By: Taj El-khayat, Managing Director – South EMEA at Vectra AI
Imagine you are in a car race — a race with no second prize. Every corner is critical, every chicane a potential derailer. Now imagine you have not tested the car properly. How confident would you be of survival, let alone victory?
Right now, the United Arab Emirates (UAE) and its GCC peers can be thought of as economies full of factories that churn out racing cars at scale. The fact that the “cars” are, in fact, digital experiences will do nothing to blunt the argument. For do these digital experiences not navigate the contours of customer demand? Must they not be fast and reliable? Must they not be crowd pleasers that outperform competitors?
Digital experiences are everything in the global digital economy. They inform, they serve, they sell, and they dazzle. But if they fly off the track and cause harm, either to the company that made them or to the customers that rely on them, they become something else. They become a risk. As in motor racing, so in software development: you need someone to kick the tires. Enter the red team.
Safety first
The UAE’s Personal Data Protection Law of 2022 outlines “proper governance for data management and protection”, and is just one of several regulations, both local and international, with which businesses must comply. Combine this burden with the range of industry-specific standards that occupy the minds of regional risk managers, and you can soon see the need for testing the IT environment thoroughly and formally. Threat actors are becoming more and more sophisticated and the complexities that litter the post-pandemic IT stack present more low-hanging fruit than CISOs have ever encountered.
Red teams lift the branches higher; they are the crew that kicks the tires of the vehicle before it leaves the pit lane. Pick your metaphor — the red team tests… thoroughly. They pose as cybercriminals, think as cybercriminals, plan as cybercriminals, and move as cybercriminals. They find stealthy paths and opportunities for lateral movement, just as a real threat actor would. They exploit gaps in hybrid workflows. They leverage the same real-world techniques in use today to dupe users into revealing information about themselves and their business environment. And they do not hesitate to hijack cloud accounts to gain access to a target.
When the red team is done, the target organization’s CISO will have a crystal-clear picture of how current security measures would fare against a real attack. Red teams keep up to date with the threat landscape, informing themselves of how the nefarious operator goes about their business. They know the latest techniques, procedures, and mind games. The best red teams, however, go beyond the standard penetration tests necessary for strict compliance. They do this because they know that many “compliant” systems are vulnerable. Such systems can and do get compromised, which can and does lead to damage.
The weakest links
Automated scans that only discover technical vulnerabilities tell a bland story, and certainly reveal very little detail of the real threats facing a business, or how those risks may become disasters. So, threat-led red team exercises simulate multiple scenarios to cover all possible chinks in the digital armor. Sometimes these gaps will involve vulnerabilities in technology. But other instances may involve processes or people. Bad actors have a rich history of finding the weakest links wherever they may be, so cyber-defenders must become adept at doing the same. Red teams can help them do this. They can show organizations the gaps in, say, the training of back-office personnel by using simple social engineering or phishing techniques, or the Swiss cheese of shadow IT, as entry points. Red teamers are trained to never miss a trick and may even plant innocent-looking USB sticks where employees can find them. Ill-trained individuals may lift these booby traps and plug them into corporate assets, thereby becoming victims of the red team.
The value of the red team quickly becomes apparent when they are able to report that thorough training is the ideal path to a more robust threat posture, rather than the patching of a series of technical flaws. Whatever improvement programs an organization opts to initiate, the red team gives much-needed guidance on direction and priority. Standard pen-tests miss a lot, given the modern methods of the cybercriminal. And while it is important to have a comprehensive patch program in place, red teams’ duplication of standard bad-actor methodologies will reveal a triage list that includes the most common exploits, allowing for quick wins — always welcome to the CISO trying to prove the value-adding credentials of their SOC.
When it comes to technology, CISOs that have engaged with proven red teams will likely opt for a preconfigured network-based threat detection and mitigation solution — one that significantly boosts threat-detection capabilities and offers quicker time to value than endpoint detection and response (EDR). Visibility is improved without wholesale changes to environments, and alert fatigue is drastically reduced.
Roadworthy at last, but for how long?
Remember that race? Competitors are happy to see you spin off the track. Spectators care nothing for an also-ran and will turn their attention to those left in the turns. But at the risk of belaboring the point, this is a race with no finish line. CISOs and their analysts, with the support of ever-vigilant red teams, must work each day to ensure that every digital experience makes it through the development life cycle as a roadworthy speedster capable of taking the organization to victory.
