Instructor: Training and exercises. 2 2
Earlier in the course, we talked a little bit about training 3 3
and exercises, so some of this will be a review. 4 4
We're going to talk about tabletop exercises, 5 5
penetration testing, and red, blue, and white exercises 6 6
in this lesson. 7 7
We are going to have some new information 8 8
so please don't just skip ahead and watch this entire video. 9 9
Now, when we talk about tabletop exercises, 10 10
we mentioned before 11 11
that these are exercises that use an incident scenario 12 12
against a framework of controls or a red team. 13 13
So what we're going to do here is we are going to 14 14
carry a discussion of simulated emergency situations 15 15
and security events. 16 16
These are great because they're really simple to set up 17 17
but they tend to be more theoretical 18 18
in nature and they don't provide practical evidence 19 19
of what could go wrong during a real event. 20 20
For example, 21 21
how long will a particular task take to complete? 22 22
You really can't gather that from a tabletop, 23 23
but if you actually go through the actions 24 24
and motions in something like a penetration test, 25 25
you'll be able to see that instead. 26 26
Now, I've seen a lot 27 27
of times when we're doing tabletop exercises 28 28
that people start using their magic wands. 29 29
Now, this is a bad thing to do 30 30
because you can start getting the effect 31 31
that something that might take a real team 32 32
12 hours to do can really be solved in 30 minutes. 33 33
And so when something really happens, 34 34
the managers start going, well, in the tabletop, 35 35
it only took us 30 minutes to solve. 36 36
Why is it taking you 12 hours? 37 37
I need this system up right now. 38 38
And so you start getting this negative training, I call it, 39 39
where you start training your senior leaders 40 40
to expect things to happen faster 41 41
in the real world than they really can. 42 42
So just be careful about that 43 43
if you're dealing with a tabletop exercise. 44 44
Now, when you're dealing with a penetration test, 45 45
this is a test that uses active tools 46 46
and security utilities to evaluate security 47 47
by simulating an attack on a system 48 48
to verify that a threat really does exist. 49 49
They actively test that threat and vulnerability. 50 50
They bypass security controls and then finally 51 51
exploit those vulnerabilities on a given system. 52 52
When you're doing a penetration test, 53 53
you are going to test the system to discover vulnerabilities 54 54
or prove security controls are actually working 55 55
as they're supposed to. 56 56
You're also going to examine the system 57 57
to identify any logical weaknesses that may be there 58 58
inside the system architecture. 59 59
And you're going to interview personnel to gather information 60 60
and see how prone they are to social engineering attacks. 61 61
All of these are things you can do 62 62
as part of a penetration test. 63 63
Now, when you're dealing with a penetration test, 64 64
you have to make sure it is properly scoped 65 65
and resourced before you can begin it. 66 66
Now, what I mean by this is you have to figure out 67 67
exactly what is going to be tested 68 68
as part of the penetration test. 69 69
If you get a penetration tester to come in 70 70
and test your organization, you say, 71 71
just go at the entire organization. 72 72
That's not going to be very effective. 73 73
Instead, you should tell them, hey, I'm really concerned 74 74
about my Windows domain controller. 75 75
I want you to see if you can get root access on that. 76 76
And that would allow them to be able to identify 77 77
exactly what your concerns are 78 78
and verify your systems are working properly. 79 79
Now, when you're dealing with a penetration test, 80 80
you can use either an internal team or an external team. 81 81
I personally like to use third parties who are external 82 82
to the organization or a separate internal red team. 83 83
I don't like to use my system administrators 84 84
to conduct penetration tests. 85 85
It's not that they're not smart enough to do it, 86 86
it's that they're biased in their approach. 87 87
When you have a system administrator 88 88
trying to pen test their own system, 89 89
what ends up happening is they start trying to 90 90
prove the system is secure 91 91
instead of trying to prove the system can be attacked. 92 92
As a penetration tester, our job is to be the bad guy. 93 93
It's to go in and find all the holes. 94 94
We want to find all the weaknesses, 95 95
and the system administrators tend to try to not do that 96 96
because they're trying to prove that their work 97 97
that they did securing the system is adequate. 98 98
And so it's a different perspective, 99 99
and that's why I much prefer a third party 100 100
or an internal red team be used 101 101
instead of system administrators. 102 102
Now, if you want to learn more about pen testing, 103 103
as I said before, you should check out 104 104
the CompTIA Pen Test+ curriculum. 105 105
In that course, there is a ton of information 106 106
on how you can become a member 107 107
of the penetration testing team and learning how 108 108
to attack these systems from that outsider perspective. 109 109
Now, the last thing we want to talk about in this lesson 110 110
is our red teams, our blue teams, and our white teams. 111 111
When we talk about red teams, 112 112
these are the hostile or attacking teams 113 113
in a penetration test or an instant response exercise. 114 114
If you hire that third party team, that is a red team. 115 115
They're trying to attack your systems. 116 116
When we're talking about blue teams, 117 117
this is our defensive teams 118 118
in a penetration test or an incident response exercise. 119 119
This is our system administrators, 120 120
this is our network defenders, 121 121
this is our cybersecurity analysts like you. 122 122
You're going to be part of the blue team. 123 123
And then we have the white team. 124 124
This is a staff who administers, evaluates, 125 125
and supervises a penetration test 126 126
or instant response exercise. 127 127
They're also going to be responsible for building the network 128 128
if you're going to be using a third party network 129 129
as part of your test. 130 130
Sometimes organizations don't want to do active testing 131 131
on their real live networks, 132 132
so they'll build a training ground 133 133
and they'll put their red teams and their blue teams 134 134
if they have internal red teams and internal blue teams 135 135
against each other in this simulated environment. 136 136
Well, somebody has to build 137 137
and support this entire ecosystem, 138 138
and that's what the white team will do. 139 139
I like to think about the white team as the referees. 140 140
They're also going to be the ones who are going to report 141 141
after the event and say, this is what the red team did well, 142 142
this is what the blue team did well, 143 143
and here's what they both did not so well. 144 144
That's the role of the white team.