Author: Theos

Penetration Testing vs Red Teaming

Given the rise of Cybercrime and advancement of tools and techniques in cybersecurity, Organizations must work to continuously test and improve their security programs. There are different security assessments that an organization can employ for this. However, with the limitations on budget and resources, it is essential to understand and choose the one that best suites the organization’s needs.  

In the forefront of security testing methods are Penetration Testing and Red Teaming. Both these methods simulate an attack from an adversary, using real world strategies and techniques to discover vulnerabilities in the organization. However, there are key differences between each method and it best to understand their differences and know when one is most appropriate to use over the other: 

Goals

Penetration tests have different goals than Red Team engagements. 

The goal of a Pentest is to find as many vulnerabilities as possible and exploit them through any means possible. Its goal is to find as many ways to compromise the target and assess the risk to the business.  

However, Red teams do not try to compile a long list of all your company’s vulnerabilities. A Red Team’s goal is to find a way, even just one way, into your organization and (depending on agreement) access whatever critical data or asset there is to access without getting caught.  

A Penetration test helps the organization discover holes in their systems that an attacker can use. A Red Team exercise helps the organization find gaps in their process, people and technology and test how effectively they can respond to a successful attack. 

Scope

Penetration tests have limited scope while a Red Team, essentially, doesn’t have these limitations. 

Penetration tests are usually limited to a specific application, server, environment or to a specific network or range, etc. Limitations may also include testing hours or testing durations. 

However, for a Red Team engagement, other than some minor business critical systems (or people), there are generally no limitations to the application or network you can leverage. You are open to compromise a UAT or production server. And you can send your attacks during and off work hours. 

Attack Vectors

There are different types of Penetration tests such as Internal, External Network, Application, Wireless, Social Engineering, etc. In each of these, the testers are limited to attacks for that specific context or type of test. For instance, for an application pentest, a test is usually only limited to using web related attack vectors. 

However, for a Red Team exercise, its Free-For-All, anything goes. Red Teams usually have complete freedom to use whatever attack or technique they can use to get in. Red Teamers can send in USB sticks, send phishing emails, or physically break into your office to get the necessary access. 

The only exception for Red Teams would be attack vectors that you have agreed to deny or exclude from the engagement. Red teams may be designed based on a scenario and thus Tactics, Tools and Techniques may be agreed upon to be limited for that scenario. 

Time

There is a major difference in the duration of a Penetration test vs a Red Team exercise. 

Penetration tests are usually done between 1-3 weeks depending on the scope and type of test.  

However, a Red team can run between 4-8 weeks, sometimes even longer depending on the size of the company and the scenario agreed upon. 

Cost

And lastly is the significant Cost difference between a Pentest and Red Team. 

Because Red Teams requires more time, more effort and expertise, it is understandably more expensive than a regular penetration test.  

Overall, Penetration testing and Red Teaming are essential parts of an organization’s security program. Both of them have different goals and bring different value to an organization. However, one is never better than the other; both of them are equally important to improve an organization’s security. They just need to be aligned with the organizations needs and current level of maturity. 

What is Penetration Testing? 

Penetration testing, also known as Pentest or Ethical Hacking, is an authorized security exercise designed to find and exploit vulnerabilities on a system, network or application. It is a simulated attack performed by cyber-security experts, mimicking real world strategies and techniques, aimed to identify weaknesses on the system and evaluate how an attacker can take advantage of them. 

Vulnerability Assessment VS Penetration Testing

While a Vulnerability Assessment also tries to identify vulnerabilities or weaknesses in a system (usually using an automated scanner), Penetration testing goes beyond that and tries to also exploit these vulnerabilities manually. A pentest not only reports these vulnerabilities but also demonstrates how these can be used, leveraged or even chained to compromise the target system. Escalation will also be attempted to demonstrate how deep an attacker can access due to the compromise and therefore better evaluate the overall exposure and security posture of the organization. 

Penetration Testing Approaches

Penetration testing can be conducted in one of three ways: Black, White or Grey box testing. 

The Black Box testing approach is done from the perspective of an outsider or external adversary with limited knowledge or information of the target system. This approach can be seen as the most authentic, demonstrating how an attacker with no inside knowledge would target and compromise the system. While this approach most closely mimics real world attackers, the process of discovering vulnerabilities takes significantly longer than other testing approaches due to the lack of internal knowledge. As a result, time spent by tester is not fully maximized and some components may not get tested. 

The White Box testing approach is done with full knowledge of the target. This knowledge includes technical and functional specifications, architecture/network diagrams, access matrix, source codes and other relevant information. This approach allows for the tester to discover all attack vectors possible and perform a more comprehensive analysis on the system. However, this approach requires much more effort to conduct and may even require more sophisticated tools. 

The Gray Box testing approach is a bit of a combination or a compromise of Black Box and White Box. In this approach the tester has some knowledge of and some level of access on the target system. This eliminates much of the time spent doing reconnaissance and allows for more time to do security testing.  

Penetration Testing Process 

In general, a penetration test can be structured in 6 phases and that is: 

1. Planning 
2. Reconnaissance 
3. Vulnerability Analysis 
4. Exploitation 
5. Post-Exploitation 
6. Reporting 

In the Planning phase, the details of the pentest exercise are discussed and agreed upon. These includes agreement on the Scope and limitations on the test, the testing approach as well as timelines and rules of engagement. Logistical requirements are also detailed on this phase such as test accounts, VPN access, IP whitelisting, etc. The goal of this phase is to ensure the exercise runs smoothly and that the objectives of the exercise are fully achieved. 

In the Reconnaissance phase, the tester gathers as much information about the target as possible and mapping out the full attack surface of the target. This is done through a combination of passive and active methods.  

Passive methods do not involve direct interaction with the target. This includes gathering of information from Open-Source Intelligence sources (ie DNS records, google search, etc). While Active Methods involves direct interaction with the target to get relevant information. This includes port scanning, application mapping/spidering, internal DNS queries, etc. 

All the information gathered is then analyzed and use to draw attack vectors that can be used in the next phases. 

In the Vulnerability Analysis phase, tester uses different techniques to discover flaws in the target system or infrastructure. Discovery can be done through manual testing or automated means (using a vulnerability scanner). These flaws are then evaluated to determine accuracy and potential exploitability based on the scope and the objectives of the engagement. 

In the Exploitation phase, vulnerabilities that have been evaluated are then exploited to attempt to validate its potential risk. The aim of the exploitation is to establish some level of access on the system for post-exploitation and demonstrate the compromise. Demonstration can be done through a Proof-of-Concept or through an actual compromise on the system. 

The Post-Exploitation phase covers activities that can be done after a successful exploitation on the target. This includes privilege escalations, later movements, data exfiltration and others. The aim of this phase is to determine the extent of the compromise that can be done, and its value based on the sensitivity of data, purpose of the asset, effect to overall operations, etc. 

Lastly, the Reporting phase involves documentation and presentation of results of the pentest engagement. The report will detail the scope and objectives of the pentest, the vulnerabilities found, the risk they bring to the organization and recommendations that the organization can take to fix these vulnerabilities and mitigate the risks.  

The Report is the arguably the most important part of the engagement. This should be communicated in a way that it can be easily understood and be acted upon by the stakeholders both executive and technical.