Speaker 1: Hey everyone, and welcome to this deep dive where we're
Speaker 1: going to be taking a close look at red teaming.
Speaker 2: Yeah, red teaming.
Speaker 1: So you've you've probably heard the term before, but what
Speaker 1: does it really mean?
Speaker 2: Right?
Speaker 1: What does it mean in the in the context of
Speaker 1: professional cybersecurity?
Speaker 2: Yeah?
Speaker 1: So, and what we're going to do today is we're
Speaker 1: going to go way beyond kind of the how to
Speaker 1: hack and really get into some of the strategic thinking
Speaker 1: and challenges that these experts face.
Speaker 2: Yeah. And it's it's not just the how to, it's
Speaker 2: the why, right, the what, the strategic element of it.
Speaker 1: And we've had some really fascinating source material today that's
Speaker 1: going to help us kind of unpack all of this.
Speaker 2: Yeah, for sure.
Speaker 1: One of the things I thought was really interesting was
Speaker 1: that getting caught isn't always a failure.
Speaker 2: Oh, absolutely, the red team getting caught can be the
Speaker 2: point sometimes, right, And even if it's not the point, Yeah,
Speaker 2: Like if you're truly trying to be stealthy and you
Speaker 2: get caught, yeah, that's still a learning experience.
Speaker 1: Yes, what did we do wrong? What can we improve?
Speaker 1: How can we be more stealthy next time?
Speaker 2: Yeah? And there's this, you know, there's all this buzz
Speaker 2: around like AI and automation and cybersecurity. But our sources
Speaker 2: really make this this compelling argument for why human hackers
Speaker 2: are still essential totally. Like I was reading about this
Speaker 2: one scenario where this red teamer used basically a shortcut
Speaker 2: command this alias, and through a series of like I
Speaker 2: don't even know if it was mistakes on the organization's
Speaker 2: part or just like oversights, oversights, they ended up gaining
Speaker 2: access to their entire AWS cloud infrastructure.
Speaker 1: It can be really really simple oversights too, you know,
Speaker 1: like a lot of times, like.
Speaker 2: A little thread that you pull on and that unravels
Speaker 2: the whole thing.
Speaker 1: Exactly, yeah, exactly.
Speaker 2: And our sources also this was really interesting kind of
Speaker 2: challenging this idea of checkless security security.
Speaker 1: Like you know, you check all the boxes and you
Speaker 1: think you're good, but right, and.
Speaker 2: You're missing you're missing the point. You know, you're missing
Speaker 2: the bigger picture.
Speaker 1: So red teaming forces you to think outside the box.
Speaker 1: You got it, Okay, So let's break down what red
Speaker 1: teaming actually is. Okay, Like, how would you explain this
Speaker 1: to someone who maybe isn't a cybersecurity expert.
Speaker 2: So I like to think of penetration testing which everyone's
Speaker 2: heard of. Right. Penetration testing is kind of like we're
Speaker 2: going to check this bridge for structural weaknesses, okay. Red
Speaker 2: teaming is we're going to simulate a massive earthquake okay,
Speaker 2: and see if the whole thing falls down. Got it.
Speaker 2: So it's much broader.
Speaker 1: So pen testing is more focused like.
Speaker 2: Looking for specific vulnerability.
Speaker 1: Specific vulnerabilities, but red teaming.
Speaker 2: Is broader, bigger pictures like the.
Speaker 1: Whole, the whole, the whole, enchilada exactly.
Speaker 2: Yeah, it's how it's like, how would the organization prevent, detect,
Speaker 2: and respond to a real atta. You know. That's kind
Speaker 2: of the goal of red teaming.
Speaker 1: And the book Professional Red Teaming actually goes into different
Speaker 1: types of red teaming engagements.
Speaker 2: Yes, So there's we've got the holistic compromise, We've got
Speaker 2: specific compromise okay, and we've got assumed compromise.
Speaker 1: Okay. So holistic is like we're going to try and
Speaker 1: like fully compromise your system.
Speaker 2: Yeah, like take over everything.
Speaker 1: Okay.
Speaker 2: You know, I think like the bank robbery example, we're
Speaker 2: going to rob the whole bank. Specific is like maybe
Speaker 2: we just want to get access to customer data something
Speaker 2: very specific, got it? And then assumed compromise is interesting, Yeah,
Speaker 2: because you're starting from the point of you that the
Speaker 2: attackers are already inside, okay, you know, so you're not
Speaker 2: worried about how they got in. You're worried about what
Speaker 2: they can do once they're there.
Speaker 1: So you're starting like midway through the movies exactly, and
Speaker 1: you're and you're seeing what damage.
Speaker 2: They can do exact.
Speaker 1: I mean that's kind of a sobering thought, right.
Speaker 2: It is. Yeah, it is, and it's becoming more and
Speaker 2: more relevant, you know. I mean, it's kind of an
Speaker 2: evitability at this point. Yeah, some attacker is going to
Speaker 2: get in somewhere.
Speaker 1: It's not if it's when exactly.
Speaker 2: Yeah, So how do we respond?
Speaker 1: Okay, so we've established what red teaming is, we've talked
Speaker 1: about the different types of engagements, but let's get into
Speaker 1: like why humans are still so crucial for cybersecurity.
Speaker 2: So academics are looking at ways to automate red teaming,
Speaker 2: which is really interesting, and they've kind of broken it
Speaker 2: down into these three categories, non pivot, non exploit okay,
Speaker 2: non pivot, exploit, and exploit pivot Okay, So those are
Speaker 2: the three things.
Speaker 1: So they're trying to mimic the steps that a human
Speaker 1: hacker would take exactly, but they're falling short in a
Speaker 1: lot of key areas.
Speaker 2: They are.
Speaker 1: And it's interesting the book talks about these different scenarios
Speaker 1: where like human ingenuity was.
Speaker 2: Just and it's something you can't really program, you know,
Speaker 2: that intuition. You can't really automate that yet.
Speaker 1: So this one scenario I was reading about this where
Speaker 1: the Red Teamer found this alias. It was like a
Speaker 1: simple command alias, and it kind of dug a little
Speaker 1: deeper and it turned out that alias actually revealed the location.
Speaker 1: Oh wow, helped their AWS jump box. So this is
Speaker 1: like a server that they use to access their cloud
Speaker 1: infrastructure and for whatever reason, the way they have this
Speaker 1: set up, the Red Teamer was able to use that
Speaker 1: jump box to basically take over our entire AWS cloud infrastructure.
Speaker 2: That's a huge that's a huge oversight.
Speaker 1: Like I can't imagine automated tool figuring that out.
Speaker 2: No, because it's not it's not a technical vulnerability. It's
Speaker 2: a human error. It's an oversight, it's a misconfiguration.
Speaker 1: And this other one, I thought this was really interesting too.
Speaker 1: They found this splunk forwarder service listening.
Speaker 2: On a local port Oh interesting.
Speaker 1: Right, and this is something that again, like an automated scan,
Speaker 1: it probably wouldn't have picked up, right.
Speaker 2: It's not inherently a vulnerability, it's how it's configured and
Speaker 2: how it's used.
Speaker 1: Right, And they were able to use that to.
Speaker 2: Gain basically elevated privileges and then kind of pivot from.
Speaker 1: There take over the whole network.
Speaker 2: Yeah, take over the whole network exactly.
Speaker 1: So it really shows you that you can't just rely on.
Speaker 2: These automated tools. Yeah. Humans are still very much needed
Speaker 2: in this space.
Speaker 1: So it's more of a partnership I guess it is, Yeah,
Speaker 1: between humans and machines exactly.
Speaker 2: You use the machines to automate the boring stuff, right,
Speaker 2: and then you use humans to do the thinking.
Speaker 1: To do the creative problem solving exactly.
Speaker 2: Yeah.
Speaker 1: Okay, so let's let's talk about some of the challenges
Speaker 1: of red teaming, because it's not all like smooth sailing, right, absolutely.
Speaker 1: Like one of the biggest I think is just that
Speaker 1: inherent like adversarial totally nature.
Speaker 2: Of it, right, Like Red teamers are coming in, they're
Speaker 2: trying to break stuff.
Speaker 1: They're trying to break stuff.
Speaker 2: No, and that could rub people the wrong way. I
Speaker 2: bet Yeah, especially internal security teams. You know, like, hey,
Speaker 2: we're doing our job.
Speaker 1: Right, We're trying to protect this, Why are you trying.
Speaker 2: To break it? Yea, So there could be some friction.
Speaker 1: There, Yeah, I would see that.
Speaker 2: Yeah. So communication is super important absolutely, you know, having
Speaker 2: a good relationship right with.
Speaker 1: The blue team, making sure everybody's on the same page exactly.
Speaker 2: Yeah.
Speaker 1: Another challenge I was reading about this is how do
Speaker 1: you scope an engagement in right? Right, because there are
Speaker 1: all these like real world constraints.
Speaker 2: You got time constraints, you got budget constraints, right, you
Speaker 2: got risk tolerance, risk tolerance, you know, the organization might say,
Speaker 2: hey you can't do this, you can't touch that, so
Speaker 2: you be really careful yeah about how you scope the engagement.
Speaker 1: So there's a lot of like upfront.
Speaker 2: A lot of planning, planning, yeah, a lot of talking,
Speaker 2: you know, getting everyone on the same page. Yeah.
Speaker 1: And this kind of gets into the legal and ethical
Speaker 1: stuff too, right, yes, absolutely, Like there are certain things
Speaker 1: that you know, maybe you can't do, you know, if
Speaker 1: there's sensitive and like iPath. Yeah, yeah, you know, all
Speaker 1: these regulations you got to be aware.
Speaker 2: Of, and that's where those rules of engagement come in right, Yes, absolutely,
Speaker 2: So this is like a document that outlines very specifically.
Speaker 1: Yeah, it's a contract.
Speaker 2: What the Red team can and can't.
Speaker 1: Do, what you can do, what you can't do.
Speaker 2: They're allowed to access, they're allowed to touch what systems?
Speaker 1: Yeah, when you can do it, when they can do it.
Speaker 1: You know, it's very very specific and they have.
Speaker 2: To stick to that absolutely. Okay. So we've talked about
Speaker 2: some of the challenges. Yeah, and you know, the adversarial
Speaker 2: nature of red teaming.
Speaker 1: But our sources also talk about this thing called purple teaming.
Speaker 2: Yes, purple teaming.
Speaker 1: And this is where things start to get really interesting.
Speaker 2: So purple teaming is all about collaboration, okay. You know,
Speaker 2: it's about breaking down those silos between the Red team
Speaker 2: and the Blue team.
Speaker 1: So instead of being adversaries, yeah, they're like allies.
Speaker 2: They're working together, working together. You're sharing knowledge to.
Speaker 1: Achieve a common goal exactly, which is better security, better
Speaker 1: security for everyone. So how does that actually work in practice?
Speaker 2: So there's a bunch of different ways you can do
Speaker 2: purple teaming. Okay. One is reciprocal awareness. Okay, so both
Speaker 2: teams know what the other team is doing, okay, and
Speaker 2: they're kind of working together like in a sparring match. Okay,
Speaker 2: you know they're learning from each other, got it. Then
Speaker 2: you get the unwitting host. Okay, so the Blue team
Speaker 2: doesn't even know they're being tested. Okay, so this is
Speaker 2: a good way to see how they would respond to
Speaker 2: a real attack, right because they're not expecting it.
Speaker 1: Yeah, like a surprise fire drill exactly, yeah, exactly. And
Speaker 1: then you have the unwitting attacker.
Speaker 2: Yes, so the Red team doesn't know they're being watched. Okay,
Speaker 2: so the Blue team can kind of see, observe their
Speaker 2: tax observe their tactics. You see what they're doing, how
Speaker 2: they're doing it.
Speaker 1: Interesting.
Speaker 2: We've also got red handed testing okay, where the Red
Speaker 2: team intentionally gets caught, okay, to see how the Blue
Speaker 2: team responds. Oh interesting, like what's their incident response process?
Speaker 2: Testing their incident response exactly okay. And then finally you
Speaker 2: got catch and release.
Speaker 1: Catch and release.
Speaker 2: So the blue team catches the Red team, the Red
Speaker 2: team steps up their.
Speaker 1: Game, Okay, they try again, They try again.
Speaker 2: Blue team catches them again, okay, and so on and
Speaker 2: so forth.
Speaker 1: So it's like this iterative process exactly where they're both
Speaker 1: learning and improving.
Speaker 2: Both sides are getting better.
Speaker 1: Yeah, okay, Now, one last thing before we wrap up
Speaker 1: this part of the Deep Dive, I want to talk
Speaker 1: about this concept called cappy t teaming, dag teaming, yeah,
Speaker 1: counter apt red teaming.
Speaker 2: It's it's when the stakes are really high.
Speaker 1: Okay.
Speaker 2: You know we're talking about critical infrastructure like the Crown
Speaker 2: Jewels exactly. Yeah, the Crown Jewels, the things that if
Speaker 2: they got compromised, yeah, it would be a really really
Speaker 2: bad day.
Speaker 1: Okay. And so what are like the key principles of this.
Speaker 2: So the key principles are one, we assume breach. Okay,
Speaker 2: We're not worried about how the attackers got in, right,
Speaker 2: We're worried about what they can do once they're there. Okay.
Speaker 2: Two we focus on lead full compromise items okay, so
Speaker 2: those are the things that if they got compromised, yeah,
Speaker 2: it would be a really, really bad day.
Speaker 1: Okay.
Speaker 2: And three we use something called reverse pivot chaining, just
Speaker 2: basically using local intelligence gathering to figure out how the
Speaker 2: attackers got in and where they're going.
Speaker 1: So you're like working backwards exactly from the crime scene.
Speaker 2: From the crime scene trying to figure out what happens.
Speaker 1: So this is like a very specific and targeted approach.
Speaker 2: Very targeted, very high stakes.
Speaker 1: Okay, well, I think that's a great place.
Speaker 2: To pause for now, take a break.
Speaker 1: We've covered a lot of ground in this first part
Speaker 1: of our deep dive. We have Yeah, we've defined red teaming,
Speaker 1: talked about why humans are still so important, talked about
Speaker 1: the different challenges, different approaches, the different approaches, and introduce
Speaker 1: these concepts of purple teaming and cap ptr teaming.
Speaker 2: And in the next part, yes, we're going to get
Speaker 2: even deeper into the weeds.
Speaker 1: We're going to get into the nitty gritty, nitty gritty
Speaker 1: of how these engagements are actually conducted.
Speaker 2: The tools, the technique, the tools, the techniques, the trade craft.
Speaker 1: That's right craft. All right, So stay tuned.
Speaker 2: Stay with us, Welcome back to our deep dive on
Speaker 2: red teaming. Last time, we got a good overview of
Speaker 2: what red teaming is and why it's so important.
Speaker 1: Yeah, and why humans are still so crucial in this field.
Speaker 2: Yeah, absolutely So.
Speaker 1: Now I think it'd be really cool to kind of
Speaker 1: get into the weeds a little bit and really see
Speaker 1: how these engagements.
Speaker 2: Yeah, let's get into the nitty gritty, Yeah.
Speaker 1: Let's get into the nitty gritty.
Speaker 2: The nuts and bolts of it all, like.
Speaker 1: What actually happens when a red team?
Speaker 2: Yeah, how do they actually do this stuff?
Speaker 1: So once they've kind of got the scope and the
Speaker 1: rules of engagement set, like where do they start? What
Speaker 1: are the first steps?
Speaker 2: So the first thing you gotta do is reconnaissance. Okay,
Speaker 2: you've got to figure out what you're dealing with. Okay,
Speaker 2: you know who's the target? What are their systems? Yeah,
Speaker 2: what are their weaknesses? This involves things like open source
Speaker 2: intelligence gathering, vulnerability scanning, maybe even some social engineering to
Speaker 2: try to get some credentials.
Speaker 1: So you're building a profile.
Speaker 2: You're building a profile, yeah the target. You got to
Speaker 2: know your enemy.
Speaker 1: And professional red teaming actually talks about this. They call
Speaker 1: it the shaping phase, the shaping phase, right, and it's
Speaker 1: all about involving the right people totally in the process,
Speaker 1: Like not just the technical folks, but yeah.
Speaker 2: You need the technical people, need the operational people. You
Speaker 2: might even need legal legal Yeah, depending on what.
Speaker 1: You're doing, because you've got to make sure that like this,
Speaker 1: it's tailored.
Speaker 2: To the organization. Yeah, you know, it's not just a generic.
Speaker 1: Attack, right, it's not off the shelf.
Speaker 2: No, it's got to be very specific, tailored to their environment.
Speaker 2: There risks, risks.
Speaker 1: And their yeah, their business. Yeah, and this intelligence gathering.
Speaker 2: Phase can be Oh, it could be very creative.
Speaker 1: I was reading about some of the techniques like website scraping,
Speaker 1: social media analysis.
Speaker 2: Oh yeah, you can find a lot of information on social.
Speaker 1: Media, and even physical penetration testing.
Speaker 2: Oh yeah, physical pen testing is fun. What is that?
Speaker 2: So basically you're trying to get physical access to the target. Okay,
Speaker 2: so this might involve things like, yeah, trying to tailgate employees,
Speaker 2: you know, sneak in behind them. Yeah, or maybe trying
Speaker 2: to pick locks or you know, test their security cameras.
Speaker 1: So you're actually like on site.
Speaker 2: Yeah, you're on site. You're in the building, Okay, trying
Speaker 2: to see what you can get away with.
Speaker 1: So you're really you're really thinking outside the box.
Speaker 2: You got to think like an attacker.
Speaker 1: Okay. So once they've kind of done their homework, they've
Speaker 1: gathered all this.
Speaker 2: Intel, they've built their profile.
Speaker 1: What happens next?
Speaker 2: So then it's time to actually attack.
Speaker 1: Okay, this is where it gets real.
Speaker 2: Yeah, this is where the rubber meets the road.
Speaker 1: So this is where like all.
Speaker 2: The technical skills come in.
Speaker 1: Yeah, the technical skills.
Speaker 2: You know, exploiting vulnerabilities.
Speaker 1: By passing security control.
Speaker 2: Yeah, all that good stuff.
Speaker 1: And I know the book talks about all.
Speaker 2: Sorts of Oh yeah, there's a whole.
Speaker 1: Range different types of attacks.
Speaker 2: External attacks, internal attacks, wireless attacks, WI lists, social engineering.
Speaker 1: Social engineering. So it's not just like hacking into a computer.
Speaker 2: No, it's much broader than that. Yes, it's about exploiting any.
Speaker 1: Weakness, any weakness you can.
Speaker 2: Find, any weakness, whether it's a technical weakness, yeah, a
Speaker 2: human weakness, a process weakness, whatever.
Speaker 1: So let's say the Red team they managed to get
Speaker 1: access to a system.
Speaker 2: Okay, what happens then, So then it's all about maintaining persistence.
Speaker 1: Okay.
Speaker 2: You know, you don't want to just get in and
Speaker 2: then get.
Speaker 1: Kicked out, right, You want to stay in. You want
Speaker 1: to stay in, establish a foothold.
Speaker 2: Establish a foothold exactly.
Speaker 1: Okay.
Speaker 2: So this might involve things like installing back doors, creating
Speaker 2: rogue user accounts, hijacking legitimate processes.
Speaker 1: So you're basically blending in, blending in with the normal
Speaker 1: network activity. You want to be a ghost, okay, And
Speaker 1: this is where operational security.
Speaker 2: Oh PSC super important.
Speaker 1: Oh PSCC, yeah, that's what they call it.
Speaker 2: Yeah, you got to be very careful.
Speaker 1: You've got to cover your tracks.
Speaker 2: Cover your tracks, don't leave any traces.
Speaker 1: Because if you make one mistake.
Speaker 2: Yeah, one mistake and you're busted.
Speaker 1: Game over.
Speaker 2: Yeah.
Speaker 1: And so now I gotta ask ye, like, where does
Speaker 1: the Blue team fit into all of this?
Speaker 2: So the Blue team is the defenders? Okay, their job
Speaker 2: is to try to stop the Red team.
Speaker 1: Okay, so it's like this, it's.
Speaker 2: A cat and mouse game.
Speaker 1: Cat and mouse game, yeah, back and forth. Okay.
Speaker 2: Red team tries to attack, Blue team tries to defend.
Speaker 1: But it's a collaborative effort.
Speaker 2: It's a collaborative effort. Yeah. Ultimately, even though it's adversarial,
Speaker 2: the goal is to improve security.
Speaker 1: So they're both working towards the same goal.
Speaker 2: Yeah, they're on the same team, ok just different sides
Speaker 2: of the coin.
Speaker 1: And one thing the sources emphasize a lot was documentation.
Speaker 2: Oh yeah, documentation is super important.
Speaker 1: Why is that?
Speaker 2: So you got to document everything you do, every vulnerability
Speaker 2: you find, every exploit you use, because that's how you learn. Okay,
Speaker 2: you know, you got to be able to go back
Speaker 2: and see what worked, Okay, what didn't work, how you
Speaker 2: can improve.
Speaker 1: It's like a record, it's a record of the engagement
Speaker 1: of everything that happens. Okay. Now let's get into some
Speaker 1: of the tools of the trade.
Speaker 2: The tools.
Speaker 1: What are so? Red teamers use a variety of tools,
Speaker 1: both open source and commercial. Okay, So some of the
Speaker 1: common categories are network scanners, vulnerability scanners, exploitation frameworks, password
Speaker 1: cracking tools, got it, and social engineering tool pits.
Speaker 2: So give me some examples.
Speaker 1: So for network scanners, you've got things like end map,
Speaker 1: which allows you to map out the target network. Okay,
Speaker 1: see what systems are there?
Speaker 2: Got it?
Speaker 1: For vulnerability scanners, yeah, you got nessus qualities Okay, those
Speaker 1: are popular ones in the basics scan for known vulnerabilities
Speaker 1: and software and systems.
Speaker 2: What about those exploitation frameworks.
Speaker 1: Yeah, so those are things like metasploit, which is a
Speaker 1: collection of pre built exploits okay, that you can use
Speaker 1: to attack systems.
Speaker 2: So it's not all manual hacking.
Speaker 1: No, you can automate a lot of this stuff.
Speaker 2: Okay, freeze up your time to focus on the more
Speaker 2: interesting things.
Speaker 1: More strategic stuff exactly.
Speaker 2: Okay.
Speaker 1: And then password cracking, password cracking, Yeah, what kind of tools.
Speaker 2: So you got tools like hashcat, John the Ripper. These
Speaker 2: are brute force tools they can try to guess passwords.
Speaker 2: And then social engineering toolkits.
Speaker 1: Yeah, what are those like?
Speaker 2: So those are things that can help you craft phishing emails,
Speaker 2: spoof websites, impersonate people.
Speaker 1: You're basically trying to trick people, trick people into giving
Speaker 1: you information exactly. Yeah, okay, so we've talked about the tools. Yeah,
Speaker 1: let's move on to the reporting phase.
Speaker 2: Reporting.
Speaker 1: Yeah, on the So once the attack is done.
Speaker 2: Simulated attack is done, the red team's got to, like
Speaker 2: you got to write a report, Yeah, write a report.
Speaker 1: You've got to summarize your findings, make recommendations, okay, and
Speaker 1: basically help the organization improve their security.
Speaker 2: So it's not just about like, no, it's not just
Speaker 2: about pointing fingers.
Speaker 1: Yeah, finding vulnerabilities and saying you suck, you suck.
Speaker 2: No, it's about helping them get better.
Speaker 1: It's about providing value. Providing value exactly, and professional red
Speaker 1: teaming talks about this concept of like an out briefing session,
Speaker 1: the out brief where they actually sit down with the organization.
Speaker 2: Yeah, you sit down with the stakeholders.
Speaker 1: And they walk them through the finding, You walk them
Speaker 1: through the reportation.
Speaker 2: Answer any questions they have.
Speaker 1: So it's like this face to face.
Speaker 2: Yeah, face to face interaction is important.
Speaker 1: Yeah, to make sure that everybody's on the same page,
Speaker 1: on the same.
Speaker 2: Page, and that they understand the importance of the findings.
Speaker 1: Okay, And one last thing I wanted to touch on
Speaker 1: before we wrap up this part, Okay, is this concept
Speaker 1: of threat hunting.
Speaker 2: It's read hunting.
Speaker 1: Yeah, I've I've heard that term.
Speaker 2: It's a hot topic these days.
Speaker 1: But I'm not really sure what it means.
Speaker 2: So threat hunting is basically proactively looking for threats in
Speaker 2: your environment. So it's not just about waiting for alerts
Speaker 2: to go on, right, It's about actively searching for evidence
Speaker 2: of malicious activity.
Speaker 1: So you're like a detective.
Speaker 2: You're a detective, Yeah, looking for clues, looking for clues,
Speaker 2: looking for patterns that might indicate that something bad is happening.
Speaker 1: So it's it's a very proactive approach to.
Speaker 2: Security, okay, rather than reactive.
Speaker 1: And this is super important, especially these days with attackers
Speaker 1: getting more sophisticated.
Speaker 2: Yeah, attackers are getting really good at hiding their tracks, right,
Speaker 2: So you've got to be proactive to find them.
Speaker 1: But is this is this a replacement for red teaming.
Speaker 2: No, No, it's not a replacement. It's a compliment. It's
Speaker 2: another tool in your toolbox.
Speaker 1: So it's about having like this layer layered defense.
Speaker 2: So you're doing proactive stuff like threat hunting. Yeah, you're
Speaker 2: doing reactive stuff like incident response, right, and then you're
Speaker 2: also doing red teaming to kind of test everything. Yeah,
Speaker 2: make sure it all works.
Speaker 1: Okay, So we've covered a lot of ground in this part.
Speaker 2: We have.
Speaker 1: Yeah, we've talked about this step by step process of
Speaker 1: a red team engagement from reconnaissance to reports, from reconnaissance
Speaker 1: to reporting. Talked about the tools.
Speaker 2: And technique, the importance of documentation.
Speaker 1: The importance of documentation, and threat hunting threat hunting. Yeah,
Speaker 1: And in the final part of our deep dive. Yeah,
Speaker 1: in the next part, we're going to talk about the
Speaker 1: ethical considerations.
Speaker 2: Yeah, the ethical landscape, the red teaming, the future of
Speaker 2: red teaming.
Speaker 1: The future of red teaming, what it all means for
Speaker 1: you the stay tuned. All right, welcome back to the
Speaker 1: final part of our red teaming deep dive. We've talked
Speaker 1: about the strategies, the tools, why human hackers are still
Speaker 1: so important and all this great stuff. But one thing
Speaker 1: that's been kind of on my mind, Yeah, throughout this
Speaker 1: whole discussion is the ethics of it all, right, because
Speaker 1: we're talking about intentionally breaking into systems, exploiting vulnerabilities. I
Speaker 1: mean that seems like it could have real world consequences.
Speaker 2: Yeah, absolutely, things go wrong. So ethical Red teamers, yeah
Speaker 2: take this very seriously, okay, And there are a lot
Speaker 2: of safeguards in place to make sure these engagements are
Speaker 2: conducted responsibly.
Speaker 1: Yeah. The sources we've looking at really emphasize those rules
Speaker 1: of engagement.
Speaker 2: Oh yeah, super important.
Speaker 1: Can you talk a little bit more about what those
Speaker 1: are and why they matter so much?
Speaker 2: Yeah, So, rules of engagement are basically like a contract
Speaker 2: between the Red Team and the organization that outlines what
Speaker 2: the Red Team is allowed to do, what they're not
Speaker 2: allowed to do, what systems they can touch, what data
Speaker 2: they can access, and when they can do it.
Speaker 1: So it's very specific, very specific, okay, And the goal
Speaker 1: is to i mean, obviously to prevent the Red Team
Speaker 1: from doing anything illegal or unethical, but it's also.
Speaker 2: About protecting the organization.
Speaker 1: Yeah, protecting the organization. Like I was reading about Red
Speaker 1: teamers having to consider data privacy regulation.
Speaker 2: Oh yeah, k ipa GDPR.
Speaker 1: You don't want to accidentally cause a data breach exactly
Speaker 1: while you're trying to improve security, right, that would be bad.
Speaker 1: So it's not just about like being a skilled hacker.
Speaker 1: You got to have like that ethical mindset as well.
Speaker 2: You got to understand the risks, yeah, and the consequence.
Speaker 1: Okay, So we've we've talked a lot about communication and
Speaker 1: collaboration and especially that relationship between the Red team and
Speaker 1: the Blue team. Why is that so important for this
Speaker 1: to actually work, Because.
Speaker 2: Like we talked about before, red teaming can be adversarial.
Speaker 1: Yeah. Right, it's like you're coming in and saying, hey,
Speaker 1: your security sucks.
Speaker 2: I found all these holes.
Speaker 1: Yeah, you know, you're not doing a good job.
Speaker 2: And nobody likes to hear that.
Speaker 1: Yea. So it's really important to to build that trust,
Speaker 1: build trust, establish good communications.
Speaker 2: Yeah, make sure everybody's on the same page.
Speaker 1: And I know, you know we talked about this before,
Speaker 1: but involving like both the technical folks and the operational folks, operational, legal, legal, everybody,
Speaker 1: Like in those early stages from the beginning, to make
Speaker 1: sure everybody understands.
Speaker 2: Yeah, what are we trying to achieve here?
Speaker 1: What are trying to achieve?
Speaker 2: What are the goals? What are the risks?
Speaker 1: Right?
Speaker 2: How are we going to do this safely and responsibly,
Speaker 2: So it's not like a surprise, No surprises. Everybody knows
Speaker 2: what's going on.
Speaker 1: And then throughout the engagement, like keep those lines of
Speaker 1: communication open.
Speaker 2: Keep the communication flowing.
Speaker 1: Yeah, like provide updates, let.
Speaker 2: Them know, Hey, we found this vulnerability. Yeah, what you're finding.
Speaker 2: We're exploiting this.
Speaker 1: This is what we're seeing, so that everybody can.
Speaker 2: Learn and adapt, learn and adapt in real time.
Speaker 1: Okay, Now let's talk about the future of red teaming. Okay,
Speaker 1: because this field is constantly evolved, constant it's never boring.
Speaker 2: Yeah, no, it's not like I'm curious. How do you
Speaker 2: see red teaming adapting to all these new threats?
Speaker 1: The threat landscape is changing so rapidly all the time. Yeah,
Speaker 1: you know, we're dealing with like nation state actors, organized.
Speaker 2: Crimes, sophisticated attackers.
Speaker 1: Yeah, how do you It's a challenge, how do you
Speaker 1: keep up?
Speaker 2: So one of the big things is AI. Attackers are
Speaker 2: using AI to enhance their capabilities.
Speaker 1: So they're using AI to to attack.
Speaker 2: Yeah, okay, so we got to use AI to defend.
Speaker 2: So red teamers are starting to incorporate AI and machine
Speaker 2: learning into their tools and techniques.
Speaker 1: So it's like this AI arms race it is, yeah, okay.
Speaker 1: And we talked about KPTR teaming, which is specifically designed.
Speaker 2: To address high impact scenarios.
Speaker 1: Yeah, those really high stakes tax when the stakes are high,
Speaker 1: and purple teaming as well. That collaborative collaboration is key approach.
Speaker 2: Yeah, you got to work together.
Speaker 1: So it's it's not enough to just.
Speaker 2: Like rely on old methods, Yeah, rely on.
Speaker 1: Like the traditional security approaches.
Speaker 2: You got to be proactive. Yeah, you got to be adaptive.
Speaker 1: Okay. So red teaming is not just like a it's.
Speaker 2: Not a one time thing, one thing. It's an ongoing process.
Speaker 1: Yeah okay. So we're we're at the end of our
Speaker 1: deep dive here. If there's like one thing our listeners
Speaker 1: should take away from this, what would it be.
Speaker 2: Cybersecurity is everyone's responsibility.
Speaker 1: Okay.
Speaker 2: It's not just the IT department's problem.
Speaker 1: It's not just the security team.
Speaker 2: It's everybody's product.
Speaker 1: It's everybody's problem.
Speaker 2: We all have a role to play in protecting our data.
Speaker 1: In our systems, and it's not a set it and
Speaker 1: forget it thing.
Speaker 2: No, security is a journey, not a destination.
Speaker 1: It's a journey and not a destiny.
Speaker 2: It's an ongoing process.
Speaker 1: Yeah, okay, So what's the most important thing for people
Speaker 1: to remember about red teaming.
Speaker 2: Red teaming is about making organizations more secure. It's not
Speaker 2: about finding faults or embarrassing people. It's about helping them
Speaker 2: understand their risks and improve their defenses.
Speaker 1: So it's ultimately a force for good, a force for good, absolutely, Okay.
Speaker 1: Any final thoughts for our listeners.
Speaker 2: Yeah, stay curious, stay informed, and don't be afraid to
Speaker 2: ask questions. The more you know about cybersecurity. Yeah, the
Speaker 2: better prepared you'll be.
Speaker 1: All right. Well, that wraps up our red teaming deep dive.
Speaker 2: It does.
Speaker 1: We hope you found it informative and insightful.
Speaker 2: We hope you learned something and until next time, stay secure.