Red Team Research Articles

The Sherman Kent School of Intelligence Analysis and its Role in Improving the Analytical Performance of the US Central Intelligence Agency CIA

The main goal in current research that the analytical philosophy of Sherman Kent played a major role in developing the craft of intelligence analysis at the American Intelligence Agency, and we point out here that the organized analytical techniques that captured Sherman Kent’s interest are scenarios, competing hypotheses, devil’s advocate, and teams (A, B). ), red team, and low-occurrence/ high-impact probabilities. They all share an important focal point, which is analytical alternatives in order to cover unlikely hypotheses to ensure that no strategic intelligence surprise occurs. We believe here that the period in which Kent lived, in which he witnessed the surprise attack on Pearl Harbor, the Korean War, and the Cuban missile crisis, which is considered one of the largest intelligence failures in The history of the CIA had left him with a fear of strategic surprise, which was reflected in his philosophy of not ignoring unexpected threats and taking them into account in all the analytical methods he adopted.

The Impact of Exercise Load and Intensity on the Performance of China U24 3x3 Women Teams

This study analyzed the exercise load and exercise intensity of the China U24 3x3 women team in multiple games, combined with the performance data of the players in the game, and explored the impact of these factors on exercise performance. The results showed that there was a significant positive correlation between load intensity and average heart rate, and high load intensity usually led to a higher average heart rate. In addition, performance data such as scoring and rebounding were also significantly correlated with load intensity and load volume. Players with higher scores often underwent higher load volume and load intensity in the game. This shows that in high-intensity games, players' physical fitness and performance are closely related, and reasonable monitoring and management of load intensity are crucial to improving player performance and reducing the risk of injury. The study also showed that there were significant differences in load volume and load intensity between the U24 Blue Team and the U24 Red Team in different games, further emphasizing the importance of load management in game strategy and physical training. This study provides empirical evidence for basketball teams to formulate scientific training plans and game strategies, and emphasizes the importance of exercise load and intensity management to improve the overall performance of the team and the individual performance of the players.

Uniqueness, Reproducibility and Discrimination of Nuclear Warhead Gamma Signatures

Nuclear verification includes confirmation measures of nuclear weapons and fissile material, which often rely on the detection of radiation signatures. It is an open research question whether these signatures are unique. Or in reverse, could a malicious actor imitate these signatures and compromise verification of disarmament processes by using hoax objects instead of real warheads? This article presents several warhead emission models and a simulation framework to assess the uniqueness of their passive gamma radiation signatures. A red team approach includes detailed simulations of three proposed confirmation systems: The Information Barrier eXperimental, and the Information Barrier eXperimental II, both developed at Princeton University, and the Trusted Radiation Identification System, developed at the Sandia National Laboratories. For these simulations, various hoaxes are analyzed: warheads using reactor-grade plutonium instead of weapon-grade plutonium, combinations of different gamma emitting isotopes, and combinations of neutron sources with radioactive isotopes. Our findings reveal that numerous radioactive signatures are not unique and may be susceptible to imitation. Moreover, confirmation systems based on passive gamma radiation signatures using low bin numbers demonstrate a limited ability to accurately handle warheads of varying ages.

SpecRep: Adversary Emulation Based on Attack Objective Specification in Heterogeneous Infrastructures.

Cybercriminals have become an imperative threat because they target the most valuable resource on earth, data. Organizations prepare against cyber attacks by creating Cyber Security Incident Response Teams (CSIRTs) that use various technologies to monitor and detect threats and to help perform forensics on machines and networks. Testing the limits of defense technologies and the skill of a CSIRT can be performed through adversary emulation performed by so-called "red teams". The red team's work is primarily manual and requires high skill. We propose SpecRep, a system to ease the testing of the detection capabilities of defenses in complex, heterogeneous infrastructures. SpecRep uses previously known attack specifications to construct attack scenarios based on attacker objectives instead of the traditional attack graphs or a list of actions. We create a metalanguage to describe objectives to be achieved in an attack together with a compiler that can build multiple attack scenarios that achieve the objectives. We use text processing tools aided by large language models to extract information from freely available white papers and convert them to plausible attack specifications that can then be emulated by SpecRep. We show how our system can emulate attacks against a smart home, a large enterprise, and an industrial control system.

Using Wargaming to Model Cyber Defense Decision-Making: Observation-Based Research in Locked Shields

Defensive Cyber Operations (DCO) in complex environments, such as cyber wargames, require in-depth cybersecurity knowledge and the ability to make quick decisions. In a typical DCO, execution rarely follows a pre-planned path because of extensive adversary influence, challenging an already complex decision-making environment. Decision-making models have been extensively studied from perspectives of military operations and business management, but they are not sufficiently researched in the context of cyber. This paper responds to this need by examining the decision-making models of DCO leaders in a live-fire wargame environment. This study was conducted by observing leaders of cyber operations during the world's largest live-fire cyber exercise, NATO Locked Shield 2023. In this exercise, the blue teams plan and execute their defensive cyber operation in a realistic operational environment, while the red team conducts attacks against the defended environment. The large-scale, wargaming-style environment of Locked Shield is one of the best environments for modelling DCO decision-making models; in this exercise, the DCO is broad and multi-faceted, a perspective which cannot be achieved in a typical capture-the-flag competition or a single security incident. DCO leaders must be able to manage two distinct decision-making processes with different sets of required skills to be successful in the mission. While the primary process relates to the execution and evolution of the pre-designed plan with traditional operational leadership skills, the secondary process deals with unplanned and deliberately caused cyber-related events that require a deep understanding of cybersecurity. In this respect, the main contribution of this research is the constructed decision-making model of the DCO leader. This model is based on observations collected and presented in the context of multiple well-known decision-making frameworks. This model can be further used to train future DCO leaders and assess artificial intelligence's usability to support and automate decision-making in such operations.

A Survey on Network Attack Surface Mapping

Network services are processes running on a system with network exposure. A key activity for any network defender, penetration tester, or red team is network attack surface mapping, the act of detecting and categorizing those services through which a threat actor could attempt malicious activity. Many tools have arisen over the years to probe, identify, and classify these services for information and vulnerabilities. In this article, we survey network attack surface mapping by reviewing several prominent tools and their features and then discussing recent works reflecting unique research using those tools. We conclude by covering several promising directions for future research.

Guide to developing case-based attack scenarios and establishing defense strategies for cybersecurity exercise in ICS environment

Critical infrastructure mainly performs its role through an industrial control system (ICS). Organizations conduct cyber exercises between red and blue teams, focusing on offense and defense. Practical exercises require explicit attack scenarios and corresponding defense strategies. However, systematic guides for deriving cyberattack scenarios or defense strategies still need to be improved. This paper proposes a guide for establishing realistic attack scenarios and defense strategies for cybersecurity exercises in ICS environments. Attack scenario generation is divided into four steps: generating attack references, deriving attack sequences, mapping threat information, and mapping vulnerable implementation patterns. Deriving a defensive strategy consists of two steps parallel to developing an attack scenario: deriving containment and eradication. The methodology we propose guides exercise planning based on a knowledge base, thereby assisting exercise planners in generating various scenarios and deriving clear defense strategies. We showed that a clear exercise plan could be established through a case study.

A Red Team automated testing modeling and online planning method for post-penetration

Post-penetration red team automation testing effectively addresses the pain points of traditional manual red teams, including manpower, time costs, and the high level of professional knowledge required, thereby improving the efficiency and effectiveness of red team penetration testing. However, introducing automation technology into the red team testing domain still faces numerous technical challenges. These challenges include accurately simulating real attack environments, coordinating complex attack actions, and effectively resolving uncertainties during the attack process. These challenges remain critical issues that require urgent solutions. In this context, we propose a post-penetration-oriented automated red team penetration test modeling and planning approach. The objective of this approach is to automatically generate attack paths, coordinate attack behaviors, and adjust attack behaviors based on feedback, enabling attacks on real target networks through corresponding operations. We conducted analysis and performance testing on our solution, comparing it with other available planners. Our experimental results demonstrate the effectiveness of the proposed planner in achieving automated penetration testing. Compared to other available planners, ours can generate valid attack paths more quickly and exhibits excellent performance in planning effectiveness and quality. Furthermore, our planner possesses wide applicability across various penetration testing scenarios.

Red Team testing: Essential KPIs and metrics

This paper first discusses the diverse types of Red Team engagements and established exercise and attack frameworks and the importance of documented rules of engagement, then details the difference between metrics and key performance indicators (KPIs), and finally identifies the essential data points to be captured and compared in your next Red Team Test.

Security Evaluation of State Space Obfuscation of Hardware IP through a Red Team-Blue Team Practice

Due to the inclination towards a fab-less model of integrated circuit (IC) manufacturing, several untrusted entities get white-box access to the proprietary intellectual property (IP) blocks from diverse vendors. To this end, the untrusted entities pose security-breach threats in the form of piracy, cloning, and reverse-engineering, sometimes threatening national security. Hardware obfuscation is a prominent countermeasure against such issues. Obfuscation allows for preventing the usage of the IP blocks without authorization from the IP owners. Due to finite state machine (FSM) transformation-based hardware obfuscation, the design’s FSM gets transformed to make it difficult for an attacker to reverse-engineer the design. A secret key needs to be applied to make the FSM functional, thus preventing the usage of the IP for unintended purposes. Although several hardware obfuscation techniques have been proposed, due to the inability to analyze the techniques from the attackers’ standpoint, numerous vulnerabilities inherent to the obfuscation methods go undetected unless a true adversary discovers them. In this article, we present a collaborative approach between two entities—one acting as an attacker or red team and another as a defender or blue team , the first systematic approach to replicate the real attacker-defender scenario in the hardware security domain, which in return strengthens the FSM transformation-based obfuscation technique. The blue team transforms the underlying FSM of a gate-level netlist using state space obfuscation. The red team plays the role of an adversary or evaluator and tries to unlock the design by extracting the unlocking key or recovering the obfuscation circuitries. As the key outcome of this red team–blue team effort, a robust state space obfuscation methodology is evolved showing security promises.

The Importance of Red Team Exercises in VAPT for Proactive Cybersecurity

This research paper explores the integration of Red Team Exercises into Vulnerability Assessment and Penetration Testing (VAPT) as a proactive cybersecurity measure. Red Team Exercises, simulating cyber-attacks, play a crucial role in identifying vulnerabilities and testing incident response capabilities. Proactive cybersecurity is emphasized for anticipating and preventing breaches, reducing cyber risks, and showcasing the value of preemptive measures. The benefits of incorporating Red Team Exercises into VAPT include uncovering hidden vulnerabilities, realistic cyber-attack simulations, and enhanced incident response capabilities. Challenges such as resource requirements and potential operational impacts are addressed. Case studies featuring Microsoft and Google illustrate successful implementations, while lessons from incidents like the Equifax data breach underscore practical applications. Best practices, integration guidelines, and considerations for future trends in cybersecurity provide a comprehensive guide for organizations seeking to fortify their defences against evolving cyber threats

Purple Teaming: A comprehensive and collaborative approach to cyber security

This paper introduces Purple Teaming as a comprehensive and collaborative approach to cyber security, emphasising the need for organisations to adapt their cyber security testing methodologies in response to evolving cyber threats. Traditionally, cyber security efforts were divided into offensive (Red Team) and defensive (Blue Team) units; however, the concept of Purple Teaming has gained prominence, advocating for the integration of these units to create a dynamic and cooperative cyber security environment. The paper covers various topics including the significance of adversary emulation, the role of the MITRE ATT&CK framework in standardising communication, the value of traditional Red Team exercises and how Purple Teaming activities can complement these exercises. It differentiates between types of Purple Teaming activities and proposes an approach and architecture to support continuous Purple Teaming efforts. Adversary emulation, a key aspect of Purple Teaming, involves replicating the tactics, techniques and procedures (TTPs) of real-world threat actors to evaluate an organisation’s defences. The paper outlines how, when properly combined, Red and Purple Team efforts can significantly enhance an organisation’s capability to proactively improve its preventative, detection and response mechanisms against adversary tactics. Through its comprehensive coverage, the paper underscores the vital role of Purple Teaming in modern cyber security, highlighting its potential to foster a more resilient and proactive security posture for organisations.

Risk-based safety scoping of adversary-centric security testing on Operational Technology

Due to the recent increase in cyber attacks targeting Critical National Infrastructure, governments and organisations alike have invested considerably into improving the security of their underlying infrastructure, commonly known as Operational Technology (OT). The use of adversary-centric security tests such as vulnerability assessments, penetration tests and red team engagements has gained significant traction due to these engagements’ goal to emulate threat actors in preparation for genuine cyber attacks. Challenges arise, however, when performing security tests on these as the nature of OT requires additional safety and operation risks to be considered. This paper proposes a framework for incorporating the assessment of safety and operational risks within an overall scoping methodology for adversary-centric security testing in OT environments. Within this framework, we also propose a hybrid testing model derived from the Purdue Enterprise Reference Architecture and the Defense in Depth model to identify and quantify safety and operational risk at a per-layer level, separating high and low-risk layers and being subsequently used for defining the rules of engagement. As a result, this framework can aid vendors and clients in appropriately scoping adversary-centric security tests so that depth-of-testing is maximised while minimising the risk to safety and to the operational process. The framework is then evaluated through a qualitative study involving industry experts, confirming the framework’s validity for implementation in practice.

Exploratory Analysis of Decision-Making Biases of Professional Red Teamers in a Cyber-Attack Dataset

Attacker psychology is currently under-examined in cybersecurity research. A prior, large-scale study sought to understand attackers’ behavior by testing both technological and psychological deception. Professional “red team” members participated over two days in various conditions. This data was examined for further evidence that cognitive biases, a potential disruption for attackers, may be present, and may be affecting the outcome. An applied, novel methodology for measuring confirmation bias and framing effects is presented using this realistic dataset. Both confirmation bias and the framing effect occurred in this interpretation. The framing effect appears to have reduced attacker interactions with systems in the network, which may benefit cyber defenders. These results provide additional, exploratory evidence that biases in the decision-making of cyber attackers could be used as part of a defensive cyber strategy. Limitations to the approach and directions for future study of attackers are discussed.

Performance evaluation of Cuckoo filters as an enhancement tool for password cracking

Cyberthreats continue their expansion, becoming more and more complex and varied. However, credentials and passwords are still a critical point in security. Password cracking can be a powerful tool to fight against cyber criminals if used by cybersecurity professionals and red teams, for instance, to evaluate compliance with security policies or in forensic investigations. For particular systems, one crucial step in the password-cracking process is comparison or matchmaking between password-guess hashes and real hashes. We hypothesize that using newer data structures such as Cuckoo filters could optimize this process. Experimental results show that, with a proper configuration, this data structure is two orders of magnitude more efficient in terms of size/usage compared to other data structures while keeping a comparable performance in terms of time.

On the trajectory of discrimination: A meta-analysis and forecasting survey capturing 44 years of field experiments on gender and hiring decisions

A preregistered meta-analysis, including 244 effect sizes from 85 field audits and 361,645 individual job applications, tested for gender bias in hiring practices in female-stereotypical and gender-balanced as well as male-stereotypical jobs from 1976 to 2020. A “red team” of independent experts was recruited to increase the rigor and robustness of our meta-analytic approach. A forecasting survey further examined whether laypeople (n = 499 nationally representative adults) and scientists (n = 312) could predict the results. Forecasters correctly anticipated reductions in discrimination against female candidates over time. However, both scientists and laypeople overestimated the continuation of bias against female candidates. Instead, selection bias in favor of male over female candidates was eliminated and, if anything, slightly reversed in sign starting in 2009 for mixed-gender and male-stereotypical jobs in our sample. Forecasters further failed to anticipate that discrimination against male candidates for stereotypically female jobs would remain stable across the decades.

Securing the Network: A Red and Blue Cybersecurity Competition Case Study

In today’s dynamic and evolving digital landscape, safeguarding network infrastructure against cyber threats has become a paramount concern for organizations worldwide. This paper presents a novel and practical approach to enhancing cybersecurity readiness. The competition, designed as a simulated cyber battleground, involves a Red Team emulating attackers and a Blue Team defending against their orchestrated assaults. Over two days, multiple teams engage in strategic maneuvers to breach and fortify digital defenses. The core objective of this study is to assess the efficacy of the Red and Blue cybersecurity competition in fostering real-world incident response capabilities and honing the skills of cybersecurity practitioners. This paper delves into the competition’s structural framework, including the intricate network architecture and the roles of the participating teams. This study gauges the competition’s impact on enhancing teamwork and incident response strategies by analyzing participant performance data and outcomes. The findings underscore the significance of immersive training experiences in cultivating proactive cybersecurity mindsets. Participants not only showcase heightened proficiency in countering cyber threats but also develop a profound understanding of attacker methodologies. Furthermore, the competition fosters an environment of continuous learning and knowledge exchange, propelling participants toward heightened cyber resilience.

Infrastructure as Code for Cybersecurity Training

An organization's infrastructure rests upon the premise that cybersecurity professionals have specific knowledge in administrating and protecting it against outside threats. Without this expertise, sensitive information could be leaked to malicious actors and cause damage to critical systems. These attacks tend to become increasingly specialized, meaning cybersecurity professionals must ensure proficiency in specific areas. Naturally, recommendations include creating advanced practical training scenarios considering realistic situations to help trainees gain detailed knowledge. However, the caveats of high-cost infrastructure and difficulties in the deployment process of this kind of system, primarily due to the manual process of pre-configuring software needed for the training and relying on a set of static Virtual Machines, may take much work to circumvent. In order to facilitate this process, our work addresses the use of Infrastructure as Code (IaC) and DevOps to automate the deployment of cyber ranges. An approach closely related to virtualization and containerization as the code's underlying infrastructure helps lay down this burden. Notably, placing emphasis on using IaC tools like Ansible eases the process of configuration management and provisioning of a network. Therefore, we start by focusing on understanding what the State of the Art perspectives lack and showcasing the benefits of this new working outlook. Lastly, we explore several up-to-date vulnerabilities that are constantly messing with the lives of individuals and organizations, most related to Privilege Escalation, Remote Code Execution attacks, and Incident Forensics, allowing the improvement of skills concerning Red team and Blue team scenarios. The analysis of the attacks and exploitation of such vulnerabilities are carried out safely due to a sandbox environment. The expected results revolve around using IaC to deploy a set of purposely-designed cyber ranges with specific challenges. The main objective is to guarantee a complexity of scenarios similar to what we can observe in enterprise-level networks. Thus, this entails having a set of playbooks that can be run in a machine or laboratory, assuring the final state of the network is consistent. We expect this deployment strategy to be cost-effective, allowing the trainee to get deep insight into a wide range of situations. Nowadays, DevOps solutions work as a silver bullet against the issues derived from old-case-driven approaches for setting up scenarios. In short, one of the key takeaways of this work is contributing to better prepare specialists in ensuring that the principles of the National Institute of Standards and Technology (NIST) Cybersecurity Framework hold, namely: prevent, detect, mitigate, and recover.

Anthrax revisited: how assessing the unpredictable can improve biosecurity.

B. anthracis is one of the most often weaponized pathogens. States had it in their bioweapons programs and criminals and terrorists have used or attempted to use it. This study is motivated by the narrative that emerging and developing technologies today contribute to the amplification of danger through greater easiness, accessibility and affordability of steps in the making of an anthrax weapon. As states would have way better preconditions if they would decide for an offensive bioweapons program, we focus on bioterrorism. This paper analyzes and assesses the possible bioterrorism threat arising from advances in synthetic biology, genome editing, information availability, and other emerging, and converging sciences and enabling technologies. Methodologically we apply foresight methods to encourage the analysis of contemporary technological advances. We have developed a conceptual six-step foresight science framework approach. It represents a synthesis of various foresight methodologies including literature review, elements of horizon scanning, trend impact analysis, red team exercise, and free flow open-ended discussions. Our results show a significant shift in the threat landscape. Increasing affordability, widespread distribution, efficiency, as well as ease of use of DNA synthesis, and rapid advances in genome-editing and synthetic genomic technologies lead to an ever-growing number and types of actors who could potentially weaponize B. anthracis. Understanding the current and future capabilities of these technologies and their potential for misuse critically shapes the current and future threat landscape and underlines the necessary adaptation of biosecurity measures in the spheres of multi-level political decision making and in the science community.

Cyber oriented digital engineering

AbstractThe purpose of cyber oriented digital engineering (CODE) is to provide a repeatable systems‐engineering process for systems to resist Stuxnet‐class advanced persistent threat (APT) cyberattacks. CODE integrates cyber thinking with systems thinking. CODE accomplishes this by extending the US Department of Defense (DoD) digital engineering (DE) framework with functional mission analysis for cyber (FMA‐C), hybrid cloud architecture, zero trust (ZT) principles, threat analysis, and hardware cyber hardening (HCH). The lack of success of red team attacks conducted in our laboratory against an exemplar system demonstrates how following the CODE systems engineering process actually does “bake cybersecurity into the system”, making the resulting systems architecture and implementations more resilient. In a recent Pilot Project, CODE enhanced the systems requirements document of the top left side of the systems engineering Vee. CODE Pilot requirements embodied ZT principles, including machine to machine (M2M) credential exchanges and internal self‐checking. We anticipate working with International Council on Systems Engineering (INCOSE), the object management group (OMG,) and others towards standardizing CODE's cyber‐systems engineering processes for broader use of the global systems engineering community.