Red teaming is the practice of looking at a problem or situation from the perspective of an adversary. A red teaming exercise emulates Tactics, Techniques, and Procedures (TTPs) of real adversaries to test assumptions and improve the security posture of people, processes, and technology in the target environment.

In order to realistically emulate how a sophisticated adversary operates, red teaming exercises usually have specific objectives and a broad scope. They may include unconventional attack techniques, such as OSINT, social engineering, and physical intrusions. Each attack attempt is tracked along with its outcome, which may be:

• Attack is prevented
• Attack is remediated
• Attack is successful but detected
• Attack is successful and goes undetected

By training the defenders (the “blue team”), as the effectiveness of detection and response policies, procedures, and technologies is measured in the field, red teaming ultimately improves the preparedness and resilience of an organization against real adversaries.

For almost all organizations, data is what matters most. Payment and financial data, patient health information, personally identifiable information (PII), and intellectual property all need to be identified and secured. Often, applications are the main assets that store, process, and transmit such data.

Modern applications rarely involve a single component. It is common for an application to encompass multiple components, such as an application server, a web server, and a database server. Securing an application means securing the full stack: all components must be identified and secured, especially those that are exposed to end users and therefore cannot be protected by means of network security controls.

Security assessments can be conducted on all types of applications and their components, including:

• Web applications
• Mobile apps
• Application Programming Interfaces (APIs)
• Databases
• Client-server applications
• Chatbots
• Voice assistants

By mapping the attack surface of applications, security assessments allow to identify vulnerabilities and exposures and ensure integration of best practice security controls for the protection of mission-critical data.

Applications store, process, and transmit mission-critical data. However, for their functioning, application components rely on servers that enable and support operations. Beside application components such as application servers, web servers, and database servers, modern infrastructures include servers providing identity and access management (often delegated to Active Directory), file sharing, software distribution, backup, monitoring, logging, and similar services. These functions can be on premise or Cloud-based, implemented as regular services or as modern microservices in dedicated containers.

In addition to servers, workstations (especially administrative workstations) play a fundamental role in the security of an organization. For this reason, they are frequently a preferred target for attackers that aim to compromise mission-critical data and operations.

Security assessments can be conducted on all types of systems and infrastructures, including:

• Active Directory
• Windows and Linux servers
• Windows workstations
• AWS, Azure, and GCP Clouds
• Containers and orchestration tools

By mapping the attack surface of systems, security assessments allow to identify vulnerabilities and exposures and ensure integration of best practice security controls for the protection of mission-critical operations.

Applications and servers are the fundamental components that must be secured in order to protect mission-critical data and operations. However, for their functioning, they rely on network architectures and communication protocols that seamlessly enable operations in an increasingly interconnected world.

Network architectures (from the classic perimeter-based model to the modern zero trust paradigm), communication protocols (wired and wireless, used to transport data or voice) and network devices (switches, routers, firewalls, application proxies, load balancers, etc.) are constantly evolving to support business needs.

Security assessments can be conducted on all types of network architectures and communication protocols, including:

• IPv4 and IPv6
• IPsec and TLS VPNs
• Voice over IP (VoIP)
• Wi-Fi
• NFC and RFID
• Bluetooth
• LoRaWAN

By mapping the attack surface of networks, security assessments allow to identify vulnerabilities and exposures and ensure integration of best practice security controls for the protection of mission-critical communications.

The Internet of Things (IoT) describes the network of physical objects that are embedded with sensors, software, and other technologies for the purpose of connecting and exchanging data with other devices and systems, over the Internet or other TCP/IP networks.

By acting as cyber-physical bridges, IoT devices can influence the physical world and may therefore directly impact the safety of individuals and organizations. For this reason, their security and reliability are extremely important for both vendors and end users.

Security assessments can be conducted on all types of IoT devices and networks, including:

• Smart home devices
• Smart city devices
• Healthcare systems
• Transportation systems
• Physical access controls and smart locks
• Video surveillance and alarms

By mapping the attack surface of IoT devices and networks, security assessments allow to identify vulnerabilities and exposures and ensure integration of best practice security controls for the protection and safety of individuals and organizations.

Operational technology (OT) devices manage, command, direct, or regulate the behavior of other devices or systems. They take a set of input data from their sensors and perform a function based on such data and on established parameters. Control systems can have different sizes and complexities, depending on the process they monitor and control.

Many types of industries, often labeled as critical infrastructure, rely on OT, including:

• Energy industry, such as electric power and oil & gas
• Service industry, such as transportation and logistics
• Factory automation and process industry

Risks related to control systems usually exceed those of IT infrastructures because they include human safety and environmental damage. These risks must be considered while assessing the security and reliability of OT.

Security assessments can be conducted on all types of OT devices, including:

• Distributed control systems (DCS) and programmable logic controllers (PLC)
• Human machine interfaces (HMI), historians, alarm servers, and engineering workstations
• Supervisory control and data acquisition (SCADA) and remote terminal units (RTU)

By mapping the attack surface of industrial control systems, security assessments allow to identify vulnerabilities and exposures and ensure integration of best practice security controls for the protection of critical infrastructure.

Financial services are the economic services provided by the finance industry. They concern a broad range of businesses that manage money, including banks, insurance companies, payment processors, and credit bureaus.

Financial technology (fintech) is an emerging industry that applies technology to improve financial activities. Fintech includes new applications, processes, products, or business models in the financial services industry, provided as an end-to-end process via the Internet. The interconnection is enabled through open banking APIs and supported by regulations such as the European Payment Services Directive (PSD2). Fintech is used to automate investments, insurance, trading, banking services, and risk management.

Security assessments can be conducted on all types of financial platforms, from traditional mainframes to modern fintech applications, including:

• Internet banking
• Mobile banking
• Open banking APIs
• Credit bureau applications
• Mainframes
• ATM devices
• Cryptocurrency

By mapping the attack surface of fintech platforms, security assessments allow to identify vulnerabilities and exposures and ensure integration of best practice security controls for the protection of financial services.

Security should not be an afterthought. Fundamental design flaws sometimes cannot be solved after deployment. In addition, it might not be feasible to replace an already deployed system especially after a significant investment has been made to develop or acquire it. As a result, it is much more difficult and expensive to address security after deployment rather than during development.

Organizations should be designing for security. Fundamental security tasks should be executed starting from the very beginning of a project. The process should be driven by secure system development life cycle (SSDLC) principles, along with threat and maturity models.

In this context, hybrid design, architecture, and configuration reviews can be conducted across different life cycle phases (from design to development, from deployment to maintenance) to measure the security posture of different hardware and software platforms. These reviews include:

• Secure design review, conducted via documentation, interviews, and practical testing
• Configuration review of servers, workstations, network equipment, and mobile devices
• Attack surface analysis, conducted via threat modeling, practical testing, and dedicated metrics
• IAG assessment, aimed to evaluate the maturity of identity and access governance practices
• Password analysis, encompassing password dumping, cracking, and statistical analysis
• Network segregation testing, aimed to evaluate firewall ACLs and other network segmentation controls.