All the cyber security youngins’ want to be an ethical hacker pentesting on a company’s red team. People often use penetration testing and red teaming interchangeably to refer to the same cyber security field. However, each has a unique meaning and applications. In this article we’re going to break down pentesting vs red teaming, their basic functions, and outline what a professional path would look like for you aspiring hackers out there.
Team Composition & Skills
Pentesters must master various technology stacks and penetration testing tactics. Networking, linux fundamentals, windows and mac operating systems, cloud environments, etc. Testers must be able to identify security vulnerabilities in an application or infrastructure, and be able to communicate those vulnerabilities clearly.
Red Teamers also have to utilize technical skills during an engagement when dealing with computer systems. However, sometimes getting access to those systems requires taking advantage of other skills. Teams will often include specialists with skills such as social engineering, phishing, and even physical security expertise.
Scope & Objective
There’s many types of pentesting: web application pentesting, network pentesting, infrastructure pentesting, etc. Prior to testing the team meets with the client or development team to set rules of engagement, in-scope and out-of-scope assets, and testing timeline. Pentests normally have a very limited scope, only focusing on one or two applications at a time. Testing normally occurs in test environments or user access testing (UAT) environments. This is to ensure payloads will not permanently modify the production application or unintentionally expose sensitive information.
Red teaming normally revolves around a real-world scenario or a proposed threat scenario. In some groups this is called an adversarial simulation, with the goal of assessing an organization’s holistic security posture including people, processes, and technology. Furthermore, red teaming goes beyond just vulnerability identification, to assessing response capabilities, incident detection, and overall resilience against advanced attacks. These engagements normally involve real people in real environments to create the most realistic scenario possible. Red team engagements may also occur during off-hours to decrease their chances of detection.
Tactics
Pentesters utilize a wide range of tactics during an engagement. A good pentester stays up to date with the most recent type of attacks, chaining vulnerabilities to compromise a target. Many pentests will require testing various types of vulnerabilities to pass compliance standards. Testers will use methodologies such as the MITRE ATT&CK framework or OWASP Top 10 to ensure they are testing for all relevant vulnerabilities.
Red team engagements utilize the same technical tactics as pentesting, but often call for more than just computer hacking skills. Many engagements utilize methods such as social engineering for information, initial access, or compromising a user account. Teams use tactics such as cloning ID cards, tailgating, or social engineering to access a physical location. Assessors may use hardware such as fake/malicious cables loaded with malware which captures keystrokes, exfiltrates data, and creates an access point for persistence.
Duration & Frequency
A pentest has a set amount of time to meet compliance requirements, especially in the financial and healthcare industries These tests will often occur on a regular or semi regular schedule in order to satisfy certain regulatory requirements. Some development pipelines require a pentest before a new application or modification to an existing application can be released. This reduces risk and the amount of bugs in a new application or new version release.
Red team engagements can last weeks or months, as the timeframe for a particular simulation bound to real-world scenarios to emulate an adversary’s persistence and evolution over time. Prep time to complete the assessment takes longer, spending more time in the recon & information gathering phase to look for external loop holes or a potentially vulnerable process where the testers can leverage a foothold.
Reporting & Follow-Up
Pentesting reports focus on vulnerabilities, their exploitability, and their potential impact. Pentesters will often avoid giving detailed remediation plans. Developers and application teams are best suited to devise a remediation solution because of their extensive knowledge of the application’s code and the technologies used in the code base. A follow-up test for each vulnerability will occur, validating if the fix implemented properly remediated the issue.
Red team reports will not only cover technical issues, but also the organization’s response capabilities, detection times, and the effectiveness of the incident response plans. Follow-ups may involve larger organization changes, additional training, or policy updates.
Legal & Ethical Considerations
Both pentesting and red teaming operations have some legal and ethical boundaries. In pentesting, this is often restricted to the scope and types of payloads to use. Testing in a production environment requires extra caution in order to prevent permanent modifications or unintended data exposure.
Red teamers will need to consider legal and ethical implications of physical and social engineering tactics. Testers must obtain explicit permissions to conduct these tests and sometimes secure legal waivers or “get out of jail free” cards if they are caught in a physical location.
Career Path
Neither penetration testing or red teaming is an entry level field. Both disciplines require lots of prerequisite skills, certifications, and experience. There’s no definitive path to follow, but this is a rough outline for you to follow starting from 0 to hero:
- Linux Fundamentals
- Networking Fundamentals
- Web Security
- Penetration Testing certifications
- Capture the Flags (CTFs)
- Bug Bounty programs
You can find a more detailed path in our article Ethical Hacking | The Offensive Side of Cyber Security
Happy hacking!
Leave a Reply