Example objectives may include gaining access to customer data, compromising internal domain administrator credentials, or demonstrating access to email or critical business systems. In order to present a realistic attack scenario, the test will be conducted with no prior knowledge of or access to Customer’s IT environment. Additionally, LMNTRIX will use techniques specifically designed to evade detection by IT Security teams and controls.
The outcome of Identification phase is a master list of potential targets that will be evaluated and prioritized for exploitation.
The ultimate goal of Exploitation phase is to breach the perimeter and access internal systems. Technical exploitation is often accomplished by compromising Internet-facing systems and leveraging that access to attack adjacent systems within the environment. Social engineering exploitation is often achieved by obtaining valid credentials that can be leveraged to access the environment via remote access solutions (e.g., VPNs) or via execution of malware on the user’s machine that allows LMNTRIX to operate within the internal environment under the context of the user.
In most attacks, post-exploitation is an iterative process that involves multiple cycles of identifying internal targets, compromising those targets, and extracting additional information and credentials for further lateral movement within the intranet. As noted above, the ultimate goal of this phase is to accomplish the predefined attack objectives. In order to accomplish the objectives, LMNTRIX often obtains full administrative access to critical systems (e.g., financial application servers, key databases, executive email and file shares), the internal authentication and authorization systems (e.g., Active Directory, LDAP, two-factor authentication), or the core network infrastructure (e.g., RADIUS, TACACS).
A secondary objective of this assessment is to measure the detection and response capabilities of the information security team. Therefore, LMNTRIX will use testing and attack techniques that are designed to bypass or evade security controls. LMNTRIX will leverage custom malware that may not be detected by commercial anti-virus products, and avoid using any scanning or exploitation techniques that are likely to be observed by system users or detected by network sensors and endpoint controls. In the event that Customer information security team detects the test in progress, the LMNTRIX and Customer project managers will select an appropriate course of action for the continuation of testing.
Red Team activities will be discussed and agreed upon by both LMNTRIX and the Customer during the project kickoff meeting. This agreement may include the specific scope of the engagement (e.g., whitelisted targets, blacklisted targets), coordination and approval necessary prior to exploitation of targets, schedules and timeframes, data handling and communications plan, and escalation policy.
Each engagement follows the phases of the attack lifecycle.
The use of real-world attacker TTPs tests your organization’s
readiness and responsiveness to cyber attacks.
- Test your security team’s effectiveness in dealing with a cyber attack
- Train your team to better respond to future cyber attacks
- Determine the level of effort required to compromise your sensitive data or IT infrastructure
- Identify and mitigate complex security vulnerabilities before an attacker exploits them
- Receive fact-based risk analysis and recommendations for improvement
- A high-level executive summary of the Red Team Assessment, catering towards executives and senior-level management
- A detailed report describing actions taken during the assessment and a report of all found vulnerabilities
- Fact-based risk analysis detailing the relevance of each vulnerability with respect to your environment, and techniques to validate said vulnerabilities
- Strategic recommendations for long-term improvement
