A wise means I’ve seen CISOs construction their crimson groups the place they should assess preliminary entry vectors is to cede entry to a system so {that a} portion of the group can start the trail discovering portion of the engagement whereas one other contingent can carry out the preliminary entry element, rejoining the group when/in the event that they full that stage. I’ve seen extra mature organizations break these engagements out into totally separate initiatives, typically chaining them collectively to inform a narrative. Considered one of my favourite examples of this was a monetary group that ran two preliminary entry initiatives — phishing and exterior assault floor exploitation — concurrently for eight weeks. The outcomes from these engagements, which included the customers who detonated the phishing payload and the exterior programs on which the group had gotten code execution, grew to become the beachheads onto which entry for the crimson group was ceded.
Maintain egos out
The debrief at completion of a crimson group engagement can typically be very tense. The crimson group has seemingly revealed critical failures alongside their assault path and you’ve got all accountable events sitting round a desk, or on a name listening to about them, typically for the primary time. Why didn’t your SOC detect their lateral motion? Why did your identification group flip MFA off in your enterprise admins? Why did your security engineering group fail to deploy your EDR onto all hosts within the surroundings? It turns into all too straightforward to start pointing fingers and assigning blame, leaving everybody upset, flustered, and embarrassed.
Keep in mind, nonetheless, {that a} pleasant group simply discovered critical flaws earlier than an adversary did and also you get the chance to repair it. Deal with creating an surroundings of honesty, humility and empathy. This isn’t to say that individuals gained’t nonetheless really feel adverse feelings, however the tone of the dialog from the outset will considerably enhance the standard of the dialogue.
