WEBVTT

1
00:00:00.040 --> 00:00:03.200
<v Speaker 1>Welcome back everyone to the deep Dive. This time we're

2
00:00:03.240 --> 00:00:07.200
<v Speaker 1>taking a close look at Johann Raeberger's book Cybersecurity Attacks,

3
00:00:07.280 --> 00:00:08.960
<v Speaker 1>Red Team Strategies, a.

4
00:00:08.960 --> 00:00:11.240
<v Speaker 2>Really practical guide for anyone who wants to know about

5
00:00:11.279 --> 00:00:15.119
<v Speaker 2>penetration testing and you know, really building a strong security program.

6
00:00:15.160 --> 00:00:17.519
<v Speaker 1>Definitely. It kind of feels like a masterclass in proactive

7
00:00:17.559 --> 00:00:21.120
<v Speaker 1>security almost. Yeah, definitely, showing us how to think like

8
00:00:21.199 --> 00:00:24.000
<v Speaker 1>the attackers would, so we can build, you know, a

9
00:00:24.039 --> 00:00:25.920
<v Speaker 1>really strong security program exactly.

10
00:00:25.960 --> 00:00:28.399
<v Speaker 2>And it's all about being prepared and like you said,

11
00:00:28.519 --> 00:00:32.520
<v Speaker 2>thinking like an attacker, finding those vulnerabilities, but before the bad.

12
00:00:32.320 --> 00:00:35.159
<v Speaker 1>Guys do before the bad guys exactly. And it's packed

13
00:00:35.159 --> 00:00:38.719
<v Speaker 1>with so many like real world examples and practical advice.

14
00:00:38.840 --> 00:00:39.799
<v Speaker 1>It's not just theory.

15
00:00:40.000 --> 00:00:42.000
<v Speaker 2>Yeah, yeah, absolutely, So let's start.

16
00:00:41.880 --> 00:00:44.399
<v Speaker 1>The very beginning. Sure, what is red teaming? What's the

17
00:00:44.439 --> 00:00:46.799
<v Speaker 1>core idea behind this in cybersecurity?

18
00:00:46.960 --> 00:00:47.320
<v Speaker 2>Okay?

19
00:00:47.399 --> 00:00:49.439
<v Speaker 1>So, and how would you explain it?

20
00:00:49.600 --> 00:00:51.159
<v Speaker 2>I think the easiest way to think about it is,

21
00:00:51.799 --> 00:00:56.359
<v Speaker 2>you're basically assembling a team of ethical hackers, okay, whose

22
00:00:56.520 --> 00:01:00.719
<v Speaker 2>entire mission is to mimic real world attacks, but from

23
00:01:00.759 --> 00:01:03.679
<v Speaker 2>the good side. So they're probing your defenses, your tech,

24
00:01:04.120 --> 00:01:07.560
<v Speaker 2>your processes, even like physical security sometimes like a real

25
00:01:07.560 --> 00:01:08.640
<v Speaker 2>attacker would Wow.

26
00:01:08.719 --> 00:01:10.519
<v Speaker 1>So it's really like taking that stressed us to the

27
00:01:10.560 --> 00:01:12.560
<v Speaker 1>next level for your entire security setup.

28
00:01:13.120 --> 00:01:14.400
<v Speaker 2>Yeah, that's a great way to put it.

29
00:01:14.439 --> 00:01:17.079
<v Speaker 1>Okay, So that kind of begs the question, then, how

30
00:01:17.159 --> 00:01:19.920
<v Speaker 1>is this different from something like penetration testing, which we've

31
00:01:19.920 --> 00:01:20.439
<v Speaker 1>all heard of?

32
00:01:20.680 --> 00:01:23.599
<v Speaker 2>Right? So, pin testing is generally more focused. You know,

33
00:01:23.640 --> 00:01:27.159
<v Speaker 2>you're zeroing in on a specific system, a specific app

34
00:01:27.519 --> 00:01:30.959
<v Speaker 2>to find as weaknesses. Red teaming is more I guess

35
00:01:31.000 --> 00:01:34.599
<v Speaker 2>you could say holistic. It's examining how your entire organization

36
00:01:34.760 --> 00:01:37.439
<v Speaker 2>responds to a more full blown attack.

37
00:01:37.599 --> 00:01:39.840
<v Speaker 1>Oh so it's really looking at it from the perspective

38
00:01:39.920 --> 00:01:42.760
<v Speaker 1>of not just are there bugs in the software, but

39
00:01:42.879 --> 00:01:46.400
<v Speaker 1>how would a human being actually try to get in

40
00:01:46.439 --> 00:01:48.599
<v Speaker 1>and exploit those? And then what would happen next.

41
00:01:48.680 --> 00:01:51.120
<v Speaker 2>Yeah, it's not just about finding like a software bug,

42
00:01:51.159 --> 00:01:55.040
<v Speaker 2>it's about how your company reacts when you know things

43
00:01:55.079 --> 00:01:55.599
<v Speaker 2>go south.

44
00:01:55.799 --> 00:01:58.560
<v Speaker 1>It's about their reflexes exactly to security breaches.

45
00:01:58.840 --> 00:02:01.400
<v Speaker 2>Yeah, and to really test those reflexes, you need a

46
00:02:01.439 --> 00:02:02.640
<v Speaker 2>dedicated red team, right.

47
00:02:02.879 --> 00:02:05.519
<v Speaker 1>Okay, But before you even think about who's on the team,

48
00:02:05.959 --> 00:02:08.159
<v Speaker 1>you need to convince the people up top totally.

49
00:02:08.560 --> 00:02:11.280
<v Speaker 2>Yeah, leadership in is absolutely.

50
00:02:11.039 --> 00:02:13.280
<v Speaker 1>Critical, Like how do you even begin to get them

51
00:02:13.319 --> 00:02:13.840
<v Speaker 1>on board?

52
00:02:14.039 --> 00:02:16.759
<v Speaker 2>Data? Data is your best friend here? Oh good, show

53
00:02:16.800 --> 00:02:19.080
<v Speaker 2>them those scary data breach numbers, like how much they cost?

54
00:02:19.159 --> 00:02:20.680
<v Speaker 1>Oh, make it real for them.

55
00:02:20.639 --> 00:02:23.759
<v Speaker 2>Yeah, how much it can impact the bottom line, because

56
00:02:23.840 --> 00:02:24.759
<v Speaker 2>that's what they care about.

57
00:02:24.879 --> 00:02:27.159
<v Speaker 1>They need to see those dollar signs. Yeah, exactly, and

58
00:02:27.159 --> 00:02:28.840
<v Speaker 1>be afraid of what's going to happen if they don't

59
00:02:28.879 --> 00:02:29.840
<v Speaker 1>invest in security.

60
00:02:30.039 --> 00:02:32.319
<v Speaker 2>Right. And then once they've signed off, you need to

61
00:02:32.319 --> 00:02:33.960
<v Speaker 2>figure out where the Red team fits.

62
00:02:34.120 --> 00:02:35.240
<v Speaker 1>Okay, where should it fit?

63
00:02:35.919 --> 00:02:40.919
<v Speaker 2>Ideally a good degree of independence, Okay, reporting directly to

64
00:02:41.000 --> 00:02:44.479
<v Speaker 2>like the Blue team, the defenders can actually cause some problems.

65
00:02:44.599 --> 00:02:47.840
<v Speaker 2>Oh okay, what because remember the Red team is supposed

66
00:02:47.840 --> 00:02:51.520
<v Speaker 2>to be the devil's advocate, you know, right, the weaknesses

67
00:02:51.919 --> 00:02:53.560
<v Speaker 2>even if it makes people uncomfortable.

68
00:02:53.719 --> 00:02:56.439
<v Speaker 1>So they need to be able to operate independently without

69
00:02:56.479 --> 00:02:58.840
<v Speaker 1>any pressure from the people they might be embarrassing.

70
00:02:58.960 --> 00:02:59.639
<v Speaker 2>Exactly, you got.

71
00:02:59.759 --> 00:03:02.039
<v Speaker 1>Okay, So let's talk about the team itself. Yeah, I

72
00:03:02.039 --> 00:03:04.759
<v Speaker 1>mean these are skilled, ethical hackers that we're talking about.

73
00:03:04.800 --> 00:03:07.960
<v Speaker 1>Oh yeah, yeah, So how do you even find these people?

74
00:03:08.120 --> 00:03:12.039
<v Speaker 2>That's the million dollar question, right, attracting and keeping great talent.

75
00:03:12.639 --> 00:03:14.919
<v Speaker 2>It's not just about offering a lot of money, although

76
00:03:14.919 --> 00:03:18.199
<v Speaker 2>that helps, but you really need to build an environment

77
00:03:18.240 --> 00:03:21.520
<v Speaker 2>that speaks to their passion, you know, the thrill of this.

78
00:03:21.800 --> 00:03:23.199
<v Speaker 1>Okay, well what would that look like?

79
00:03:23.520 --> 00:03:27.240
<v Speaker 2>So things like development opportunities, you know, go into conferences

80
00:03:27.680 --> 00:03:29.560
<v Speaker 2>and just like a culture of sharing knowledge.

81
00:03:29.719 --> 00:03:32.240
<v Speaker 1>Right, So building this team is more about understanding what

82
00:03:32.319 --> 00:03:35.879
<v Speaker 1>motivates them and what gets them excited about cybersecurity than

83
00:03:36.000 --> 00:03:37.360
<v Speaker 1>just finding someone who can hack.

84
00:03:38.000 --> 00:03:40.240
<v Speaker 2>Exactly. You need that mindset, that passion.

85
00:03:40.919 --> 00:03:43.560
<v Speaker 1>Now, I'm guessing not every hacker out there's going to

86
00:03:43.560 --> 00:03:47.199
<v Speaker 1>be ethical, So how do you filter for that?

87
00:03:47.199 --> 00:03:50.800
<v Speaker 2>That's where you use scenarios in the interview process. Okay,

88
00:03:50.919 --> 00:03:53.080
<v Speaker 2>you know, I like to throw out a hypothetical. Ok

89
00:03:53.280 --> 00:03:56.280
<v Speaker 2>let's say you got to compromise this HR system to

90
00:03:56.360 --> 00:03:59.199
<v Speaker 2>see if someone can pull out data. Would you download

91
00:03:59.240 --> 00:04:04.560
<v Speaker 2>your own file, would you access other employee records, or

92
00:04:05.039 --> 00:04:07.479
<v Speaker 2>you know, would you propose using dummy data?

93
00:04:07.560 --> 00:04:09.840
<v Speaker 1>So it's like an ethical puzzle exactly.

94
00:04:10.080 --> 00:04:12.680
<v Speaker 2>Yeah, and how they answer tells you a lot about

95
00:04:12.680 --> 00:04:16.839
<v Speaker 2>their boundaries and how they handle that kind of sensitive information.

96
00:04:17.120 --> 00:04:20.639
<v Speaker 1>That's super interesting. Yeah, are there any other essential things?

97
00:04:20.680 --> 00:04:23.120
<v Speaker 1>To consider when putting this team together.

98
00:04:23.519 --> 00:04:26.920
<v Speaker 2>I think diversity is absolutely key, Okay, and that's something

99
00:04:26.920 --> 00:04:30.199
<v Speaker 2>that the cybersecurity world struggles with in what way? You

100
00:04:30.240 --> 00:04:33.040
<v Speaker 2>know it's still a very male dominated field, is it. Yeah,

101
00:04:33.079 --> 00:04:35.360
<v Speaker 2>Like globally it's only about eleven percent women.

102
00:04:35.600 --> 00:04:37.240
<v Speaker 1>Wow, that's a really low number.

103
00:04:37.319 --> 00:04:38.319
<v Speaker 2>Yeah, it's pretty shocking.

104
00:04:38.480 --> 00:04:41.360
<v Speaker 1>Why is diversity so important, especially when bailing a red

105
00:04:41.399 --> 00:04:43.160
<v Speaker 1>team Because.

106
00:04:42.800 --> 00:04:45.959
<v Speaker 2>You get more creative and effective solutions when you have

107
00:04:46.000 --> 00:04:47.279
<v Speaker 2>different perspectives in the room.

108
00:04:47.360 --> 00:04:49.759
<v Speaker 1>Oh, you don't want everyone thinking the same way exactly.

109
00:04:49.920 --> 00:04:51.199
<v Speaker 2>That's a recipe for disaster.

110
00:04:51.399 --> 00:04:54.560
<v Speaker 1>So you've got your dream team. It's diverse, they're ethical,

111
00:04:54.560 --> 00:04:56.319
<v Speaker 1>they're ready to go. Yeah, but then you need to

112
00:04:56.360 --> 00:04:59.759
<v Speaker 1>manage them. What's the challenge in managing a red team?

113
00:05:00.560 --> 00:05:02.519
<v Speaker 2>Well, I think it's about finding that balance, right. You

114
00:05:02.519 --> 00:05:08.839
<v Speaker 2>want to give clear goals, but also not squash their creativity,

115
00:05:08.879 --> 00:05:13.839
<v Speaker 2>their freedom to explore. Okay, So regular feedback communication is

116
00:05:13.879 --> 00:05:17.120
<v Speaker 2>really important building that culture of trust and respect.

117
00:05:17.480 --> 00:05:19.720
<v Speaker 1>So it's like you're a coach, but you're not dictating

118
00:05:19.720 --> 00:05:22.120
<v Speaker 1>every move exactly. You want to make sure that they

119
00:05:22.160 --> 00:05:25.040
<v Speaker 1>feel comfortable coming to you and bouncing ideas off of

120
00:05:25.079 --> 00:05:26.600
<v Speaker 1>you and not feeling micromanaged.

121
00:05:26.759 --> 00:05:27.519
<v Speaker 2>Yeah, you got it.

122
00:05:28.120 --> 00:05:31.199
<v Speaker 1>This is all sounding pretty intense. Are there any other considerations?

123
00:05:31.360 --> 00:05:34.360
<v Speaker 2>Well, this field can be really prone to burnout in

124
00:05:34.399 --> 00:05:37.399
<v Speaker 2>what way? Red teamers are always on edge, you know, right,

125
00:05:37.600 --> 00:05:39.839
<v Speaker 2>thinking about new threats and how to get ahead of them.

126
00:05:39.879 --> 00:05:42.000
<v Speaker 2>That's a lot of pressure, it is. Yeah, So a

127
00:05:42.079 --> 00:05:46.000
<v Speaker 2>healthy team culture, promoting work life balance is essential.

128
00:05:46.279 --> 00:05:48.519
<v Speaker 1>So really making sure that they can do this job

129
00:05:48.560 --> 00:05:50.680
<v Speaker 1>long term and not burn out after a year or two.

130
00:05:50.920 --> 00:05:53.959
<v Speaker 2>Yeah, you want sustainability, not just a quick burst of energy.

131
00:05:54.199 --> 00:05:57.360
<v Speaker 1>Okay, so you've got your team, they're happy, they're healthy,

132
00:05:57.360 --> 00:06:01.240
<v Speaker 1>they're ready to go. How do they actually plan a test?

133
00:06:01.439 --> 00:06:02.720
<v Speaker 1>A Red Team operation?

134
00:06:03.759 --> 00:06:06.600
<v Speaker 2>It always starts with clearly defined objectives.

135
00:06:06.680 --> 00:06:07.240
<v Speaker 1>What do you mean?

136
00:06:07.600 --> 00:06:09.759
<v Speaker 2>What are you trying to achieve? Do you want to

137
00:06:09.800 --> 00:06:12.160
<v Speaker 2>disrupt the system? Are you trying to get to some

138
00:06:12.279 --> 00:06:16.519
<v Speaker 2>juicy data? Or is it about testing how they respond

139
00:06:16.639 --> 00:06:17.279
<v Speaker 2>to an incident?

140
00:06:17.519 --> 00:06:19.120
<v Speaker 1>Right? So you really need to have a plan. It's

141
00:06:19.160 --> 00:06:20.519
<v Speaker 1>not just about breaking.

142
00:06:20.160 --> 00:06:23.560
<v Speaker 2>Thing, No, definitely not. You get to simulate a real attack,

143
00:06:23.680 --> 00:06:25.480
<v Speaker 2>one that actually makes sense for that company.

144
00:06:25.560 --> 00:06:29.279
<v Speaker 1>Okay, so you've established your target, your goals. What happens next?

145
00:06:29.879 --> 00:06:31.360
<v Speaker 2>Well, then they got to choose their approach.

146
00:06:32.120 --> 00:06:33.160
<v Speaker 1>What do you mean by approach?

147
00:06:33.560 --> 00:06:36.120
<v Speaker 2>Think surgical strike versus carpet bombing.

148
00:06:36.480 --> 00:06:37.560
<v Speaker 1>I like that analogy.

149
00:06:37.639 --> 00:06:41.959
<v Speaker 2>Ye know. Surgical strike is very focused, very specific objective, okay.

150
00:06:42.040 --> 00:06:44.920
<v Speaker 2>Carpet bombing is more about throwing everything you got seeing

151
00:06:44.920 --> 00:06:45.480
<v Speaker 2>what sticks.

152
00:06:45.639 --> 00:06:47.199
<v Speaker 1>Okay, So how do you know which one's the right

153
00:06:47.240 --> 00:06:47.680
<v Speaker 1>way to go?

154
00:06:47.920 --> 00:06:50.360
<v Speaker 2>It depends. Sometimes you need that precision of a surgical

155
00:06:50.360 --> 00:06:54.600
<v Speaker 2>strike to test a very specific mechanism, and other times

156
00:06:55.079 --> 00:06:58.959
<v Speaker 2>that broader approach reveals more systemic weaknesses.

157
00:06:59.040 --> 00:07:02.600
<v Speaker 1>It's about choosing the right tool for the job exactly. Now.

158
00:07:02.759 --> 00:07:06.639
<v Speaker 1>Red teams have a real advantage over actual attackers, right

159
00:07:06.680 --> 00:07:09.040
<v Speaker 1>because they have that home field advantage.

160
00:07:09.120 --> 00:07:10.560
<v Speaker 2>Oh yeah, a huge advantage.

161
00:07:10.560 --> 00:07:12.879
<v Speaker 1>They know the organization inside and out.

162
00:07:12.759 --> 00:07:15.279
<v Speaker 2>They know the systems, they know the people. They even

163
00:07:15.319 --> 00:07:17.399
<v Speaker 2>know the little quirks that nobody documents.

164
00:07:17.480 --> 00:07:19.480
<v Speaker 1>Right, So they might know about a system that everyone

165
00:07:19.480 --> 00:07:22.680
<v Speaker 1>forgot about, or a security protocol that nobody's actually following,

166
00:07:22.759 --> 00:07:25.120
<v Speaker 1>or even like a disgruntled employee that they won't be

167
00:07:25.160 --> 00:07:25.959
<v Speaker 1>able to manipulate.

168
00:07:26.079 --> 00:07:28.199
<v Speaker 2>Exactly. All that insider info is gold.

169
00:07:28.439 --> 00:07:30.759
<v Speaker 1>But what happens is they get caught during an operation.

170
00:07:31.439 --> 00:07:34.920
<v Speaker 2>It happens, you know, really, and sometimes that can actually

171
00:07:34.920 --> 00:07:35.759
<v Speaker 2>be really valuable.

172
00:07:35.879 --> 00:07:36.040
<v Speaker 1>Oh.

173
00:07:36.120 --> 00:07:38.839
<v Speaker 2>Interesting, because it's a chance to see how the incident

174
00:07:38.920 --> 00:07:41.279
<v Speaker 2>response team, you know, how they react.

175
00:07:41.399 --> 00:07:44.240
<v Speaker 1>Okay, yeah, it shows their strength and weaknesses.

176
00:07:43.759 --> 00:07:45.920
<v Speaker 2>Exactly, highlights where they need to improve.

177
00:07:46.040 --> 00:07:49.079
<v Speaker 1>You can't get that from a theoretical exercise.

178
00:07:49.199 --> 00:07:52.000
<v Speaker 2>Yeah. The key is to view these as learning opportunities.

179
00:07:52.040 --> 00:07:55.680
<v Speaker 1>Oh, to embrace those mistakes, right, to make them positive.

180
00:07:55.759 --> 00:07:58.199
<v Speaker 1>And this is where we start talking about purple teaming.

181
00:07:58.360 --> 00:08:01.399
<v Speaker 2>Yeah, purple teaming is all about cloudberation. The red team

182
00:08:01.439 --> 00:08:04.959
<v Speaker 2>and the blue team working together, breaking down those silos.

183
00:08:05.040 --> 00:08:08.600
<v Speaker 1>Instead of working against each other, they're actually joining.

184
00:08:08.319 --> 00:08:12.920
<v Speaker 2>Forces exactly, sharing knowledge and understanding the threat from both sides.

185
00:08:13.240 --> 00:08:14.399
<v Speaker 1>How would that actually work.

186
00:08:14.639 --> 00:08:17.959
<v Speaker 2>They might do joint exercises like threat hunting, where the

187
00:08:18.000 --> 00:08:21.680
<v Speaker 2>red team shares what they know about attacker tactics and

188
00:08:21.720 --> 00:08:24.600
<v Speaker 2>then the blue team uses that to strengthen their defenses.

189
00:08:24.839 --> 00:08:27.839
<v Speaker 1>Okay, so it's like they're sparring partners, pushing each other

190
00:08:27.879 --> 00:08:28.399
<v Speaker 1>to get better.

191
00:08:28.480 --> 00:08:29.759
<v Speaker 2>Yeah, that's good analogy.

192
00:08:30.000 --> 00:08:33.440
<v Speaker 1>Now, how does a red team actually know if what

193
00:08:33.480 --> 00:08:36.440
<v Speaker 1>they're doing is working? How do they measure their effectiveness?

194
00:08:36.639 --> 00:08:38.759
<v Speaker 2>It's a really good question, right, and there are lots

195
00:08:38.799 --> 00:08:41.399
<v Speaker 2>of ways to do it. Like what one is just

196
00:08:41.480 --> 00:08:45.120
<v Speaker 2>tracking what they find. You know, how many vulnerabilities, how

197
00:08:45.159 --> 00:08:48.080
<v Speaker 2>long it takes them to exploit something. Okay, you know,

198
00:08:48.240 --> 00:08:49.879
<v Speaker 2>really quantifying.

199
00:08:49.279 --> 00:08:51.360
<v Speaker 1>The risk so they can go back and say, look,

200
00:08:51.639 --> 00:08:54.279
<v Speaker 1>we found all these problems. We help make the organization

201
00:08:54.320 --> 00:08:55.679
<v Speaker 1>more secure exactly.

202
00:08:55.759 --> 00:08:59.679
<v Speaker 2>Yeah, and these reports can be really useful for justifying budgets, yeah,

203
00:09:00.080 --> 00:09:01.200
<v Speaker 2>oritizing what needs fixing.

204
00:09:01.559 --> 00:09:03.919
<v Speaker 1>Oh right, they can say, look, we need more resources

205
00:09:03.960 --> 00:09:06.440
<v Speaker 1>to do this because it's actually having a real impact.

206
00:09:06.759 --> 00:09:07.759
<v Speaker 2>Exactly, you get it.

207
00:09:07.799 --> 00:09:09.960
<v Speaker 1>So it's not just about the technical side of hacking.

208
00:09:10.039 --> 00:09:16.320
<v Speaker 1>It's about communication, analysis and actually making the organization more secure.

209
00:09:16.000 --> 00:09:17.639
<v Speaker 2>One hundred percent. It's all connected.

210
00:09:17.720 --> 00:09:20.639
<v Speaker 1>Now, a lot of organizations might be thinking they haven't

211
00:09:20.679 --> 00:09:23.679
<v Speaker 1>been attacked, right, so maybe there's nothing to worry about.

212
00:09:23.679 --> 00:09:25.000
<v Speaker 1>Maybe they're doing everything right.

213
00:09:25.799 --> 00:09:29.679
<v Speaker 2>That's a dangerous assumption. Okay, Why because it creates this

214
00:09:29.759 --> 00:09:33.480
<v Speaker 2>illusion of control. Oh they think they're secure because they

215
00:09:33.480 --> 00:09:34.679
<v Speaker 2>haven't been tested properly.

216
00:09:35.000 --> 00:09:38.279
<v Speaker 1>Oh so red teaming is almost like forcing them to

217
00:09:38.360 --> 00:09:39.679
<v Speaker 1>confront that reality.

218
00:09:39.879 --> 00:09:43.440
<v Speaker 2>Yeah. It shatters the illusion by exposing those weaknesses so

219
00:09:43.480 --> 00:09:46.039
<v Speaker 2>they can fix them before a real attacker gets in.

220
00:09:46.159 --> 00:09:48.200
<v Speaker 1>It's like a wake up call exactly.

221
00:09:48.440 --> 00:09:50.000
<v Speaker 2>Prevention is always better than a cure.

222
00:09:50.679 --> 00:09:52.919
<v Speaker 1>Okay, So let's dive a little deeper into some of

223
00:09:52.960 --> 00:09:55.840
<v Speaker 1>the tactics that red teams use. Sure, the book talks

224
00:09:55.840 --> 00:09:58.000
<v Speaker 1>about something called attack graphs. What are those?

225
00:09:58.279 --> 00:10:01.480
<v Speaker 2>Okay? So attack graphs think of it like a roadmap,

226
00:10:02.159 --> 00:10:03.039
<v Speaker 2>but for hackers.

227
00:10:03.320 --> 00:10:03.679
<v Speaker 1>Okay.

228
00:10:03.879 --> 00:10:06.120
<v Speaker 2>It shows how an attacker might try to move through

229
00:10:06.120 --> 00:10:07.240
<v Speaker 2>your systems, So it's.

230
00:10:07.159 --> 00:10:08.919
<v Speaker 1>Like a blueprint for how they would attack.

231
00:10:09.240 --> 00:10:12.600
<v Speaker 2>Yeah, it's really valuable for the red team to map

232
00:10:12.600 --> 00:10:13.679
<v Speaker 2>out potential paths.

233
00:10:13.960 --> 00:10:18.840
<v Speaker 1>Oh, to see how different assets connect and where the vulnerabilities.

234
00:10:18.000 --> 00:10:19.320
<v Speaker 2>Are exactly, you get it.

235
00:10:19.360 --> 00:10:22.519
<v Speaker 1>And it can be used for threat modeling, vulnerability analysis,

236
00:10:22.600 --> 00:10:25.879
<v Speaker 1>even for training your employees on security awareness.

237
00:10:26.039 --> 00:10:28.759
<v Speaker 2>Yeah, totally. It helps you understand how an attacker thinks.

238
00:10:29.240 --> 00:10:33.039
<v Speaker 1>Now, the book also mentions threat trees and graphs, Right,

239
00:10:33.159 --> 00:10:34.720
<v Speaker 1>how are those different from attack graphs.

240
00:10:34.799 --> 00:10:37.039
<v Speaker 2>Well, attack graphs focus on those specific paths.

241
00:10:37.120 --> 00:10:37.480
<v Speaker 1>Okay.

242
00:10:37.720 --> 00:10:39.679
<v Speaker 2>Threat trees and graphs take a broader look.

243
00:10:39.759 --> 00:10:40.240
<v Speaker 1>Oh, Okay.

244
00:10:40.519 --> 00:10:43.120
<v Speaker 2>They map out all the potential threats, what their impact

245
00:10:43.200 --> 00:10:43.679
<v Speaker 2>could be.

246
00:10:43.679 --> 00:10:45.960
<v Speaker 1>So it's like zooming out to see the big picture.

247
00:10:45.759 --> 00:10:50.919
<v Speaker 2>Exactly, and they often include info about what motivates the attackers,

248
00:10:51.279 --> 00:10:53.360
<v Speaker 2>what they're capable of and who they're after.

249
00:10:53.480 --> 00:10:55.399
<v Speaker 1>Oh wow, so it's not just about the how, but

250
00:10:55.480 --> 00:10:57.559
<v Speaker 1>also the why behind an attack.

251
00:10:57.720 --> 00:10:58.879
<v Speaker 2>Yeah, that's really important.

252
00:10:58.960 --> 00:11:02.279
<v Speaker 1>That's a crucial distinction, right, because if you understand the why,

253
00:11:02.440 --> 00:11:05.080
<v Speaker 1>you can prioritize what to protect and how to defend.

254
00:11:05.279 --> 00:11:06.399
<v Speaker 2>Absolutely. Yeah.

255
00:11:06.480 --> 00:11:10.720
<v Speaker 1>Now, the book talks about building these conceptual graphs manually, right,

256
00:11:10.799 --> 00:11:12.919
<v Speaker 1>what does that involve? How does it actually work?

257
00:11:13.200 --> 00:11:15.960
<v Speaker 2>It's basically a brainstorming session. You know, a bunch of

258
00:11:16.320 --> 00:11:22.840
<v Speaker 2>security experts getting together, okay, mapping out those scenarios, identifying assets, vulnerabilities,

259
00:11:22.879 --> 00:11:24.200
<v Speaker 2>all those attacker actions.

260
00:11:24.360 --> 00:11:26.200
<v Speaker 1>So you're trying to predict what they might.

261
00:11:26.080 --> 00:11:29.279
<v Speaker 2>Do exactly, and you can use a whiteboard, sticky notes

262
00:11:29.759 --> 00:11:30.879
<v Speaker 2>just trying to connect the dots.

263
00:11:31.080 --> 00:11:33.159
<v Speaker 1>That sounds super time consuming though.

264
00:11:33.120 --> 00:11:35.159
<v Speaker 2>It can be, and that's where automation comes in.

265
00:11:35.279 --> 00:11:36.799
<v Speaker 1>Oh okay, how does that work.

266
00:11:36.919 --> 00:11:41.159
<v Speaker 2>There are tools that can scan networks, analyze those configurations,

267
00:11:41.679 --> 00:11:43.159
<v Speaker 2>find known vulnerabilities.

268
00:11:43.240 --> 00:11:46.759
<v Speaker 1>So it's like perbocharging that brainstorming session with technology exactly.

269
00:11:46.759 --> 00:11:49.360
<v Speaker 2>It frees up the security teams from more strategic work.

270
00:11:49.639 --> 00:11:51.600
<v Speaker 1>Okay, Now, let's shift gears a little bit and talk

271
00:11:51.600 --> 00:11:55.399
<v Speaker 1>about measuring how effective a red team's work is sure.

272
00:11:55.679 --> 00:11:59.799
<v Speaker 1>The book talks about defining things called metrics and KPIs.

273
00:12:00.039 --> 00:12:01.919
<v Speaker 1>What are those? Can you give me some examples of those?

274
00:12:02.200 --> 00:12:04.399
<v Speaker 2>Yeah? So there are two main times. Ones that focus

275
00:12:04.440 --> 00:12:08.159
<v Speaker 2>on the Red team's internal operations, okay, and then ones

276
00:12:08.200 --> 00:12:10.279
<v Speaker 2>that look at the impact of their work. Give me

277
00:12:10.320 --> 00:12:13.399
<v Speaker 2>an example, like, an operational kpiah could be the number

278
00:12:13.399 --> 00:12:16.120
<v Speaker 2>of pen tests they've done. Okay, Well, an impact KPI

279
00:12:16.200 --> 00:12:19.080
<v Speaker 2>would be how many critical vulnerabilities they found or how

280
00:12:19.120 --> 00:12:20.200
<v Speaker 2>long it takes to fix them.

281
00:12:20.360 --> 00:12:23.000
<v Speaker 1>Oh so one's about efficiency and the other ones about

282
00:12:23.000 --> 00:12:27.279
<v Speaker 1>effectiveness exactly. What about these attack insight dashboards that I

283
00:12:27.320 --> 00:12:28.320
<v Speaker 1>saw mentioned in the book?

284
00:12:28.399 --> 00:12:29.440
<v Speaker 2>Oh yeah, they're really cool.

285
00:12:29.519 --> 00:12:30.039
<v Speaker 1>What are they?

286
00:12:30.240 --> 00:12:33.440
<v Speaker 2>Imagine a dashboard that gives you a real time view

287
00:12:33.600 --> 00:12:36.519
<v Speaker 2>of what's happening in an operation. Okay, you can see

288
00:12:36.799 --> 00:12:40.279
<v Speaker 2>what phase the attack is, in, which assets have been compromised,

289
00:12:40.559 --> 00:12:42.000
<v Speaker 2>what techniques are being used.

290
00:12:42.159 --> 00:12:44.559
<v Speaker 1>So it's like watching the attack unfold live.

291
00:12:44.679 --> 00:12:46.720
<v Speaker 2>Yeah, super helpful for the Blue team. You know, they

292
00:12:46.720 --> 00:12:50.240
<v Speaker 2>can observe what's going on, learn those tactics, and adapt

293
00:12:50.240 --> 00:12:51.720
<v Speaker 2>their defenses in real time.

294
00:12:51.919 --> 00:12:53.720
<v Speaker 1>Like they're getting a front row seat to a real

295
00:12:53.759 --> 00:12:57.960
<v Speaker 1>attack exactly. The book also mentioned something called Red Team scores.

296
00:12:58.159 --> 00:13:00.360
<v Speaker 2>Yeah, what are they? So they basically quant to find

297
00:13:00.399 --> 00:13:03.480
<v Speaker 2>the impact of the findings. Oh, they might assign points

298
00:13:03.519 --> 00:13:07.000
<v Speaker 2>based on how bad a vulnerability is, how easy it

299
00:13:07.080 --> 00:13:08.840
<v Speaker 2>is to exploit it, and how what do you damage

300
00:13:08.879 --> 00:13:09.240
<v Speaker 2>it could do.

301
00:13:09.399 --> 00:13:12.759
<v Speaker 1>So it helps prioritize what to fix first exactly.

302
00:13:12.759 --> 00:13:14.559
<v Speaker 2>You want to focus on the things that pose the

303
00:13:14.559 --> 00:13:16.120
<v Speaker 2>biggest risk, right okay.

304
00:13:16.120 --> 00:13:18.720
<v Speaker 1>And then I saw burn down charts. Yeah, what are

305
00:13:18.720 --> 00:13:19.279
<v Speaker 1>those used for?

306
00:13:19.440 --> 00:13:22.279
<v Speaker 2>They're like visual trackers Okay. In this case, they show

307
00:13:22.279 --> 00:13:24.279
<v Speaker 2>you how quickly vulnerabilities are being addressed.

308
00:13:24.320 --> 00:13:26.960
<v Speaker 1>Oh, so you can see if the organization is actually

309
00:13:27.000 --> 00:13:30.799
<v Speaker 1>fixing the problems that the Red Team finds, right exactly.

310
00:13:30.840 --> 00:13:34.639
<v Speaker 1>And then there's this blast radius visualization. Yeah, what's that

311
00:13:34.879 --> 00:13:36.279
<v Speaker 1>and why is it important?

312
00:13:36.440 --> 00:13:39.480
<v Speaker 2>Well, it shows you the potential fallout if an attack

313
00:13:39.559 --> 00:13:42.240
<v Speaker 2>is successful. Okay, Like let's say the Red Team got

314
00:13:42.320 --> 00:13:45.759
<v Speaker 2>hold of a user account. Okay, this visualization would show

315
00:13:45.759 --> 00:13:47.879
<v Speaker 2>you all the systems they could access, the data they

316
00:13:47.879 --> 00:13:48.360
<v Speaker 2>could get to.

317
00:13:49.000 --> 00:13:51.480
<v Speaker 1>Oh wow, it's like a worst case scenario map.

318
00:13:51.679 --> 00:13:54.320
<v Speaker 2>Yeah, you can see the potential domino effect.

319
00:13:54.440 --> 00:13:57.000
<v Speaker 1>That's important for risk management because then you can really

320
00:13:57.080 --> 00:13:58.200
<v Speaker 1>understand what's at stake.

321
00:13:58.600 --> 00:13:59.240
<v Speaker 2>Absolutely.

322
00:13:59.320 --> 00:14:01.399
<v Speaker 1>Now, one thing the book points out is that using

323
00:14:01.480 --> 00:14:06.480
<v Speaker 1>simple ratings like critical, high, medium, low to assess risk

324
00:14:06.720 --> 00:14:07.600
<v Speaker 1>isn't really enough.

325
00:14:07.879 --> 00:14:09.679
<v Speaker 2>Yeah, those terms can be subjective.

326
00:14:09.879 --> 00:14:10.360
<v Speaker 1>Oh okay.

327
00:14:10.600 --> 00:14:13.399
<v Speaker 2>What one person thinks is critical, another person might say

328
00:14:13.440 --> 00:14:17.120
<v Speaker 2>is high. And without clear definitions, it's hard to prioritize

329
00:14:17.200 --> 00:14:18.679
<v Speaker 2>you know where to put your resources.

330
00:14:18.759 --> 00:14:21.559
<v Speaker 1>So how do you move beyond those simple ratings?

331
00:14:21.600 --> 00:14:25.960
<v Speaker 2>Then? Well, you could use more quantitative methods like simulations.

332
00:14:25.960 --> 00:14:28.679
<v Speaker 2>Oh okay, like Monty Carlo simulations.

333
00:14:28.159 --> 00:14:29.480
<v Speaker 1>Money Carlos simulations.

334
00:14:29.480 --> 00:14:32.879
<v Speaker 2>That sounds complex, It can be, but it's a powerful tool.

335
00:14:33.440 --> 00:14:37.879
<v Speaker 2>You basically run thousands of simulations to model different attack

336
00:14:37.960 --> 00:14:40.919
<v Speaker 2>scenarios and then calculate the impact of each one.

337
00:14:41.080 --> 00:14:44.080
<v Speaker 1>So you're factoring the likelihood of the attack, how strong

338
00:14:44.120 --> 00:14:47.120
<v Speaker 1>your defenses are, and what the financial hit would be.

339
00:14:47.360 --> 00:14:50.320
<v Speaker 2>Yeah, exactly. You want to make data driven decisions, not

340
00:14:50.399 --> 00:14:52.600
<v Speaker 2>just gut feeling, right, Data is key, okay.

341
00:14:52.600 --> 00:14:55.960
<v Speaker 1>The book also mentions meantime metrics. Yeah, what are those?

342
00:14:56.360 --> 00:14:58.600
<v Speaker 2>So these basically measure how long it takes to do

343
00:14:58.840 --> 00:15:02.000
<v Speaker 2>certain things, how long to detect an attack, how long

344
00:15:02.039 --> 00:15:04.720
<v Speaker 2>to fix a vulnerability, how long to recover.

345
00:15:05.000 --> 00:15:07.440
<v Speaker 1>So you're measuring how quickly you can respond and then

346
00:15:07.519 --> 00:15:09.679
<v Speaker 1>using that to improve your response times.

347
00:15:09.799 --> 00:15:11.559
<v Speaker 2>Yeah, you want to be fast and efficient.

348
00:15:11.240 --> 00:15:15.000
<v Speaker 1>Right, Okay. There's also something called the Threat Response Matrix, right,

349
00:15:15.080 --> 00:15:16.240
<v Speaker 1>can you explain what that is?

350
00:15:16.320 --> 00:15:19.480
<v Speaker 2>Basically, it's a playbook, Okay. It lists potential threats, what

351
00:15:19.519 --> 00:15:23.240
<v Speaker 2>their impact could be, and how the organization wants to respond.

352
00:15:23.360 --> 00:15:25.919
<v Speaker 1>Oh, so everybody knows what to do if a specific

353
00:15:26.000 --> 00:15:27.360
<v Speaker 1>threat shows up exactly.

354
00:15:27.440 --> 00:15:29.559
<v Speaker 2>Yeah, especially when you're under pressure, you need a plan.

355
00:15:29.799 --> 00:15:30.159
<v Speaker 1>Right.

356
00:15:30.240 --> 00:15:33.559
<v Speaker 2>Then there's the Test Maturity Model Integration or TMI.

357
00:15:33.840 --> 00:15:35.559
<v Speaker 1>TMI Okay, I'm not familiar with that.

358
00:15:35.919 --> 00:15:40.480
<v Speaker 2>It's a framework for evaluating how mature a testing process is. Okay.

359
00:15:40.559 --> 00:15:43.840
<v Speaker 2>It wasn't designed specifically for security, okay, but a lot

360
00:15:43.840 --> 00:15:45.679
<v Speaker 2>of the principles apply to red teaming.

361
00:15:45.879 --> 00:15:49.879
<v Speaker 1>Okay, So how can organizations use this framework to improve

362
00:15:49.919 --> 00:15:50.759
<v Speaker 1>their red teaming?

363
00:15:51.080 --> 00:15:55.000
<v Speaker 2>Well, they can assess their processes against the TMMI and

364
00:15:55.039 --> 00:15:56.240
<v Speaker 2>see where they need to improve.

365
00:15:56.480 --> 00:15:59.399
<v Speaker 1>So it's like benchmarking themselves against best practices.

366
00:16:00.080 --> 00:16:02.720
<v Speaker 2>Exactly. You want to make sure your operations are top notch.

367
00:16:03.000 --> 00:16:05.120
<v Speaker 1>Okay, I'm sure our listeners are eager to hear about

368
00:16:05.159 --> 00:16:08.240
<v Speaker 1>some of the more I guess cutting edge red team operations.

369
00:16:08.279 --> 00:16:11.240
<v Speaker 1>Oh yeah, definitely, let's dive into those more innovative and

370
00:16:11.320 --> 00:16:12.440
<v Speaker 1>challenging exercises.

371
00:16:12.519 --> 00:16:16.559
<v Speaker 2>Okay, let's start with progressive red teaming, which really pushes

372
00:16:16.600 --> 00:16:18.200
<v Speaker 2>beyond those traditional methods.

373
00:16:18.279 --> 00:16:18.600
<v Speaker 1>Okay.

374
00:16:18.639 --> 00:16:22.039
<v Speaker 2>One example is cryptocurrency mining, oh wow, where red teams

375
00:16:22.039 --> 00:16:27.000
<v Speaker 2>are simulating attacks designed to basically hijack your computing resources

376
00:16:27.320 --> 00:16:28.120
<v Speaker 2>to make money.

377
00:16:28.480 --> 00:16:32.279
<v Speaker 1>So instead of stealing data, they're stealing your processing power.

378
00:16:32.480 --> 00:16:35.440
<v Speaker 2>Yeah, exactly, they're using your resources for their own profit.

379
00:16:35.639 --> 00:16:37.840
<v Speaker 1>That's a big concern for organizations today.

380
00:16:37.919 --> 00:16:40.200
<v Speaker 2>It is. Yeah, it can be really expensive, slow down

381
00:16:40.200 --> 00:16:42.159
<v Speaker 2>your systems, even damage your hardware.

382
00:16:42.679 --> 00:16:46.000
<v Speaker 1>What are some other types of progressive red teaming operations?

383
00:16:46.120 --> 00:16:49.879
<v Speaker 2>Another area is red teaming for privacy violations. Okay, so

384
00:16:49.960 --> 00:16:53.080
<v Speaker 2>you're testing the defenses against attacks that are trying to

385
00:16:53.120 --> 00:16:55.720
<v Speaker 2>steal or misuse personal data.

386
00:16:55.399 --> 00:16:58.559
<v Speaker 1>So basically making sure you're complying with things like GDPR.

387
00:16:59.000 --> 00:17:05.359
<v Speaker 2>Exactly. They might simulate attacks that exploit weaknesses in data protection.

388
00:17:05.400 --> 00:17:07.240
<v Speaker 1>So you might find out that your web app is

389
00:17:07.240 --> 00:17:10.000
<v Speaker 1>insecure or your database isn't configured properly.

390
00:17:10.200 --> 00:17:13.960
<v Speaker 2>Yeah, exactly. You're finding those hidden risks that companies might

391
00:17:14.000 --> 00:17:14.799
<v Speaker 2>not even be aware of.

392
00:17:14.960 --> 00:17:17.920
<v Speaker 1>It's all about being proactive, right, finding the problem before

393
00:17:17.960 --> 00:17:19.119
<v Speaker 1>it becomes a bigger problem.

394
00:17:19.319 --> 00:17:20.279
<v Speaker 2>Yeah. Absolutely.

395
00:17:20.319 --> 00:17:23.200
<v Speaker 1>Are there any other progressive red team exercises that you

396
00:17:23.240 --> 00:17:24.279
<v Speaker 1>think are worth mentioning?

397
00:17:24.599 --> 00:17:28.400
<v Speaker 2>Yeah? Another big one is attacking AI and machine learning systems.

398
00:17:28.680 --> 00:17:29.440
<v Speaker 1>Oh interesting.

399
00:17:29.519 --> 00:17:32.680
<v Speaker 2>So these are systems that are becoming more and more common, right,

400
00:17:32.839 --> 00:17:35.079
<v Speaker 2>and we're starting to see the vulnerabilities in them.

401
00:17:35.119 --> 00:17:36.440
<v Speaker 1>What kind of vulnerabilities?

402
00:17:36.559 --> 00:17:40.279
<v Speaker 2>Well, one example is what's called data poisoning. Okay, Attackers

403
00:17:40.319 --> 00:17:43.000
<v Speaker 2>try to manipulate the data that's used to train the

404
00:17:43.039 --> 00:17:44.400
<v Speaker 2>AI models, so.

405
00:17:44.400 --> 00:17:49.079
<v Speaker 1>Like introducing biases or errors that make the AI make

406
00:17:49.119 --> 00:17:49.960
<v Speaker 1>bad decisions.

407
00:17:50.119 --> 00:17:52.000
<v Speaker 2>Yeah, exactly, And it can be really hard.

408
00:17:51.839 --> 00:17:54.720
<v Speaker 1>To detect, right, because you're not breaking into a system,

409
00:17:54.759 --> 00:17:57.119
<v Speaker 1>You're just manipulating the data that the.

410
00:17:57.079 --> 00:17:59.160
<v Speaker 2>System uses, right, You're tricking the AI.

411
00:17:59.640 --> 00:18:03.240
<v Speaker 1>Wow. Wow, that's a whole new level of complexity, it is.

412
00:18:03.319 --> 00:18:03.720
<v Speaker 2>Yeah.

413
00:18:03.759 --> 00:18:07.680
<v Speaker 1>What other AI related attacks are red teams simulating?

414
00:18:08.279 --> 00:18:12.440
<v Speaker 2>There's also something called adversarial machine learning, where they create

415
00:18:12.519 --> 00:18:16.920
<v Speaker 2>inputs that are designed to fool the AI models, make

416
00:18:17.000 --> 00:18:18.319
<v Speaker 2>them misclassified data.

417
00:18:18.599 --> 00:18:20.400
<v Speaker 1>So it's like an optical illusion for AI.

418
00:18:21.599 --> 00:18:22.880
<v Speaker 2>Yeah, that's a great way to put it.

419
00:18:22.880 --> 00:18:27.960
<v Speaker 1>They can bypass security, manipulate markets, even control physical systems exactly.

420
00:18:28.039 --> 00:18:29.119
<v Speaker 2>It's a serious concern.

421
00:18:29.319 --> 00:18:32.799
<v Speaker 1>So what can organizations do to protect themselves from this?

422
00:18:33.400 --> 00:18:36.720
<v Speaker 2>Well, it's a constantly evolving area, right, But some things

423
00:18:36.720 --> 00:18:41.000
<v Speaker 2>they can do are implement robust data validation okay, develop

424
00:18:41.039 --> 00:18:43.519
<v Speaker 2>more resilient models, and just stay up to date on

425
00:18:43.680 --> 00:18:44.839
<v Speaker 2>the latest threats.

426
00:18:45.200 --> 00:18:47.880
<v Speaker 1>So red teaming is crucial here too, right, because they

427
00:18:47.880 --> 00:18:50.559
<v Speaker 1>can help you understand the weaknesses in your AI system.

428
00:18:50.680 --> 00:18:53.200
<v Speaker 2>Oh absolutely, They're essential for staying ahead of the curve

429
00:18:53.200 --> 00:18:53.839
<v Speaker 2>in this area.

430
00:18:53.920 --> 00:18:56.680
<v Speaker 1>Okay. Any other innovative exercises.

431
00:18:56.200 --> 00:18:59.599
<v Speaker 2>Yeah, there's one called operation Vigilanting Operation vigilante, okay, where

432
00:18:59.640 --> 00:19:03.319
<v Speaker 2>the red team goes beyond just finding vulnerabilities Okay, they

433
00:19:03.319 --> 00:19:04.200
<v Speaker 2>actually fix them.

434
00:19:04.359 --> 00:19:06.519
<v Speaker 1>Wait, so they're not just pointing out the problems, they're

435
00:19:06.519 --> 00:19:08.079
<v Speaker 1>actually solving them exactly.

436
00:19:08.240 --> 00:19:09.839
<v Speaker 2>They're taking more proactive approach.

437
00:19:10.079 --> 00:19:12.599
<v Speaker 1>That blurs the line between red teaming and being like

438
00:19:12.640 --> 00:19:14.039
<v Speaker 1>a system administrator.

439
00:19:14.200 --> 00:19:16.480
<v Speaker 2>It does, yeah, but it can be a really effective

440
00:19:16.519 --> 00:19:18.279
<v Speaker 2>way to address vulnerabilities quickly.

441
00:19:18.720 --> 00:19:21.920
<v Speaker 1>So it's good for organizations that are maybe struggling to

442
00:19:22.000 --> 00:19:24.960
<v Speaker 1>keep up with patching and fixing things. Yeah, exactly, But

443
00:19:25.039 --> 00:19:27.119
<v Speaker 1>how do you make sure the blue team knows what's

444
00:19:27.160 --> 00:19:27.519
<v Speaker 1>going on?

445
00:19:27.880 --> 00:19:32.000
<v Speaker 2>Transparency is key. The red team has to document everything. Okay,

446
00:19:32.160 --> 00:19:34.799
<v Speaker 2>share that info with the Blue team so they can

447
00:19:34.880 --> 00:19:35.920
<v Speaker 2>update their defenses.

448
00:19:36.160 --> 00:19:39.279
<v Speaker 1>So everybody's in the loop exactly, no surprises. Okay. Now

449
00:19:39.319 --> 00:19:42.880
<v Speaker 1>let's talk about situational awareness and knowledge graphs. Sure, what

450
00:19:43.000 --> 00:19:45.279
<v Speaker 1>are those and how are they important for red teaming?

451
00:19:45.960 --> 00:19:48.960
<v Speaker 2>Well, a knowledge graph think of it like a map, okay,

452
00:19:49.079 --> 00:19:51.400
<v Speaker 2>but for your organization's cybersecurity.

453
00:19:51.480 --> 00:19:51.720
<v Speaker 1>Okay.

454
00:19:52.039 --> 00:19:57.319
<v Speaker 2>It shows you the relationships between different assets, users, vulnerabilities.

455
00:19:57.759 --> 00:20:00.319
<v Speaker 1>So it's like a Google Maps for your secure scurity.

456
00:20:00.480 --> 00:20:01.759
<v Speaker 2>Yeah, that's a great way to put it.

457
00:20:01.799 --> 00:20:04.559
<v Speaker 1>And the Red team can use that to find potential

458
00:20:04.559 --> 00:20:10.519
<v Speaker 1>attack paths exactly. It's super helpful for THREP modeling, vulnerability analysis,

459
00:20:10.680 --> 00:20:12.079
<v Speaker 1>responding to incidents.

460
00:20:12.480 --> 00:20:14.160
<v Speaker 2>Yeah. It's can to be more and more important as

461
00:20:14.160 --> 00:20:15.559
<v Speaker 2>a tax get more sophisticated.

462
00:20:15.720 --> 00:20:19.240
<v Speaker 1>Okay, So how do you actually create these knowledge graphs.

463
00:20:19.359 --> 00:20:22.000
<v Speaker 2>You can do it manually, but it takes forever and

464
00:20:22.039 --> 00:20:24.559
<v Speaker 2>it's not always accurate. Right, So the book talks about

465
00:20:24.599 --> 00:20:27.359
<v Speaker 2>using something called graph databases like Neo four J.

466
00:20:27.599 --> 00:20:28.759
<v Speaker 1>Neo four J. What's that.

467
00:20:29.279 --> 00:20:33.000
<v Speaker 2>It's a database that's specifically designed to store and query

468
00:20:33.279 --> 00:20:37.839
<v Speaker 2>graph data. Okay, it's really good at handling complex relationships. Oh, okay,

469
00:20:37.960 --> 00:20:43.440
<v Speaker 2>create nodes that represent things like users, systems, vulnerabilities, and

470
00:20:43.440 --> 00:20:46.480
<v Speaker 2>then you connect them with relationships that define how they're connected.

471
00:20:46.599 --> 00:20:49.920
<v Speaker 1>So you're building this virtual map of how everything is

472
00:20:49.920 --> 00:20:51.160
<v Speaker 1>interconnected exactly.

473
00:20:51.240 --> 00:20:53.799
<v Speaker 2>And because of the database, you can ask questions like

474
00:20:54.079 --> 00:20:57.880
<v Speaker 2>what systems can this user access okay, or what vulnerabilities

475
00:20:57.920 --> 00:21:00.559
<v Speaker 2>are on this system and NEO four J can answer

476
00:21:00.599 --> 00:21:02.759
<v Speaker 2>that instantly. That's powerful, it is.

477
00:21:02.880 --> 00:21:05.079
<v Speaker 1>Yeah, So how does this help the Red team?

478
00:21:05.279 --> 00:21:08.920
<v Speaker 2>It helps them plan and execute attacks more effectively. They

479
00:21:08.960 --> 00:21:12.319
<v Speaker 2>can find systems with sensitive data or systems that are

480
00:21:12.400 --> 00:21:14.559
<v Speaker 2>vulnerable to specific.

481
00:21:14.160 --> 00:21:18.079
<v Speaker 1>Attacks, so they can prioritize their targets exactly.

482
00:21:18.160 --> 00:21:18.400
<v Speaker 2>Yeah.

483
00:21:18.440 --> 00:21:20.359
<v Speaker 1>What about the Blue team? Does this help them too?

484
00:21:20.720 --> 00:21:26.039
<v Speaker 2>Definitely? It helps them detect threats okay, by identifying unusual

485
00:21:26.160 --> 00:21:30.359
<v Speaker 2>user activity or system behavior that could indicate an attack.

486
00:21:30.559 --> 00:21:32.319
<v Speaker 1>So they're using it to find anomalies.

487
00:21:32.559 --> 00:21:33.279
<v Speaker 2>Yeah, exactly.

488
00:21:33.359 --> 00:21:35.480
<v Speaker 1>It sounds like knowledge graphs are a game changer for

489
00:21:35.519 --> 00:21:36.279
<v Speaker 1>both sides.

490
00:21:36.400 --> 00:21:37.000
<v Speaker 2>They really are.

491
00:21:37.400 --> 00:21:41.599
<v Speaker 1>We talked about how they can show relationships between assets, users,

492
00:21:42.279 --> 00:21:45.240
<v Speaker 1>but what about vulnerabilities. How do those fit into this model?

493
00:21:45.359 --> 00:21:48.799
<v Speaker 2>Vulnerabilities are nodes too, just like users and systems. Okay,

494
00:21:48.960 --> 00:21:51.720
<v Speaker 2>you connect them to system nodes to show which systems

495
00:21:51.720 --> 00:21:52.240
<v Speaker 2>are affected.

496
00:21:52.319 --> 00:21:54.119
<v Speaker 1>So like, you could have a node for a buffer

497
00:21:54.240 --> 00:21:58.359
<v Speaker 1>overflow vulnerability and connect that to all the systems running

498
00:21:58.400 --> 00:21:59.880
<v Speaker 1>software that's vulnerable to.

499
00:21:59.839 --> 00:22:02.519
<v Speaker 2>That exactly, then you can quickly see which systems are

500
00:22:02.519 --> 00:22:03.319
<v Speaker 2>at the highest risk.

501
00:22:03.440 --> 00:22:06.400
<v Speaker 1>Okay, that makes sense. Yeah, Now let's talk about something

502
00:22:06.440 --> 00:22:09.640
<v Speaker 1>called credential hunting. What are some of the techniques that

503
00:22:10.079 --> 00:22:14.079
<v Speaker 1>red teams use to find those sensitive credentials within an organization?

504
00:22:14.480 --> 00:22:17.880
<v Speaker 2>So, credential hunting is all about finding the keys to

505
00:22:17.920 --> 00:22:22.960
<v Speaker 2>the kingdom, right, those passwords, those access tokens that unlock everything.

506
00:22:22.680 --> 00:22:25.839
<v Speaker 1>Right, like the ultimate goal of a hacker exactly. So

507
00:22:25.880 --> 00:22:26.640
<v Speaker 1>how do they do it?

508
00:22:26.680 --> 00:22:29.680
<v Speaker 2>Well, let's start with a simple one. Searching for common patterns.

509
00:22:30.160 --> 00:22:31.000
<v Speaker 1>What do you mean by that?

510
00:22:31.160 --> 00:22:34.920
<v Speaker 2>Literally searching for passwords that might be stored in plain text.

511
00:22:35.240 --> 00:22:38.160
<v Speaker 2>People do that more often than you think. Yeah. Really,

512
00:22:38.240 --> 00:22:42.920
<v Speaker 2>They look through configuration files, source codes, scripts, documents anywhere

513
00:22:43.000 --> 00:22:47.160
<v Speaker 2>that might have passwords. Wow. They search for keywords like passwords, secret,

514
00:22:47.400 --> 00:22:48.160
<v Speaker 2>API key.

515
00:22:48.559 --> 00:22:52.400
<v Speaker 1>It sounds so simple, but it works.

516
00:22:52.240 --> 00:22:55.480
<v Speaker 2>It does, yees, especially when people don't follow good security practices.

517
00:22:55.559 --> 00:22:58.119
<v Speaker 1>Okay, now there are more sophisticated techniques, right, Oh, yeah,

518
00:22:58.160 --> 00:22:59.200
<v Speaker 1>of course, what else can they do?

519
00:22:59.519 --> 00:23:01.640
<v Speaker 2>On One is to use indexing.

520
00:23:01.920 --> 00:23:03.160
<v Speaker 1>Indexing, Yeah, you.

521
00:23:03.079 --> 00:23:07.400
<v Speaker 2>Know how operating systems and applications index things to make

522
00:23:07.440 --> 00:23:11.920
<v Speaker 2>searches faster. Well, red teams can use that to their advantage. Okay,

523
00:23:11.920 --> 00:23:15.279
<v Speaker 2>how they can query the index and search for keywords

524
00:23:15.359 --> 00:23:17.400
<v Speaker 2>like password across all the files.

525
00:23:17.480 --> 00:23:21.720
<v Speaker 1>So they're using the system's own tools against itself exactly.

526
00:23:21.920 --> 00:23:24.319
<v Speaker 1>So if you're on Windows, for example, what would they use.

527
00:23:24.440 --> 00:23:28.680
<v Speaker 2>They could use PowerShell to query the Windows Search index

528
00:23:28.880 --> 00:23:31.559
<v Speaker 2>oct and find anything that has the word password in it.

529
00:23:31.839 --> 00:23:33.799
<v Speaker 1>What about on mac OS and Linux?

530
00:23:34.000 --> 00:23:37.960
<v Speaker 2>Oh, they have tools too. macOS has Spotlight, which indexes files,

531
00:23:38.000 --> 00:23:39.720
<v Speaker 2>and Linux has rep and find.

532
00:23:39.960 --> 00:23:42.000
<v Speaker 1>So no matter what system you're on, they can find

533
00:23:42.000 --> 00:23:43.680
<v Speaker 1>those hidden credentials pretty much.

534
00:23:43.759 --> 00:23:43.960
<v Speaker 2>Yeah.

535
00:23:44.000 --> 00:23:46.880
<v Speaker 1>Now you can get even more specific, right, Oh yeah,

536
00:23:46.880 --> 00:23:50.920
<v Speaker 1>what about techniques that target particular applications or systems?

537
00:23:51.160 --> 00:23:53.839
<v Speaker 2>Right? So one example is analyzing process.

538
00:23:53.480 --> 00:23:54.880
<v Speaker 1>Memory process memory.

539
00:23:54.960 --> 00:23:58.680
<v Speaker 2>Yeah, when an application is running, its code and data

540
00:23:58.920 --> 00:24:02.039
<v Speaker 2>are loaded into memory. Okay, and that memory can contain

541
00:24:02.119 --> 00:24:06.440
<v Speaker 2>things like passwords, API keys, encryption keys.

542
00:24:06.519 --> 00:24:08.839
<v Speaker 1>Oh wow, so they're looking for the stuff that's actually

543
00:24:08.880 --> 00:24:09.880
<v Speaker 1>in use exactly.

544
00:24:09.920 --> 00:24:12.079
<v Speaker 2>They can dump the memory and then search through it

545
00:24:12.119 --> 00:24:12.920
<v Speaker 2>for credentials.

546
00:24:13.200 --> 00:24:16.279
<v Speaker 1>It's bypassing all the usual security stuff like file encryption.

547
00:24:17.000 --> 00:24:20.599
<v Speaker 2>Yeah, it's a powerful technique because they're getting the data

548
00:24:20.759 --> 00:24:23.680
<v Speaker 2>in its most vulnerable state. Wow. Okay, And there are

549
00:24:23.720 --> 00:24:26.519
<v Speaker 2>other memory based techniques too, like what they can abuse

550
00:24:26.559 --> 00:24:27.720
<v Speaker 2>logging mechanisms.

551
00:24:28.000 --> 00:24:28.880
<v Speaker 1>How does that work?

552
00:24:29.039 --> 00:24:33.119
<v Speaker 2>Well? Applications and systems often keep logs of what they're.

553
00:24:32.960 --> 00:24:35.119
<v Speaker 1>Doing, right, for debugging or auditing.

554
00:24:35.400 --> 00:24:40.279
<v Speaker 2>Yeah, but those logs can sometimes contain sensitive information oh okay,

555
00:24:40.400 --> 00:24:44.200
<v Speaker 2>like passwords or encryption keys. So red teams can manipulate

556
00:24:44.240 --> 00:24:46.000
<v Speaker 2>these logs to capture that data.

557
00:24:46.079 --> 00:24:48.079
<v Speaker 1>So they're turning logging, which is supposed to be a

558
00:24:48.119 --> 00:24:51.240
<v Speaker 1>security feature, into a vulnerability exactly.

559
00:24:51.319 --> 00:24:53.079
<v Speaker 2>They're turning the system against itself.

560
00:24:53.319 --> 00:24:55.519
<v Speaker 1>Are there any examples of this on Windows?

561
00:24:55.799 --> 00:24:59.319
<v Speaker 2>Yeah, there's something called event tracing for Windows or etw Okay,

562
00:25:00.000 --> 00:25:03.960
<v Speaker 2>developers create detailed logs, okay, but red teams can sometimes

563
00:25:04.039 --> 00:25:06.759
<v Speaker 2>hijack those logs and get passwords and encryption keys.

564
00:25:06.920 --> 00:25:09.559
<v Speaker 1>Wow. That's sneaky, it is. Yeah, it sounds like red

565
00:25:09.599 --> 00:25:11.240
<v Speaker 1>teams need to be incredibly creative.

566
00:25:11.359 --> 00:25:13.599
<v Speaker 2>Oh yeah, definitely, thinking outside the box's key.

567
00:25:13.799 --> 00:25:16.480
<v Speaker 1>Okay. Now, what about spoofing credential prompts? Is that something

568
00:25:16.519 --> 00:25:16.759
<v Speaker 1>they do.

569
00:25:16.880 --> 00:25:18.039
<v Speaker 2>Oh yeah, that's a classic.

570
00:25:18.160 --> 00:25:18.960
<v Speaker 1>How does that work?

571
00:25:19.200 --> 00:25:22.079
<v Speaker 2>They create fake login windows that look just like the

572
00:25:22.119 --> 00:25:25.240
<v Speaker 2>real ones? Oh wow, So the user thinks they're entering

573
00:25:25.279 --> 00:25:27.839
<v Speaker 2>their password into a legitimate.

574
00:25:27.359 --> 00:25:30.359
<v Speaker 1>System, but they're actually giving it to the attacker exactly.

575
00:25:30.400 --> 00:25:32.400
<v Speaker 1>And how do they deliver these fake prompts.

576
00:25:32.440 --> 00:25:35.480
<v Speaker 2>They might use phishing emails or malicious websites.

577
00:25:35.680 --> 00:25:39.359
<v Speaker 1>Oh so they're relying on people clicking on things they shouldn't.

578
00:25:39.640 --> 00:25:41.599
<v Speaker 2>Yeah, social engineering is a big part of it.

579
00:25:41.799 --> 00:25:44.880
<v Speaker 1>So even a security conscious person might fall for.

580
00:25:44.880 --> 00:25:47.839
<v Speaker 2>This absolutely if it's done well, it can be very convincing.

581
00:25:48.079 --> 00:25:50.640
<v Speaker 2>That's a little scary, Yeah it is. But there are

582
00:25:50.640 --> 00:25:53.440
<v Speaker 2>things you can do to protect yourself. What always double

583
00:25:53.519 --> 00:25:57.119
<v Speaker 2>check the url of any website that asks for your password.

584
00:25:57.240 --> 00:25:59.160
<v Speaker 1>Okay, yeah, make sure it's the real site.

585
00:25:59.279 --> 00:26:02.680
<v Speaker 2>Yeah. Wary of any unexpected prompts for your password.

586
00:26:03.240 --> 00:26:04.359
<v Speaker 1>Okay, good advice.

587
00:26:04.559 --> 00:26:05.000
<v Speaker 2>Yeah.

588
00:26:05.079 --> 00:26:08.519
<v Speaker 1>Now the book also mentions password spring.

589
00:26:08.519 --> 00:26:11.680
<v Speaker 2>Right, what's that? So it's a way to bypass a

590
00:26:11.720 --> 00:26:14.519
<v Speaker 2>lot of those brute force protections. Instead of trying a

591
00:26:14.559 --> 00:26:17.559
<v Speaker 2>ton of passwords against one account, Okay, they try a

592
00:26:17.599 --> 00:26:20.160
<v Speaker 2>few common passwords against a lot of accounts.

593
00:26:20.359 --> 00:26:22.920
<v Speaker 1>So it's like they're casting a wider net hoping to

594
00:26:23.119 --> 00:26:25.440
<v Speaker 1>catch those users who have weak passwords.

595
00:26:25.480 --> 00:26:27.640
<v Speaker 2>Exactly. Yeah, they might use a list of the top

596
00:26:27.680 --> 00:26:31.599
<v Speaker 2>one hundred most common passwords and try those against thousands

597
00:26:31.640 --> 00:26:32.200
<v Speaker 2>of accounts.

598
00:26:32.319 --> 00:26:36.359
<v Speaker 1>Oh so, because they're only trying a few passwords per account, right,

599
00:26:36.759 --> 00:26:39.039
<v Speaker 1>it's less likely to trigger any alarms.

600
00:26:39.279 --> 00:26:40.880
<v Speaker 2>Exactly, it flies under the radar.

601
00:26:41.240 --> 00:26:42.559
<v Speaker 1>Clever it is.

602
00:26:42.680 --> 00:26:46.000
<v Speaker 2>Yeah, but there's a good defense against this. What's that

603
00:26:46.240 --> 00:26:47.640
<v Speaker 2>multi factor authentication?

604
00:26:48.000 --> 00:26:50.079
<v Speaker 1>Oh right, that extra layer of security.

605
00:26:50.160 --> 00:26:51.960
<v Speaker 2>Yeah, even if they get the password, they still need

606
00:26:52.000 --> 00:26:52.799
<v Speaker 2>that second factor.

607
00:26:52.920 --> 00:26:53.960
<v Speaker 1>Okay, that makes sense.

608
00:26:54.079 --> 00:26:54.359
<v Speaker 2>Yeah.

609
00:26:54.440 --> 00:26:56.559
<v Speaker 1>Now we've talked a lot about the offensive side of

610
00:26:56.640 --> 00:27:00.400
<v Speaker 1>red teaming, right, but the book also talks about protecting

611
00:27:00.519 --> 00:27:01.920
<v Speaker 1>the red team themselves.

612
00:27:02.160 --> 00:27:03.720
<v Speaker 2>Yes, that's really important.

613
00:27:03.759 --> 00:27:05.720
<v Speaker 1>Why is that so important? I mean, there are the attackers.

614
00:27:05.720 --> 00:27:07.759
<v Speaker 1>Shouldn't they be able to protect themselves.

615
00:27:08.119 --> 00:27:11.200
<v Speaker 2>Well, they can become targets too, really, Yeah, they have

616
00:27:11.279 --> 00:27:15.119
<v Speaker 2>access to sensitive information, they use powerful tools, so other

617
00:27:15.160 --> 00:27:16.720
<v Speaker 2>attackers might try to go after them.

618
00:27:16.960 --> 00:27:21.039
<v Speaker 1>So they're like high value targets in the cybersecurity world.

619
00:27:21.160 --> 00:27:24.200
<v Speaker 2>Exactly. Yeah, so protecting them should be a top priority.

620
00:27:24.480 --> 00:27:27.119
<v Speaker 1>So what can you actually do to protect them?

621
00:27:27.400 --> 00:27:30.200
<v Speaker 2>It starts with the basics, you know, securing their machines.

622
00:27:30.279 --> 00:27:33.599
<v Speaker 1>Okay, so strong passwords, firewalls, all that good stuff.

623
00:27:33.680 --> 00:27:35.519
<v Speaker 2>Yeah, all the things we tell everyone else to do.

624
00:27:35.559 --> 00:27:37.079
<v Speaker 2>They need to do it too, right, and.

625
00:27:37.039 --> 00:27:39.559
<v Speaker 1>They shouldn't be using those machines for personal stuff.

626
00:27:39.640 --> 00:27:41.680
<v Speaker 2>Definitely not, that's just asking for trouble.

627
00:27:41.759 --> 00:27:46.359
<v Speaker 1>The book also mentions improving documentation. Right, why is that

628
00:27:46.400 --> 00:27:47.480
<v Speaker 1>important for security?

629
00:27:47.839 --> 00:27:51.079
<v Speaker 2>Well, it helps them keep track of what they're doing. Oh,

630
00:27:51.119 --> 00:27:53.960
<v Speaker 2>they can share information with each other, and it provides

631
00:27:54.000 --> 00:27:58.000
<v Speaker 2>evidence of their findings. So it's like an audit trail exactly,

632
00:27:58.200 --> 00:28:01.559
<v Speaker 2>and it can protect them if anyone ever questions their actions.

633
00:28:01.680 --> 00:28:03.680
<v Speaker 1>Oh right, it's like proof of what they did and

634
00:28:03.720 --> 00:28:06.680
<v Speaker 1>why they did it exactly. And one way to improve

635
00:28:06.759 --> 00:28:09.359
<v Speaker 1>documentation is to customize those shell prompts.

636
00:28:09.640 --> 00:28:10.720
<v Speaker 2>Yeah, that's a good one.

637
00:28:10.759 --> 00:28:12.599
<v Speaker 1>Can you explain what that is for people who might

638
00:28:12.680 --> 00:28:13.039
<v Speaker 1>not know.

639
00:28:13.400 --> 00:28:15.799
<v Speaker 2>So the shell prompt is that text you see on

640
00:28:15.839 --> 00:28:18.680
<v Speaker 2>the command line right where you type in commands. Okay.

641
00:28:18.839 --> 00:28:22.640
<v Speaker 2>Red teamers can customize it to include things like the date,

642
00:28:22.880 --> 00:28:26.519
<v Speaker 2>the time, the username, the host name, the directory they're in.

643
00:28:26.839 --> 00:28:30.200
<v Speaker 1>So it's automatically adding all this information to their commands.

644
00:28:30.319 --> 00:28:31.799
<v Speaker 2>Yeah. Basically, so if.

645
00:28:31.640 --> 00:28:35.160
<v Speaker 1>Someone needs to review their actions, it's all right there exactly.

646
00:28:35.240 --> 00:28:37.079
<v Speaker 2>It's like a built in log Okay.

647
00:28:37.279 --> 00:28:40.000
<v Speaker 1>What other tips does the book give for protecting the

648
00:28:40.039 --> 00:28:40.599
<v Speaker 1>Red team?

649
00:28:40.920 --> 00:28:43.519
<v Speaker 2>Well, monitoring log in attempts is a big one.

650
00:28:43.880 --> 00:28:46.039
<v Speaker 1>Okay. So if someone tries to log into their machine,

651
00:28:46.599 --> 00:28:48.279
<v Speaker 1>they'll get alerted exactly.

652
00:28:48.400 --> 00:28:50.680
<v Speaker 2>Yeah, especially if it's from a weird location or at

653
00:28:50.680 --> 00:28:51.359
<v Speaker 2>a strange time.

654
00:28:51.440 --> 00:28:52.359
<v Speaker 1>It's like a trip wire.

655
00:28:52.559 --> 00:28:53.599
<v Speaker 2>Yeah, you got it now.

656
00:28:53.640 --> 00:28:56.720
<v Speaker 1>I found it interesting that the book encourages Red teams

657
00:28:56.759 --> 00:28:58.039
<v Speaker 1>to learn from the Blue team.

658
00:28:58.200 --> 00:28:59.240
<v Speaker 2>Oh yeah, absolutely.

659
00:28:59.240 --> 00:29:00.440
<v Speaker 1>Why is that? Well?

660
00:29:00.559 --> 00:29:03.640
<v Speaker 2>Red teams and Blue teams often have very different perspectives.

661
00:29:03.839 --> 00:29:06.400
<v Speaker 1>Right, one's attacking, one's defending.

662
00:29:06.079 --> 00:29:08.039
<v Speaker 2>Exactly, but they can learn a lot from each other.

663
00:29:08.279 --> 00:29:11.720
<v Speaker 1>So breaking down those silos can actually make both sides stronger.

664
00:29:12.200 --> 00:29:16.039
<v Speaker 2>Definitely. Red teams can learn from the tools and strategies

665
00:29:16.119 --> 00:29:17.160
<v Speaker 2>that blue teams use.

666
00:29:17.480 --> 00:29:19.279
<v Speaker 1>Oh okay, how does that help them?

667
00:29:19.759 --> 00:29:24.640
<v Speaker 2>Well, for example, blue teams use something called centralized monitoring solutions.

668
00:29:24.759 --> 00:29:25.200
<v Speaker 1>Okay.

669
00:29:25.400 --> 00:29:28.359
<v Speaker 2>These collect security data from all over the organization.

670
00:29:28.559 --> 00:29:31.680
<v Speaker 1>Okay, so instead of looking at logs on individual machines,

671
00:29:32.240 --> 00:29:33.920
<v Speaker 1>you have everything in one place.

672
00:29:34.200 --> 00:29:36.000
<v Speaker 2>Exactly. It gives you a bird's eye view.

673
00:29:36.160 --> 00:29:38.880
<v Speaker 1>Okay, So how does this benefit the Red team.

674
00:29:39.519 --> 00:29:43.079
<v Speaker 2>Well, if they understand how these systems work, okay, they

675
00:29:43.079 --> 00:29:46.359
<v Speaker 2>can design attacks that are more likely to go undetected.

676
00:29:46.680 --> 00:29:48.680
<v Speaker 1>So it's like knowing how the enemy thinks, so you

677
00:29:48.680 --> 00:29:49.599
<v Speaker 1>can outsmart them.

678
00:29:49.680 --> 00:29:51.480
<v Speaker 2>Yeah, exactly, it's all about strategy.

679
00:29:51.640 --> 00:29:55.160
<v Speaker 1>What are some specific tools that the book recommends red

680
00:29:55.200 --> 00:29:56.359
<v Speaker 1>teams should learn.

681
00:29:56.799 --> 00:29:59.759
<v Speaker 2>Two big ones are Oscary and the Elastic Search Stack.

682
00:30:00.000 --> 00:30:01.599
<v Speaker 1>Okay, let's start with Oscary. What is that?

683
00:30:01.960 --> 00:30:03.319
<v Speaker 2>So? Oscary is really cool?

684
00:30:03.480 --> 00:30:03.759
<v Speaker 1>Okay.

685
00:30:03.960 --> 00:30:06.680
<v Speaker 2>It lets you query your operating system like it's a database.

686
00:30:06.920 --> 00:30:08.079
<v Speaker 1>Oh, interesting, and get.

687
00:30:07.960 --> 00:30:12.000
<v Speaker 2>All sorts of information like running processes, network connections, user accounts,

688
00:30:12.039 --> 00:30:13.039
<v Speaker 2>hardware details.

689
00:30:13.519 --> 00:30:17.279
<v Speaker 1>So it's like having this super powerful search engine for

690
00:30:17.359 --> 00:30:17.960
<v Speaker 1>your computer.

691
00:30:18.240 --> 00:30:19.559
<v Speaker 2>Yeah, that's a great way to put it.

692
00:30:19.960 --> 00:30:21.240
<v Speaker 1>How would a red team use it?

693
00:30:21.680 --> 00:30:24.640
<v Speaker 2>Well, they can use it for reconnaissance, uh, you know,

694
00:30:24.799 --> 00:30:27.799
<v Speaker 2>gathering information about the target system. But they can also

695
00:30:28.039 --> 00:30:31.880
<v Speaker 2>use it after they've compromised a system, oh, to dig

696
00:30:31.920 --> 00:30:33.720
<v Speaker 2>deeper and find new targets.

697
00:30:33.880 --> 00:30:36.200
<v Speaker 1>So it's useful at multiple stages of an attack.

698
00:30:36.319 --> 00:30:37.680
<v Speaker 2>Exactly, it's a versatile tool.

699
00:30:37.799 --> 00:30:39.920
<v Speaker 1>Okay. What about the Elastic Search Stack.

700
00:30:40.400 --> 00:30:43.160
<v Speaker 2>So, elastic search is a set of open source tools

701
00:30:43.200 --> 00:30:46.039
<v Speaker 2>for working with data. Okay, it's used a lot by

702
00:30:46.039 --> 00:30:49.759
<v Speaker 2>Blue teams for log management, security monitoring, threat hunting.

703
00:30:49.880 --> 00:30:51.680
<v Speaker 1>So it's about making sense of all that data.

704
00:30:51.880 --> 00:30:55.759
<v Speaker 2>Yeah, exactly. Security generates tons of data, and elastic search

705
00:30:55.759 --> 00:30:56.720
<v Speaker 2>helps you make sense of it.

706
00:30:57.160 --> 00:31:01.640
<v Speaker 1>Okay, So how can Red teams benefit from understanding elastic search.

707
00:31:02.359 --> 00:31:05.200
<v Speaker 2>Well, if they know how Blue teams use it to

708
00:31:05.279 --> 00:31:08.880
<v Speaker 2>detect attacks, Okay, they can figure out ways to avoid detection.

709
00:31:09.200 --> 00:31:11.680
<v Speaker 1>So it's like learning the enemy's playbook exactly.

710
00:31:11.720 --> 00:31:13.559
<v Speaker 2>You got to know their moves to counter them.

711
00:31:13.640 --> 00:31:18.400
<v Speaker 1>Now, let's move on to something I find really interesting. Sure, traps, deceptions,

712
00:31:18.440 --> 00:31:19.359
<v Speaker 1>and honey pots.

713
00:31:19.680 --> 00:31:20.960
<v Speaker 2>Oh yeah, those are fun.

714
00:31:21.000 --> 00:31:22.359
<v Speaker 1>They're all about deception.

715
00:31:22.160 --> 00:31:25.480
<v Speaker 2>Right exactly, you're trying to trick the attackers into revealing themselves.

716
00:31:25.599 --> 00:31:27.319
<v Speaker 1>Okay, can you give me some concrete example.

717
00:31:27.440 --> 00:31:30.640
<v Speaker 2>Sure, So a honeypot file okay, is basically a fake

718
00:31:30.720 --> 00:31:33.279
<v Speaker 2>file that looks like it has valuable.

719
00:31:32.880 --> 00:31:36.519
<v Speaker 1>Information okay, like passwords or financial data.

720
00:31:36.759 --> 00:31:39.480
<v Speaker 2>Yeah, something that an attacker would be interested in, right,

721
00:31:39.559 --> 00:31:41.519
<v Speaker 2>and you place it somewhere they're likely to look.

722
00:31:41.640 --> 00:31:42.640
<v Speaker 1>So it's like bait.

723
00:31:43.200 --> 00:31:45.640
<v Speaker 2>Exactly, And when they take the bait and open the file,

724
00:31:46.240 --> 00:31:47.240
<v Speaker 2>it triggers an alert.

725
00:31:47.799 --> 00:31:50.279
<v Speaker 1>Oh so you know someone snooping around exactly.

726
00:31:50.400 --> 00:31:50.640
<v Speaker 2>Yeah.

727
00:31:50.799 --> 00:31:53.559
<v Speaker 1>No. What about traps? Are they different from honeypot files?

728
00:31:53.920 --> 00:31:56.480
<v Speaker 2>Yeah, traps are more active. They might be scripts or

729
00:31:56.519 --> 00:32:00.920
<v Speaker 2>programs that execute when an attacker does something specific, so.

730
00:32:00.960 --> 00:32:03.440
<v Speaker 1>Like trying to access a certain file.

731
00:32:03.559 --> 00:32:05.839
<v Speaker 2>Yeah exactly, it's like a trip wire okay, And when

732
00:32:05.880 --> 00:32:09.079
<v Speaker 2>the trap is triggered, it logs what they did, maybe

733
00:32:09.079 --> 00:32:10.319
<v Speaker 2>even blocks their access.

734
00:32:10.599 --> 00:32:13.480
<v Speaker 1>So it's not just detecting them, it's actually doing something to.

735
00:32:13.440 --> 00:32:15.319
<v Speaker 2>Stop them, right, it's more defensive.

736
00:32:15.440 --> 00:32:17.160
<v Speaker 1>What about deceptions, how do those work?

737
00:32:17.279 --> 00:32:21.319
<v Speaker 2>Well? You create fake assets that look real okay, like

738
00:32:21.480 --> 00:32:25.119
<v Speaker 2>a decoy web server, a fake database, even a made

739
00:32:25.200 --> 00:32:26.200
<v Speaker 2>up user account.

740
00:32:26.279 --> 00:32:28.319
<v Speaker 1>So you're trying to distract them, lead them down the

741
00:32:28.359 --> 00:32:29.599
<v Speaker 1>wrong path exactly.

742
00:32:29.640 --> 00:32:31.119
<v Speaker 2>You want to waste their time and get them away

743
00:32:31.119 --> 00:32:31.960
<v Speaker 2>from the real stuff.

744
00:32:32.000 --> 00:32:35.559
<v Speaker 1>So once you've set up these traps and honeypots and everything,

745
00:32:35.960 --> 00:32:37.799
<v Speaker 1>how do you actually monitor them?

746
00:32:37.920 --> 00:32:41.839
<v Speaker 2>Well, operating systems have arditing features okay, what are those?

747
00:32:41.960 --> 00:32:46.759
<v Speaker 2>They track certain events like file access, process creation, network connections.

748
00:32:46.880 --> 00:32:47.279
<v Speaker 1>Okay.

749
00:32:47.880 --> 00:32:50.319
<v Speaker 2>You can use these features to watch the decoys and

750
00:32:50.359 --> 00:32:51.759
<v Speaker 2>see if anyone interacts with them.

751
00:32:52.039 --> 00:32:54.920
<v Speaker 1>So you're looking for any signs that someone is touching something.

752
00:32:54.960 --> 00:32:55.559
<v Speaker 1>They shouldn't.

753
00:32:55.680 --> 00:32:58.240
<v Speaker 2>Exactly, you're looking for those red flags on Windows?

754
00:32:58.279 --> 00:32:59.000
<v Speaker 1>How would you do that?

755
00:32:59.240 --> 00:33:02.920
<v Speaker 2>You can use the security audit policy okay, and set

756
00:33:02.920 --> 00:33:06.240
<v Speaker 2>it to track specific events, so if someone tries to

757
00:33:06.240 --> 00:33:08.640
<v Speaker 2>open a honeypot file, you'll see it in the logs.

758
00:33:09.160 --> 00:33:12.960
<v Speaker 1>What about on other systems like mac os and Linux?

759
00:33:13.319 --> 00:33:16.759
<v Speaker 2>They have similar features. Mac Os has audit policies okay,

760
00:33:16.799 --> 00:33:18.720
<v Speaker 2>and Linux has audit So no.

761
00:33:18.640 --> 00:33:21.599
<v Speaker 1>Matter what system you're using, you can monitor these decoys.

762
00:33:21.720 --> 00:33:22.480
<v Speaker 2>Yeah you can.

763
00:33:22.519 --> 00:33:24.200
<v Speaker 1>Are there any tools that can help with this?

764
00:33:24.400 --> 00:33:26.400
<v Speaker 2>Oh yeah, tons of them. They are open source tools,

765
00:33:26.440 --> 00:33:31.519
<v Speaker 2>commercial tools, things like the Elastic Search Stack, Splunk Oscary, so.

766
00:33:31.480 --> 00:33:34.079
<v Speaker 1>They can analyze all those logs and alert you if

767
00:33:34.079 --> 00:33:35.240
<v Speaker 1>something suspicious happen.

768
00:33:35.359 --> 00:33:37.079
<v Speaker 2>Exactly. They make your life a lot easier.

769
00:33:37.240 --> 00:33:40.680
<v Speaker 1>So you've set up your honeypot file, you're monitoring it.

770
00:33:41.400 --> 00:33:43.559
<v Speaker 1>How do you actually get alerted if someone tries to

771
00:33:43.559 --> 00:33:44.000
<v Speaker 1>open it?

772
00:33:44.400 --> 00:33:48.200
<v Speaker 2>Well, the good old fashioned email is still reliable, okay.

773
00:33:48.400 --> 00:33:51.960
<v Speaker 2>Most people check their email regularly. It's a simple way

774
00:33:51.960 --> 00:33:53.039
<v Speaker 2>to send notifications.

775
00:33:53.480 --> 00:33:55.519
<v Speaker 1>But there are other ways too, right.

776
00:33:55.400 --> 00:33:58.839
<v Speaker 2>Oh yeah, you can use desktop notifications okay, those pop

777
00:33:58.880 --> 00:34:01.160
<v Speaker 2>up messages you see on your screen, they're hard to

778
00:34:01.200 --> 00:34:03.720
<v Speaker 2>mess there's a little alarm going on, exactly. Yeah.

779
00:34:03.839 --> 00:34:07.319
<v Speaker 1>You can also tie those alerts into something called SIME systems.

780
00:34:07.839 --> 00:34:11.599
<v Speaker 2>Right. What are so SIM stands for Security Information and

781
00:34:11.639 --> 00:34:12.519
<v Speaker 2>Event Management.

782
00:34:12.800 --> 00:34:13.079
<v Speaker 1>Okay.

783
00:34:13.199 --> 00:34:16.320
<v Speaker 2>They're systems that collect and analyze security data from all

784
00:34:16.360 --> 00:34:20.079
<v Speaker 2>over the place. Okay, and they can trigger automated responses. Oh.

785
00:34:20.159 --> 00:34:20.679
<v Speaker 1>Interesting.

786
00:34:20.800 --> 00:34:24.960
<v Speaker 2>So let's say someone accesses your honeypot file, the SIGN

787
00:34:25.079 --> 00:34:27.719
<v Speaker 2>system could automatically block their IP address.

788
00:34:28.000 --> 00:34:29.559
<v Speaker 1>Oh wow, that's impressive.

789
00:34:29.800 --> 00:34:32.480
<v Speaker 2>Yeah, it's really powerful for containing attacks quickly.

790
00:34:32.639 --> 00:34:35.480
<v Speaker 1>It's like having a digital security guard that reacts instantly.

791
00:34:35.800 --> 00:34:37.000
<v Speaker 2>Yeah, that's a good analogy.

792
00:34:37.039 --> 00:34:39.440
<v Speaker 1>Now, we talked about how red teams can learn from

793
00:34:39.480 --> 00:34:44.719
<v Speaker 1>blue teams by understanding those centralized monitoring solutions. Can you

794
00:34:44.760 --> 00:34:46.920
<v Speaker 1>give me some more specifics on how that helps them

795
00:34:47.039 --> 00:34:47.920
<v Speaker 1>be more effective?

796
00:34:48.239 --> 00:34:50.679
<v Speaker 2>Sure? So, one thing they can learn is how to

797
00:34:50.679 --> 00:34:52.800
<v Speaker 2>blend in with normal network traffic.

798
00:34:53.159 --> 00:34:53.559
<v Speaker 1>Okay.

799
00:34:53.719 --> 00:34:56.599
<v Speaker 2>They can make their attacks look less suspicious so they

800
00:34:56.599 --> 00:34:59.280
<v Speaker 2>don't stand out. Exactly. They can also learn how to

801
00:34:59.360 --> 00:35:02.400
<v Speaker 2>modify law files oh wow, to cover.

802
00:35:02.280 --> 00:35:04.320
<v Speaker 1>Their tracks so it's like they are never there.

803
00:35:04.440 --> 00:35:08.039
<v Speaker 2>Right, And they can even find ways to exploit weaknesses

804
00:35:08.039 --> 00:35:09.199
<v Speaker 2>in those monitoring tools.

805
00:35:09.559 --> 00:35:11.000
<v Speaker 1>It's like turning the tables.

806
00:35:11.320 --> 00:35:13.400
<v Speaker 2>Yeah, it's all about knowing how the other side thinks.

807
00:35:14.119 --> 00:35:17.679
<v Speaker 1>Now, could Red teams actually use those same tools that

808
00:35:17.840 --> 00:35:20.440
<v Speaker 1>blue teams use to protect their own infrastructure?

809
00:35:20.719 --> 00:35:24.280
<v Speaker 2>Absolutely, they can, really. Yeah. They might use oscary to

810
00:35:24.360 --> 00:35:27.400
<v Speaker 2>monitor their own systems okay, to make sure nobody's trying

811
00:35:27.400 --> 00:35:29.880
<v Speaker 2>to attack them, right, And they might use elastic search

812
00:35:29.920 --> 00:35:31.159
<v Speaker 2>to analyze their own logs.

813
00:35:31.760 --> 00:35:34.800
<v Speaker 1>So it's like using the enemy's weapons against them.

814
00:35:35.159 --> 00:35:36.079
<v Speaker 2>Yeah, in a way.

815
00:35:36.159 --> 00:35:38.599
<v Speaker 1>But it also shows that both teams are really working

816
00:35:38.599 --> 00:35:40.119
<v Speaker 1>towards the same goal exactly.

817
00:35:40.320 --> 00:35:41.840
<v Speaker 2>They both want to improve security.

818
00:35:42.199 --> 00:35:45.039
<v Speaker 1>Okay. Now we focus a lot on the technical side, right,

819
00:35:45.079 --> 00:35:48.519
<v Speaker 1>but the book also emphasizes the human element.

820
00:35:48.920 --> 00:35:50.079
<v Speaker 2>Yeah, that's crucial.

821
00:35:50.239 --> 00:35:52.320
<v Speaker 1>What are some of the things to consider when it

822
00:35:52.320 --> 00:35:55.159
<v Speaker 1>comes to the people involved in red teaming?

823
00:35:55.440 --> 00:35:57.719
<v Speaker 2>Well, the Red team needs to be aware of the

824
00:35:57.880 --> 00:36:00.559
<v Speaker 2>impact their actions can have other people targeting.

825
00:36:00.920 --> 00:36:01.679
<v Speaker 1>Okay, what do you mean.

826
00:36:01.840 --> 00:36:05.280
<v Speaker 2>These exercises can be stressful, you know, right, so falls

827
00:36:05.320 --> 00:36:06.960
<v Speaker 2>for a phishing attack, they might feel.

828
00:36:06.719 --> 00:36:09.360
<v Speaker 1>Embarrassed, right, they might feel like they failed.

829
00:36:09.400 --> 00:36:11.920
<v Speaker 2>Exactly, So it's important to do these exercises in a

830
00:36:11.960 --> 00:36:14.119
<v Speaker 2>way that minimizes that negative impact.

831
00:36:14.280 --> 00:36:16.719
<v Speaker 1>So be sensitive and provide support afterwards.

832
00:36:16.760 --> 00:36:18.920
<v Speaker 2>Yeah, exactly. You want to help people learn from the experience.

833
00:36:18.960 --> 00:36:21.199
<v Speaker 1>Okay. Now what about the Red Team members themselves?

834
00:36:21.360 --> 00:36:25.760
<v Speaker 2>Right, So they're also vulnerable. They're under pressure, they handle

835
00:36:25.800 --> 00:36:28.639
<v Speaker 2>sensitive information, they use powerful.

836
00:36:28.199 --> 00:36:30.559
<v Speaker 1>Tools, so they could be targeted by attackers.

837
00:36:30.639 --> 00:36:35.760
<v Speaker 2>Absolutely, they could be victims of social engineering, phishing, even blackmail.

838
00:36:36.000 --> 00:36:37.239
<v Speaker 1>So you need to protect them too.

839
00:36:37.679 --> 00:36:40.440
<v Speaker 2>Exactly how do you do that? Security awareness training is

840
00:36:40.519 --> 00:36:43.239
<v Speaker 2>really important, Okay. They need to know how to spot

841
00:36:43.360 --> 00:36:44.639
<v Speaker 2>and avoid those threats.

842
00:36:44.840 --> 00:36:47.920
<v Speaker 1>So training that's tailored to the risks they face.

843
00:36:48.079 --> 00:36:48.679
<v Speaker 2>Yeah, exactly.

844
00:36:48.719 --> 00:36:49.519
<v Speaker 1>What else can you do?

845
00:36:49.639 --> 00:36:53.719
<v Speaker 2>Give them ways to report suspicious activity okay, and to

846
00:36:53.840 --> 00:36:55.119
<v Speaker 2>seek help if they need it.

847
00:36:55.320 --> 00:36:58.599
<v Speaker 1>So it's about creating a culture of security that includes

848
00:36:59.039 --> 00:37:00.599
<v Speaker 1>the Red Team exactly.

849
00:37:00.760 --> 00:37:01.960
<v Speaker 2>They need to feel supported.

850
00:37:02.039 --> 00:37:04.639
<v Speaker 1>Now, one of the biggest challenges in cybersecurity is staying

851
00:37:04.639 --> 00:37:05.360
<v Speaker 1>ahead of the curve.

852
00:37:05.519 --> 00:37:06.599
<v Speaker 2>Oh yeah, definitely.

853
00:37:06.679 --> 00:37:09.400
<v Speaker 1>How can Red Teams keep up with all the new

854
00:37:09.559 --> 00:37:11.000
<v Speaker 1>threats and vulnerabilities?

855
00:37:11.280 --> 00:37:14.360
<v Speaker 2>Well, one way is to be active in the security community. Okay,

856
00:37:14.400 --> 00:37:18.679
<v Speaker 2>you know, go to conferences, read blogs, participate in online forums.

857
00:37:18.679 --> 00:37:22.320
<v Speaker 2>So learn from other people exactly, and share your own

858
00:37:22.360 --> 00:37:23.239
<v Speaker 2>knowledge too.

859
00:37:23.159 --> 00:37:25.159
<v Speaker 1>Right, it's a two way street, it is. Yeah, what

860
00:37:25.239 --> 00:37:25.960
<v Speaker 1>else can they do?

861
00:37:26.199 --> 00:37:28.400
<v Speaker 2>They need to develop their own tools and techniques.

862
00:37:28.639 --> 00:37:30.199
<v Speaker 1>Okay. Why is that so important?

863
00:37:30.280 --> 00:37:33.199
<v Speaker 2>Because the attacks are always changing, right, If you just

864
00:37:33.599 --> 00:37:36.800
<v Speaker 2>rely on the existing tools, you'll be fall behind.

865
00:37:36.960 --> 00:37:38.880
<v Speaker 1>So you need to be innovative exactly.

866
00:37:38.920 --> 00:37:40.480
<v Speaker 2>You need to think like an attacker.

867
00:37:41.079 --> 00:37:42.960
<v Speaker 1>Now that sounds really challenging.

868
00:37:43.280 --> 00:37:46.039
<v Speaker 2>It is, yeah, but it's also really rewarding.

869
00:37:46.239 --> 00:37:47.920
<v Speaker 1>What kind of skills do you need to be a

870
00:37:47.960 --> 00:37:49.119
<v Speaker 1>good RED tumor.

871
00:37:49.159 --> 00:37:52.800
<v Speaker 2>Well, obviously you need strong technical skills okay, like what

872
00:37:53.199 --> 00:37:58.760
<v Speaker 2>understanding operating systems, networks, programming, But you also need creativity

873
00:37:59.000 --> 00:38:00.480
<v Speaker 2>and problem solving skills.

874
00:38:00.599 --> 00:38:03.119
<v Speaker 1>You need to be able to think outside the box exactly.

875
00:38:03.159 --> 00:38:05.039
<v Speaker 2>You need to see things that other people miss.

876
00:38:05.239 --> 00:38:07.039
<v Speaker 1>And I imagine teamwork is important too.

877
00:38:07.400 --> 00:38:09.400
<v Speaker 2>Oh yeah, crucial. You can't do this alone.

878
00:38:09.480 --> 00:38:12.519
<v Speaker 1>You need to be able to communicate, share knowledge, learn

879
00:38:12.559 --> 00:38:13.119
<v Speaker 1>from each other.

880
00:38:13.239 --> 00:38:14.159
<v Speaker 2>Absolutely. Yeah.

881
00:38:14.320 --> 00:38:17.880
<v Speaker 1>Now, one specific area that RED teams often target is

882
00:38:18.199 --> 00:38:21.920
<v Speaker 1>active directory. Right, what is that and why is it

883
00:38:21.920 --> 00:38:23.480
<v Speaker 1>such a popular target? So?

884
00:38:23.599 --> 00:38:28.280
<v Speaker 2>Active directory is MICROSOFTS Directory service for Windows networks.

885
00:38:28.360 --> 00:38:28.679
<v Speaker 1>Okay.

886
00:38:28.920 --> 00:38:34.039
<v Speaker 2>It's basically a database that stores info about users, computers,

887
00:38:34.360 --> 00:38:38.719
<v Speaker 2>other resources. Okay, and it handles authentication and authorization, so

888
00:38:38.760 --> 00:38:40.559
<v Speaker 2>it controls who has access.

889
00:38:40.199 --> 00:38:43.280
<v Speaker 1>To what it's like the central nervous system of the network.

890
00:38:43.400 --> 00:38:44.639
<v Speaker 2>Yeah, that's a great way to put it.

891
00:38:44.679 --> 00:38:46.920
<v Speaker 1>And if you control active directory, you control.

892
00:38:46.639 --> 00:38:48.360
<v Speaker 2>Everything pretty much. Yeah.

893
00:38:48.400 --> 00:38:51.000
<v Speaker 1>So what are some of the tactics that red teams

894
00:38:51.119 --> 00:38:52.039
<v Speaker 1>use to attack it?

895
00:38:52.559 --> 00:38:55.960
<v Speaker 2>One common one is credential dumping okay. They use tools

896
00:38:55.960 --> 00:38:59.559
<v Speaker 2>to extract passwords from the database okay, and they also

897
00:38:59.639 --> 00:39:02.920
<v Speaker 2>try to exploit vulnerabilities in the services that act to

898
00:39:03.000 --> 00:39:05.239
<v Speaker 2>directory uses, like herberos.

899
00:39:05.079 --> 00:39:08.199
<v Speaker 1>So they're finding ways to bypass the security exactly.

900
00:39:08.199 --> 00:39:09.440
<v Speaker 2>They're looking for weaknesses.

901
00:39:09.519 --> 00:39:12.840
<v Speaker 1>Another tactic you mentioned is privilege escalation. What's that?

902
00:39:13.159 --> 00:39:15.840
<v Speaker 2>So that's where they try to gain higher levels of

903
00:39:15.920 --> 00:39:19.960
<v Speaker 2>access Okay. They might start with a regular user account okay,

904
00:39:20.159 --> 00:39:24.239
<v Speaker 2>but they use various techniques to try to get administrator privileges.

905
00:39:24.840 --> 00:39:27.159
<v Speaker 1>So they're working their way up the ladder exactly.

906
00:39:27.360 --> 00:39:29.800
<v Speaker 2>Yeah, and once they're an administrator, they can do pretty

907
00:39:29.880 --> 00:39:30.400
<v Speaker 2>much anything.

908
00:39:30.559 --> 00:39:34.000
<v Speaker 1>That's scary, yeah it is. So what can organizations do

909
00:39:34.159 --> 00:39:36.519
<v Speaker 1>to protect their active directory?

910
00:39:37.159 --> 00:39:41.320
<v Speaker 2>Strong passwords, multi factor authentication, keep everything.

911
00:39:41.039 --> 00:39:42.679
<v Speaker 1>Patched, the usual stuff.

912
00:39:42.760 --> 00:39:44.360
<v Speaker 2>Yeah, it's basic but important.

913
00:39:44.480 --> 00:39:44.719
<v Speaker 1>Right.

914
00:39:45.159 --> 00:39:48.360
<v Speaker 2>They can also segment their network okay, so if one

915
00:39:48.360 --> 00:39:50.840
<v Speaker 2>part gets compromised, it doesn't affect the whole thing.

916
00:39:51.039 --> 00:39:54.079
<v Speaker 1>So it's about limiting the damage exactly. Now a lot

917
00:39:54.119 --> 00:39:56.119
<v Speaker 1>of organizations are moving to the cloud.

918
00:39:56.440 --> 00:39:57.519
<v Speaker 2>Yeah, that's a big trend.

919
00:39:57.679 --> 00:40:00.519
<v Speaker 1>What are some of the unique challenges for RED teams

920
00:40:00.559 --> 00:40:02.360
<v Speaker 1>when it comes to cloud security.

921
00:40:03.000 --> 00:40:06.360
<v Speaker 2>Well, one big difference is the shared responsibility model. Okay,

922
00:40:06.559 --> 00:40:10.079
<v Speaker 2>the cloud provider is responsible for some things and the

923
00:40:10.159 --> 00:40:12.000
<v Speaker 2>customer is responsible for others.

924
00:40:12.280 --> 00:40:13.280
<v Speaker 1>So it's a partnership.

925
00:40:13.559 --> 00:40:14.679
<v Speaker 2>Yeah, but it can get.

926
00:40:14.559 --> 00:40:16.320
<v Speaker 1>Confusing, right, who's in charge of what?

927
00:40:16.719 --> 00:40:20.559
<v Speaker 2>Exactly? So RED teams need to understand that to test

928
00:40:20.719 --> 00:40:21.519
<v Speaker 2>things properly.

929
00:40:21.920 --> 00:40:24.639
<v Speaker 1>It's like sharing an apartment. You need to know who's

930
00:40:24.639 --> 00:40:25.760
<v Speaker 1>supposed to clean what.

931
00:40:26.119 --> 00:40:27.199
<v Speaker 2>Yeah, that's a good analogy.

932
00:40:27.239 --> 00:40:28.440
<v Speaker 1>What other challenges are there?

933
00:40:28.639 --> 00:40:32.920
<v Speaker 2>Well, cloud environments are constantly changing. Resources can be created

934
00:40:33.039 --> 00:40:34.280
<v Speaker 2>and deleted very quickly.

935
00:40:34.519 --> 00:40:36.199
<v Speaker 1>Oh wow, so it's like trying to hit a moving

936
00:40:36.199 --> 00:40:37.239
<v Speaker 1>target exactly.

937
00:40:37.280 --> 00:40:40.360
<v Speaker 2>Yeah. RED teams need to adapt their tools and techniques.

938
00:40:40.440 --> 00:40:41.760
<v Speaker 1>What are some of the tools they use.

939
00:40:42.039 --> 00:40:46.679
<v Speaker 2>Well, one important one is Cloud Security Posture Management or CSPM.

940
00:40:46.880 --> 00:40:47.559
<v Speaker 1>Okay, what's that.

941
00:40:47.760 --> 00:40:51.280
<v Speaker 2>It's a tool that helps organizations assess their cloud security.

942
00:40:51.519 --> 00:40:51.880
<v Speaker 1>Okay.

943
00:40:51.960 --> 00:40:55.519
<v Speaker 2>It looks for misconfigurations and vulnerabilities.

944
00:40:54.800 --> 00:40:56.599
<v Speaker 1>So it's like an automated security check.

945
00:40:57.440 --> 00:40:59.360
<v Speaker 2>Yeah, that's a good way to think about it and.

946
00:40:59.280 --> 00:41:00.559
<v Speaker 1>How to red team use it.

947
00:41:01.400 --> 00:41:04.320
<v Speaker 2>They use it to find weaknesses okay, and then they

948
00:41:04.320 --> 00:41:07.159
<v Speaker 2>design at tax that exploit those weaknesses.

949
00:41:07.239 --> 00:41:09.840
<v Speaker 1>So they're finding the cracks in the armor exactly.

950
00:41:09.960 --> 00:41:11.440
<v Speaker 2>They're looking for the easy ways in.

951
00:41:11.719 --> 00:41:14.880
<v Speaker 1>What other techniques do they use, Well, there's cloud penetration testing.

952
00:41:15.039 --> 00:41:19.039
<v Speaker 2>It's like regular penetration testing, right, but specifically for cloud environments.

953
00:41:19.519 --> 00:41:22.280
<v Speaker 1>Okay, but the cloud is so different you must need

954
00:41:22.320 --> 00:41:23.400
<v Speaker 1>special skills for that.

955
00:41:23.639 --> 00:41:29.159
<v Speaker 2>Oh yeah, definitely, you need to understand things like serverleist, computing, containerization,

956
00:41:30.119 --> 00:41:30.800
<v Speaker 2>micro services.

957
00:41:30.840 --> 00:41:33.679
<v Speaker 1>There's a whole different set of technologies it is. Yeah, Now,

958
00:41:33.679 --> 00:41:36.719
<v Speaker 1>I know this field is always changing, right, What are

959
00:41:36.800 --> 00:41:39.840
<v Speaker 1>some of the emerging trends in red teaming that we

960
00:41:39.880 --> 00:41:40.719
<v Speaker 1>should keep an eye on.

961
00:41:41.239 --> 00:41:44.639
<v Speaker 2>Well, one big one is automation, Okay. Red teams are

962
00:41:44.639 --> 00:41:46.639
<v Speaker 2>automating more and more tasks.

963
00:41:46.719 --> 00:41:48.639
<v Speaker 1>So they can do more in less time.

964
00:41:48.880 --> 00:41:54.239
<v Speaker 2>Exactly. They can scan for vulnerabilities faster, develop exploits quicker.

965
00:41:54.440 --> 00:41:55.639
<v Speaker 1>So it's all about efficiency.

966
00:41:55.800 --> 00:42:00.280
<v Speaker 2>Yeah. Basically, thread intelligence is becoming more important okay. Red

967
00:42:00.320 --> 00:42:03.199
<v Speaker 2>teams are using it to make their attacks more realistic.

968
00:42:03.400 --> 00:42:06.960
<v Speaker 1>Okay, so they're tailoring their attacks to mimic real world threats.

969
00:42:07.239 --> 00:42:07.719
<v Speaker 2>Exactly.

970
00:42:07.800 --> 00:42:10.840
<v Speaker 1>Yeah, they're learning from what the bad guys are actually.

971
00:42:10.519 --> 00:42:13.199
<v Speaker 2>Doing, right, that makes their exercises more valuable.

972
00:42:13.280 --> 00:42:14.519
<v Speaker 1>Okay, any other trends.

973
00:42:14.719 --> 00:42:17.719
<v Speaker 2>Artificial intelligence is starting to play a role, Oh wow,

974
00:42:17.880 --> 00:42:20.679
<v Speaker 2>really Yeah, it's early days, okay, but Red teams are

975
00:42:20.760 --> 00:42:26.559
<v Speaker 2>using AI to automate tasks, analyze data, even create new attacks.

976
00:42:26.760 --> 00:42:29.400
<v Speaker 1>So it's like AI is becoming a tool for both

977
00:42:29.440 --> 00:42:31.119
<v Speaker 1>the attackers and the defenders.

978
00:42:31.199 --> 00:42:33.800
<v Speaker 2>Exactly. Yeah, it's going to change the game. What else,

979
00:42:33.920 --> 00:42:36.679
<v Speaker 2>attack surface management is becoming a bigger focus.

980
00:42:36.760 --> 00:42:37.159
<v Speaker 1>What's that.

981
00:42:37.519 --> 00:42:41.119
<v Speaker 2>It's about reducing the number of ways that an attacker

982
00:42:41.159 --> 00:42:44.920
<v Speaker 2>can get in Okay. Red teams can help organizations identify

983
00:42:44.960 --> 00:42:47.400
<v Speaker 2>those weaknesses and prioritize them.

984
00:42:47.599 --> 00:42:50.639
<v Speaker 1>So it's about being proactive, not just waiting for an

985
00:42:50.639 --> 00:42:51.480
<v Speaker 1>attack to happen.

986
00:42:51.800 --> 00:42:56.000
<v Speaker 2>Exactly. Yeah. And finally, purple teaming is gaining more traction.

987
00:42:55.960 --> 00:42:58.360
<v Speaker 1>Right where the Red team and Blue team work together.

988
00:42:58.639 --> 00:43:00.800
<v Speaker 2>Yeah, they share knowledge, they learn from each other.

989
00:43:00.679 --> 00:43:03.480
<v Speaker 1>So it's a more collaborative approach to security.

990
00:43:03.639 --> 00:43:06.239
<v Speaker 2>Exactly. It's about breaking down those silos and working as

991
00:43:06.239 --> 00:43:06.599
<v Speaker 2>a team.

992
00:43:07.159 --> 00:43:09.000
<v Speaker 1>That makes a lot of sense. Yeah, Now, This has

993
00:43:09.039 --> 00:43:10.559
<v Speaker 1>been a really fascinating discussion.

994
00:43:10.719 --> 00:43:11.000
<v Speaker 2>Thanks.

995
00:43:11.039 --> 00:43:12.960
<v Speaker 1>I'm sure our listeners have learned a lot, I hope so.

996
00:43:13.119 --> 00:43:15.159
<v Speaker 1>But for someone who might be new to all this,

997
00:43:15.960 --> 00:43:18.199
<v Speaker 1>what's the one key takeaway they should remember?

998
00:43:19.000 --> 00:43:22.519
<v Speaker 2>Security is a journey, not a destination. Okay, there's no

999
00:43:22.599 --> 00:43:26.519
<v Speaker 2>such thing as perfect security. It's about constantly evaluating your risks,

1000
00:43:26.840 --> 00:43:29.559
<v Speaker 2>finding your weaknesses, and improving your defenses.

1001
00:43:29.800 --> 00:43:31.760
<v Speaker 1>So it's about being proactive exactly.

1002
00:43:31.880 --> 00:43:33.199
<v Speaker 2>Yeah, always be one step ahead.

1003
00:43:33.239 --> 00:43:35.440
<v Speaker 1>It's a continuous process of improvement.

1004
00:43:35.599 --> 00:43:37.599
<v Speaker 2>Yeah, and red teaming is a big part of that.

1005
00:43:38.039 --> 00:43:41.599
<v Speaker 1>Now, what about organizations that are thinking, Okay, this all

1006
00:43:41.639 --> 00:43:44.960
<v Speaker 1>sounds great, but we can't afford a dedicated red team.

1007
00:43:45.159 --> 00:43:47.719
<v Speaker 2>You don't necessarily need a full blown team to get started.

1008
00:43:47.840 --> 00:43:50.000
<v Speaker 1>Okay, what would you recommend them start.

1009
00:43:49.760 --> 00:43:51.280
<v Speaker 2>By just thinking like a red teamer?

1010
00:43:51.920 --> 00:43:52.599
<v Speaker 1>How do you do that?

1011
00:43:52.960 --> 00:43:55.679
<v Speaker 2>Look at your own security with a critical eye, ask

1012
00:43:55.719 --> 00:43:58.639
<v Speaker 2>yourself those tough questions like what what are the things

1013
00:43:58.679 --> 00:44:01.360
<v Speaker 2>you really need to protect? Okay, how would someone try

1014
00:44:01.360 --> 00:44:04.679
<v Speaker 2>to attack you? Where are the weak spots in your defenses?

1015
00:44:05.000 --> 00:44:07.079
<v Speaker 1>So put yourself in the attacker shoes.

1016
00:44:07.199 --> 00:44:09.199
<v Speaker 2>Exactly, see things from their perspective.

1017
00:44:09.320 --> 00:44:10.880
<v Speaker 1>You don't need fancy tools.

1018
00:44:10.559 --> 00:44:13.360
<v Speaker 2>For that right, not at all. There are free tools

1019
00:44:13.400 --> 00:44:16.639
<v Speaker 2>out there, open source scanners, penetration testing tools.

1020
00:44:16.719 --> 00:44:18.840
<v Speaker 1>She can get started without spending a lot of money.

1021
00:44:19.159 --> 00:44:24.239
<v Speaker 2>Yeah, you do. Stay informed, that's huge, Okay. Read security blogs,

1022
00:44:24.679 --> 00:44:26.199
<v Speaker 2>go to webinars, follow the.

1023
00:44:26.199 --> 00:44:29.079
<v Speaker 1>Experts, keep up with the latest threats.

1024
00:44:29.239 --> 00:44:30.960
<v Speaker 2>Exactly. Knowledge is power.

1025
00:44:31.199 --> 00:44:33.000
<v Speaker 1>So it's about continuous learning.

1026
00:44:33.400 --> 00:44:34.639
<v Speaker 2>Yeah, always be learning.

1027
00:44:34.719 --> 00:44:37.519
<v Speaker 1>This has been a really insightful conversation. Have Yeah, I'm

1028
00:44:37.519 --> 00:44:40.000
<v Speaker 1>sure our listeners have a lot to think about, hopefully,

1029
00:44:40.039 --> 00:44:42.679
<v Speaker 1>but before we go, what's the one thing you'd like

1030
00:44:42.719 --> 00:44:45.639
<v Speaker 1>them to remember? The most important takeaway from the book.

1031
00:44:46.320 --> 00:44:49.559
<v Speaker 2>Red Teaming is so much more than just hacking. It's

1032
00:44:49.599 --> 00:44:55.199
<v Speaker 2>about challenging those assumptions, finding those hidden weaknesses, and always

1033
00:44:55.199 --> 00:44:56.840
<v Speaker 2>pushing the boundaries of security.

1034
00:44:56.960 --> 00:44:58.920
<v Speaker 1>So it's about being proactive and staying ahead.

1035
00:44:59.159 --> 00:44:59.760
<v Speaker 2>Absolutely.

1036
00:45:00.280 --> 00:45:05.119
<v Speaker 1>Johann Reeberger's book Cybersecurity Attacks, Red Team Strategies is a

1037
00:45:05.159 --> 00:45:08.360
<v Speaker 1>fantastic guide for anyone who wants to build a strong

1038
00:45:08.519 --> 00:45:09.519
<v Speaker 1>security program.

1039
00:45:09.760 --> 00:45:10.760
<v Speaker 2>Yeah, so must read.

1040
00:45:10.880 --> 00:45:12.800
<v Speaker 1>Thanks for joining us on this deep dive.

1041
00:45:12.920 --> 00:45:14.280
<v Speaker 2>It was my pleasure and.

1042
00:45:14.239 --> 00:45:19.320
<v Speaker 1>For our listeners, remember, think like an attacker, but defend

1043
00:45:19.559 --> 00:45:20.119
<v Speaker 1>like a pro.

1044
00:45:20.519 --> 00:45:21.960
<v Speaker 2>Couldn't have said it better myself.

1045
00:45:22.199 --> 00:45:24.480
<v Speaker 1>Until next time, stay curious, and keep exploring