Red Team Assessment (Red Teaming) is an activity where a group of white hat hackers (or penetration tester) perform a series of activities to assess the company’s security readiness towards real-world cyber threats. Red teaming aims to ‘attack’ an organization’s digital and physical infrastructure to assess the organization’s security defense and posture, at the same time targeting to obtain any sensitive and beneficial information.

Red Teaming usually emulates several malicious actors to penetrate organization digital and physical infrastructure security. Usually, a group of penetration testers masquerading different identities relevant to the scenario seek to challenge the organization’s staff security awareness. Methods usually include, but not limited to:

Social Engineer

Wireless Hacking

Eternal Access

LGMS Red Teaming

LGMS Red Team Engagement process:

1. Understanding the security

In the first stage of a red team engagement, the team would take a field trip and observe the target and its location. The exercise aims to perform deceitful conversation with the employees or known as social engineering, to gather useful information about the target location, while observing the surrounding of the security infrastructure.

During the engagement, the testers usually carry different false identity (masquerading) roles such as customer, accountant or police officer to perform the first stage of the red team.

2. Strategic planning

After gathering enough information of the target location, the red team will design a very specific plan for the execution strategy. A checklist of actions will be provided to each member of the red team based on their roles to compromise every possible scenario. Every scenario from the checklist is taken into account, ultimately to cover every possible scenario or loophole in the target location.

3. Red Team Execution

Finally, aimed with a plan, the red team will attempt to infiltrate the target location. Different identities will also be utilized in this phase in order to achieve its needed, yet different goals. For example, an amount of team members will pretend to be a customer to divert the attention of the staff or employee. Another team will attempt to perform the required infiltration, which includes but not limited to; installing malware into public kiosks or workstations, pasting unnecessary QR codes in false advertisements on the surroundings, etc.

Another team of experts will pretend to be individuals of importance, for example, an auditor or accountant to gain access to highly sensitive or confidential areas such as safe rooms or filing rooms, with the objective of gathering highly confidential information of the target area. Dumpster diving around trash bins and also printer spaces will also be performed in order to obtain sensitive corporate data.

Actual Footage

Everything is a possible target