Everyone does security assessments. Some companies do them right, some do really badly. We’ve got vulnerability assessments, pen tests, and red team exercises. How do you look at these three and how do you decide when to undertake what?
\nWhen I think about these different assessments, a lot of it comes down to the outcomes I’m looking to drive and more fundamentally, what do I want to know? A vulnerability assessment in my mind is finding the gaps in the network, pretty standard stuff. I know that people use the term vulnerabilities, but it’s really just finding out where you need to be better at patching, configuration management, and things like that.
\nIf you take that up a level, you end up with a pen test where they do more creative attacking. They take the vulnerability and actually try to assess it and figure out if they can exploit it. Security teams should really pay attention to whether your pentesters are able to exploit the gaps they find. I’ve had plenty of experiences where we hire a company and they tell us something’s wrong. That’s great but then I’m like “Can you exploit it? Can you get root and get admin? Can you denial of service it ?” Interestingly, on some older stuff, they’re not able to do it. If a pentesting company is not able to exploit what they find, then the criticality of the findings goes down.
\nAnd now when you take the pentest a level up, that kind reels into the red team / blue team exercises or something along the lines of a cyber range where you’re actually setting up something for the assessors to try and get into, you’ve got a team dedicated to trying to catch them, and then they’re both watching each other and trying to either evade or adjust and that that to my mind where you get kind of the offense-defense interaction. Honestly, I’ve not done a whole lot of those.
\nThe one that I like to do is what’s sometimes called an objective-based test. And this is where a lot of times we’ll say to a company, “Hey, we want you to get a hold of an executives account, or try to get data out of an executive’s account.” Assessments like these help us build an understanding of the attacker’s view and you wind up developing a different way of thinking about it.