record keeping. There isn’t a team member specifically tasked with the job of the scribe. However, working with the blue team is always a learning experience. It’s interesting when we do our debriefs, and they show us what they were able to catch and not catch and dive into the technical portions of some attacks. Both teams learn a lot, and it is one of the most critical elements of the engagement.

      “My absolute favorite part of red teaming is the team aspect. I love the camaraderie that is developed during the engagement.”

       What is your approach to debriefing and supporting blue teams after an operation is completed?

      This is a question that we ask during kickoff calls with the client—to determine what they want. Some clients like to be very hands-on with daily calls, multiple after-engagement calls/demos with different departments, and so on, while other clients are just looking forward to the final report. It all comes down to delivering the value that the client needs from the engagement.

       If you were to switch to the blue team, what would be your first step to better defend against attacks?

      Don’t assume. One of the biggest benefits any new hire brings to an organization is a fresh set of eyes. However, you need to capitalize on this while they are still fresh. I would personally start at the beginning, going from policies and procedures to technologies and to roles and responsibilities. I would take stock of what was present in order to determine what was missing. Things are often put in place in the blue team to meet policy need but never touched or exercised. Additionally, over time complacency sets in and things move to the wayside that should still be actively monitored.

       What is some practical advice on writing a good report?

      I’ve written, reviewed, and read others’ reports,