Top tips for CISOs running red teams

A sensible approach I’ve seen CISOs construction their purple groups the place they should assess preliminary entry vectors is to cede entry to a system so {that a} portion of the workforce can start the trail discovering portion of the engagement whereas one other contingent can carry out the preliminary entry part, rejoining the group when/in the event that they full that stage. I’ve seen extra mature organizations break these engagements out into solely separate tasks, generally chaining them collectively to inform a narrative. One in every of my favourite examples of this was a monetary group that ran two preliminary entry tasks — phishing and exterior assault floor exploitation — concurrently for eight weeks. The outcomes from these engagements, which included the customers who detonated the phishing payload and the exterior programs on which the workforce had gotten code execution, turned the beachheads onto which entry for the purple workforce was ceded.

Maintain egos out

The debrief at completion of a purple workforce engagement can typically be very tense. The purple workforce has possible revealed critical failures alongside their assault path and you’ve got all accountable events sitting round a desk, or on a name listening to about them, typically for the primary time. Why didn’t your SOC detect their lateral motion? Why did your identification workforce flip MFA off to your enterprise admins? Why did your safety engineering workforce fail to deploy your EDR onto all hosts within the setting? It turns into all too simple to start pointing fingers and assigning blame, leaving everybody upset, flustered, and embarrassed. 

Keep in mind, nevertheless, {that a} pleasant workforce simply discovered critical flaws earlier than an adversary did and also you get the chance to repair it. Give attention to creating an setting of honesty, humility and empathy. This isn’t to say that individuals gained’t nonetheless really feel unfavourable feelings, however the tone of the dialog from the outset will considerably enhance the standard of the dialogue.