Understanding Offensive Security

Approximately two billion records were stolen between July and October 2019. That’s just in one quarter of a year! This is several times more than what was stolen last year – half a billion records. Even as organizations continue to invent new technology and pump in more and more funds (an estimated $124 billion in 2019) to secure data, the number of breaches also continues to rise – at an alarming rate!

It’s becoming evident that cybersecurity software solutions alone are not enough anymore. There is an urgent need to train employees and bring in experts who can close the loopholes left by software solutions. Therein arises the concept of offensive security.

The purpose of offensive security

Offensive security works like a vaccination would, to build up the organization’s immunity against attacks. Vaccines introduce antigens from the disease-causing bacteria or virus to train the body to develop immunity. In the same way, enterprises are now introducing ethical hackers into the organization to:

• Get a better understanding of the existing security system from the perspective of hackers
• Find loopholes that others would miss but hackers can clearly see
• Fix critical vulnerabilities
• Come up with effective security measures to prevent attacks

Known as Offensive Security Personnel or Red Teams, the mission of these ethical hackers is to ensure that organizational data is kept secure from adversaries – by playing the role of adversaries themselves. In other words, they look for various routes to “break-in” to the organization’s network from the outside and then address the vulnerabilities that allowed them to do so. 

They also work in conjunction with Defensive Security Personnel (or Blue Teams) to “assume” that a compromise has already taken place – and try to identify the resources that could have been possibly accessed by a hacker.

Offensive Security Services

A red team’s services include, but are not limited to, the following:

Vulnerability Assessment

A vulnerability assessment is a testing process and foundational offensive security service. It is applied to the host, network, and application layers of a given technology during a particular time frame. It combines a number of automated and manual techniques with the purpose of identifying, defining, and categorizing (by severity) vulnerabilities in the system. This information is then used by security leaders to decide if and what additional controls and actions are required to address these vulnerabilities.

Penetration Testing

Penetration testing (pen testing), also known as white-hat attacks is a type of offensive security process used to test an organization’s security policy, adherence to compliance requirements, and employee awareness on security while determining if the organization might be a possible target for security disasters. It begins with information gathering followed by the identification of possible entry points, attempted break-ins, and reporting.

Red Team Simulation

As the name suggests, this is a simulation of a cyberattack carried out by the red team. It is intended for training the organization’s employees and other security team members so that they know how to respond in case of such an attack. Red team simulations can be of different kinds and can replicate advanced persistent threats, state-sponsored attacks, malware campaigns, and the like. They are also a great way to identify gaps and test the organization’s incident response strategy.

Offensive Countermeasures

Paul Asadoorian and John Strand from the SANS Institute recommend offensive countermeasures that can be used to take offensive security one step further. It consists of three components: Annoyance, Attribution, Attack.

• Annoyance: Luring the attacker into a false port, service, or directory and frustrating their attempts by sending them on an endless loop to find something to attack
• Attribution: Identifying the attacker’s system by putting in web bugs in sensitive documents so they can be traced if they access them
• Attack: Launching an assault on the attacker through enhancements of the annoyance and attribution capabilities

As you can see, offensive security is more than just testing for the security of your environment. It is about leveraging cyber threat intelligence and coming up with iterative, aggressive new patterns of testing to prevent infiltrations of all kinds – opportunist attacks, cloud resource exploitation, phishing, and so on. Therefore, the nature of an offensive security team member’s work may resemble that of hackers, attackers, hacktivists, and organized cyber-criminals. They won’t be limited to a set group of processes or tasks but will require innovation and out-of-the-box thinking while appreciating and respecting organizational security policies.

At CloudNow, our team of security experts can carry out advanced testing services to keep your data and applications on the cloud secure. We further augment your security through Akku, our proprietary identity and access management (IAM) solution. Interested in knowing more?  Get in touch with us!
Contact us