3 ms·

I'm not a huge fan of how red teaming is generally conducted. It's sometimes necessary, but the CISA report seems to indicate that the organization wasn't respo

by clwg 2y ago

I'm not a huge fan of how red teaming is generally conducted. It's sometimes necessary, but the CISA report seems to indicate that the organization wasn't responding to their requests the way they wanted, leading to a communication breakdown right from the start. The vulnerability was patched and the red team's initial compromise was contained, so they targeted them with phishing, owned their domain controllers, then maintained access for months while pivoting to partner organizations, then published a public report. It's hard to establish constructive dialogue after that, allot of bad feelings and burnt bridges - and sometimes HR. It's tough because there's generally allot of dynamics at play, but I'm sure the impact of this testing was felt by people within the targeted org.

Jtsummers 2y ago
> The vulnerability was patched and the red team's initial compromise was contained, so they targeted them with phishing, owned their domain controllers, then maintained access for months while pivoting to partner organizations, then published a public report. You're missing a few steps between the pivot to partner organizations and the report. The public report was made on 11 July 2024. They revealed the breach to the target last year, June 2023, and then began a collaboration effort at that point, running through September 2023. They also don't name and shame in this public report, we don't know what the target organization was.
- clwg 2y ago
  My next sentence is really a comment on that step. I generally find that working incrementally alongside the teams provides better outcomes. This is not to say you can't use black-box testing or perform unscoped testing, but collaborating throughout the process gives you additional visibility that can save a lot of time, especially in large-scale and diverse environments. People generally respond in a more positive and collaborative manner as well.

by clwg 2y ago

Jtsummers 2y ago

> The vulnerability was patched and the red team's initial compromise was contained, so they targeted them with phishing, owned their domain controllers, then maintained access for months while pivoting to partner organizations, then published a public report. You're missing a few steps between the pivot to partner organizations and the report. The public report was made on 11 July 2024. They revealed the breach to the target last year, June 2023, and then began a collaboration effort at that point, running through September 2023. They also don't name and shame in this public report, we don't know what the target organization was.

clwg 2y ago
My next sentence is really a comment on that step. I generally find that working incrementally alongside the teams provides better outcomes. This is not to say you can't use black-box testing or perform unscoped testing, but collaborating throughout the process gives you additional visibility that can save a lot of time, especially in large-scale and diverse environments. People generally respond in a more positive and collaborative manner as well.