Penetration testing is an increasingly common part of cybersecurity and compliance regulations. The truth is that in many cases, the best way to get to the root of IT vulnerabilities in a system is to expose them to controlled but realistic attack scenarios that probe every interaction and connection in that system. In many cases, organizations will take penetration one step further and use what has been called red team testing. 

Here we’ll discuss the difference between typical pen testing and red team exercises, how red team testing can help you better understand your security risks, and why that’s important for your organization’s compliance efforts. 

What is Penetration Testing?

Penetration Testing is the practice of fielding simulated (but human-directed attacks) against systems to determine vulnerabilities and attack vectors. The philosophy behind penetration testing is that expert attackers (sometimes referred to as ethical or “white hat” hackers) can follow the probable maneuvers that a real attacker would, investigating interfaces and leveraging known vulnerabilities to gain access to systems and propagate through those systems. 

Sometimes, penetration tests are discussed hand-in-hand with vulnerability scanning. The difference between the two is that a vulnerability scan is typically automated and focused on rapid assessments of surface-level weaknesses in an IT system. A pen test is a bigger investment of time and effort but can provide a much more comprehensive view of system vulnerabilities. 

Generally speaking, there are six types of pen tests addressing different aspects of modern IT systems: 

• External Network Testing: Probably the most well-known types of tests, external network tests are when pen testers attempt to breach a system from outside of it through typical user interfaces or system vulnerabilities. This kind of testing will also involve testers using any and all publicly available knowledge to inform how they attack the system. 
• Internal Network Testing: Conversely, internal network tests position the tester as an insider, someone who has access to inside systems, intranets, VPNs and so on. This approach will also include any system knowledge that would be available to a potential insider threat.
• Physical Testing: Digital systems, contrary to popular understanding, have baseline physical components like servers, data storage centers, workstations and so on–essentially any physical system that supports the digital infrastructure. Physical pen testing is the practice of infiltrating physical locations to access these assets. For example, a tester might enter an office location and learn how to gain access to server rooms by fooling security doors.
• Social Engineering Testing: Social engineering is a long-standing set of practices that hackers have used to leverage what is often the weakest link in your operations: your people. Social engineering attacks can involve hackers making contact with employees to gain information to help them in their attacks. Likewise, it can also involve more modern and well-known types of attacks like phishing, spear phishing and whaling. 
• Application Testing: With the exponential growth of cloud and web applications as replacements for traditional desktop apps, attacks against these apps have also grown. Any application that allows users to log in or provide input is vulnerable to attack, and compromising one application can further compromise an entire cloud system–making these applications prime targets for hackers. Pen testers focusing on applications will attempt to attack user interfaces, APIs used to connect online apps and the Identity and Access Management (IAM) systems associated with the apps. 
• Wireless Network Testing: Wireless networks are the backbone of modern connectivity, and as such, they are incredibly vulnerable to attack. Pen testers will focus on breaking weak passwords or taking advantage of poorly configured routers to access network traffic and, eventually, breach your entire system. 

Penetration testing, therefore, can take one or more of these approaches to attempt to access a system, propagate into that system and then create a complete report on those vulnerabilities so that weakness can be remediated. 

What Are Red Team Exercises and How Are They Different from Traditional Pen Testing?

The above-listed penetration tests can, when combined in the right way, provide a comprehensive understanding of system weaknesses. Likewise, these penetration tests can be performed with different levels of involvement. For example, you can undergo penetration tests where your entire organization is prepared for it, or undergo tests where no one knows the tests are happening. 

One such form of penetration testing, called “red team” testing, takes these ideas to the extreme. Born from the notion of a competitive “red team vs. blue team” model, red team tests are penetration tests taken to their most extreme. A red team will use “any means necessary” to breach a system and expose vulnerabilities

How is a red team test different from norm penetration tests? To begin with, typical penetration tests are planned and sanitized with the clear goal of exposing vulnerabilities. Red team exercises are modeled after the most relevant and recent forms of attack in the wild, no matter what they are. This means that they will use any combination of the above-listed forms of testing alongside creative approaches and shady forms of software to put a system under pressure.

Additionally, since these tests are so up-to-date, they can provide critical and real-time information on how your systems react to more innovative, and in some cases little-understood, forms of attack.   

By and large, red team exercises have three goals:

1. Identify all vulnerabilities associated with the interactions of physical, digital, and administrative systems. This includes assessing and exploiting the gaps that would expose an entire system to threat. 
2. Create a realistic picture of how a system may be breached and the risk associated with specific configurations and interactions. Since red teams will be coordinating attacks across multiple surfaces, these reports will typically include descriptions of vulnerabilities that only arise in your unique IT system. 
3. Provide insights and reporting on how to address vulnerabilities. A red team report will usually include a catalog of vulnerabilities and recommendations for remediating those issues. 

Red Team vs. Blue Team Exercises

Penetration testing is often undertaken from one side: that of the attacker. However, unique businesses and enterprise companies may, in many cases, have internal security teams (or direct/whitelisted SOC teams) that would benefit from a pen-testing wargame. 

As such, red vs. blue teams can help internal cybersecurity and compliance teams create, test and refine their responses to direct and ongoing attacks. Likewise, the follow-up consulting with the red team can help them better understand the logic of attacks and the effectiveness of their responses to security measures. 

Lazarus Alliance: Red Team Exercises and Compliance Support for Comprehensive Security 

Penetration testing is a major part of reliable and effective cybersecurity. Additionally, many primary compliance frameworks and regulations require that contractors and other organizations undergo regular penetration testing as part of their overall security posture. 

It’s critical that, if you are undergoing a pen test or fielding red team exercises, that you work with a partner that understands how to perform these tests effectively and in alignment with your business and compliance goals. Lazarus Alliance brings collective decades of security and compliance expertise to bear in all our penetration testing to help you meet compliance requirements and better understand your vulnerabilities and security risks. 

Do You Want a Comprehensive Understanding of Your Cybersecurity Risk and Vulnerabilities?

Call Lazarus Alliance at 1-888-896-7580 or fill our this form to learn more on our penetration testing and red team services.