Can you guys hear me very well? Is there any kind of echo or background noise?
Or is that just fine?
Just give me a heart if it is okay.
Okay, cool. Thank you.
Once again, hello everyone.
My name is Abhijit.
And I am also known by the pseudonym ABX.
I belong to Defcon Group Trivandrum, aka DC0471.
I am very glad to be here today.
It is a pleasure to be here.
And I really appreciate the keynote of Jason.
That was really wonderful.
That was a really impressive keynote.
And along with me, I have a couple of team members from Defcon Group Trivandrum today.
We have my Defcon Trivandrum teammates, Aditya, Srihari, Taufik, Alex, Praveen, Vishnu, and Plucky, along with Alex.
And we are all happy to be here.
Once again, it is a privilege to be here in this village.
Moving on to the next slide.
Next slide, please.
Give me a second, guys. Give me a second.
Let me drop the mic here.
One second.
Sorry, guys. I am pretty new to this platform.
Give me a second.
Could you please help me with this mic?
I just need to drop this mic and speak in loudspeaker.
Could anyone help me, please?
TX?
You have to hold your left mouse button for a while and you can just throw the mic away.
What? Left what? Left shift key?
The mouse button, right?
Yeah, the left mouse button.
That's how you do it.
Okay.
Cool.
Okay, sorry again for the trouble, guys.
I am really new to this platform.
Okay, once again, going back to the slide.
We manage the Defcon Group Trivandrum, which is in India.
Our location is Trivandrum, which is a very small city in India.
So, we have started our Defcon Group in January 2018.
We have organized a couple of hacker meetups and conferences during the past events with multiple tracks and CTFs.
We have more than 15 organizing team members, which are hardcore team members.
This is like a brotherhood for me and everyone in my group.
We are also hosting a hacking podcast in Malayalam language, which is our native language.
You could view that URL in there.
It is kind of interviewing local hackers and cybersecurity professionals.
We also connect regularly.
Move to the next slide, please.
Here are some of the photos of some of our events.
We had the opportunity to have a good set of speakers in our previous meetups.
I think that is it about our Defcon Group Trivandrum.
I think we can go to the technical presentation now.
Please move to the next slide.
As you can see, the title of my talk would be building an internal Red Team for your organization.
It is like building a practical Red Team within your organization.
Next slide, please.
As I have mentioned, my name is Abhijit.
And I'm also known by the pseudonym ABX.
I'm leading OpenSea security operations in a global financial technology company.
I'm also the former deputy manager for cybersecurity in Nissan Motors.
Prior to that, I used to work for EY as a senior security analyst.
I have nearly 10 years of experience in the security domain.
I'm also the founder of a community called teamvillage.org.
And no, it is not associated with Defcon Villages.
Like I mentioned earlier, I'm also the leader of the Defcon Trivandrum community.
Recently, I started running a blog called tacticaladversary.io,
which is a blog dedicated to adversarial simulation and Red Teaming tactics.
It is still a work in progress. I'm still working on it, you know, just to get things started.
Moving to the next slide.
Let's make some things clear first.
I don't really want to, you know, do an intro about vulnerability assessment, pen test or Red Teaming.
But I just want to make some statements before we go further into the slides.
Moving on to the next slide.
This is just a statement. I think you can see the slide. Yeah, yeah.
This is just a statement. Vulnerability assessment, it is not Red Teaming.
Like, you know, also vulnerability assessment, it is not penetration testing as well.
So we all know, like, what is vulnerability assessment.
It is about targeting a system, an application or a network just to identify the list of vulnerabilities.
Like, you know, what are the known weaknesses in that system?
List them down along with the remediation plan and hand it over to the appropriate teams so that they can get it fixed.
So that is called vulnerability assessment.
It is not Red Teaming. I will go to the next slide.
Again, penetration testing, it is also not Red Teaming.
But pen testing, on the other hand, compared to VA, it is more focused towards the goal.
Maybe... could you please go to the next slide?
Oh, OK. This is fine. This is fine.
OK. Maybe we are targeting an application or infrastructure.
Our only goal would be compromising that system and get into it.
The pen testing report also reflects the same, rather than listing all vulnerabilities.
We are facing a problem now, right?
You know, nowadays we cannot differentiate between vulnerability assessment and pen testing reports.
A pen testing report may list all vulnerabilities in the target system instead of the exportation and how the attacker got into the system.
For my day job, I used to see external pen testing reports with SSL issues only.
Just imagine that. Just think about it.
I used to see penetration testing reports from external vendors which are having SSL issues in a pen testing report.
That is really weird.
It is kind of confusing now, you know.
If anyone here is also feeling the same, just let me know.
Like, you know, the confusion between the vulnerability assessment and pen testing.
We are seeing it in our day-to-day life, you know.
These vendors, these professionals, they are giving us the VA and pen testing reports, you know.
It is kind of very confusing.
We are not blind here, but I am getting muted sometimes.
I don't know why.
Okay, as the last statement, I also want to mention that pen testing is not routine.
I'll come to this point later, later in the presentation.
Can we go to the next slide?
Okay.
So, like, you know, most of us know the meaning of RETeam or what is RETeam, right?
We have a cool definition from RETeams.net here.
Historically, RETeam, the term RETeam, it originates from the military terms which would be imitating the role of adversaries.
They will try to mimic the attacks against the military base.
That is the explanation about RETeaming.
Could you please go to the next slide?
We have a much simpler explanation in here.
This is a much simpler and easy to use explanation.
This is also from RETeams.net.
A RETeam is a group of highly skilled people that continuously challenge the plans, defensive measures, and security concepts.
That is pretty clear, right?
This is actually called adversarial attack simulation.
That is what we are doing nowadays.
I will come to the next slide.
Is it the next slide yet?
Yes, it is.
Let me talk about a confusion here.
I have seen these comments with the sales people and usually the security services executives.
I am not mocking anyone here.
It is also very sad that many people are seeing RETeams as penetration testers.
They will be saying, like, you know, I am a part of internal RETeam.
But I will ask, like, what are you doing then?
I am doing penetration testing.
I am doing web application penetration testing.
I am doing application security.
But I am a part of internal RETeam.
But it is kind of confusing.
It is also very sad that, you know, these people are seeing RETeams as penetration testers.
To explain the actual job, along with the RETeam professional, I mean, along with the RETeam professional,
many security folks are nowadays using the term adversarial attack simulation as well.
I have recently seen a couple of similar job titles in LinkedIn.
Instead of mentioning a RETeam professional, they are listing their profile as adversarial attack simulation professional.
Or, you know, like operator as adversarial attack simulation.
Something like that.
Just to be more clear, other than, you know, confusing, using confusing terms.
Next slide, please.
So, everyone, how is this picture?
Do you like this picture?
Could you guys please give me hearts or claps if you like this picture?
I am not getting hearts from everyone, I think.
Yeah, now I do.
Actually, you know, I really wanted to show off this picture.
You know, the perfect symphony between the attackers and the defenders.
It was created based on the native Kerala martial art, which is called Kalaripayattu.
That is the traditional martial art form of our native place.
So, based on that, we created this picture.
You know, it was designed for a CTF competition at a conference called COCON, which is one of the biggest cyber security conference in India.
So, I really wanted to show you guys this picture.
I think you guys really like it, right?
You know, the actual symphony between RETeams and Blue Teams, based on our native martial art form.
That was kind of a show off. Thank you.
Moving on to the next slide.
So, most of the things mentioned here, that is from my own experience, are the awesome contributors of the security community.
Most of the companies, they already have their own application security and internal pen testing teams.
So, what if they want to move a more matured attack simulation activities?
You know, they are doing fine with AppSec and internal pen test, but they also want to move into a more matured attack simulation team.
So, I really think this talk will be helpful for such people who want to build an offensive internal team for adversarial attack simulation.
We are targeting that kind of audience here. I mean, the target audience.
Next slide, please.
Okay, I think you can see this picture.
So, we have created this diagram for one of our assignments.
Internal Red Team Operations Framework. That is still a work in progress. We are still working on this.
We have split it into five different phases. Internal Red Team Operations Framework into five different phases.
Each framework will be having its own models and its own concepts.
So, based on that, we can start from the scratch and get into more mature level Red Teams, Internal Red Teams.
We can go into each of these phases individually.
Next slide, please.
Okay.
So, this is the very first phase of IRTO, which is Internal Red Team Operations.
It's like building from the scratch. We need to get our budget approved.
We really need to defend the practical goals and objectives.
It's like you should ask yourself, why are we creating this team? What is the need of an Internal Red Team in my organization?
Now, there should be a hard question.
Each organization has its own different set of crown jewels.
It is their sensitive data or assets.
The crown jewels of our organization.
Not only crown jewels, also people.
For example, it is always about the critical assets or critical people within an organization.
For example, if there is a company which is doing manufacturing, for them, it is their formula architects and all the stuff.
They have to keep it very safe.
So, considering that, each organization has its own valuable assets, its own data set, its own data centers.
So, we need to identify the crown jewels of our organization.
We need to create rules of engagement and we need to get assistance from the management and legal department.
And more importantly, before moving forward, we need to understand the security posture of our organization.
What are the security countermeasures or what are the security implementations which are there for an organization.
So, that is very essential to understand before we move forward.
And, like I mentioned, identify the crown jewels and people.
There is one more thing. People are always important.
For example, you know that there are many high-level executives out there, high-level management people are out there.
They are always vulnerable to phishing attacks. I will tell you why.
Usually, being technical people, we don't have the urge to open our email all the time.
But, being business consultants or being business executives, they always have the kind of an issue to open and respond to their emails.
So, they will always fall for a targeted phishing campaign. That is kind of the key thing here.
So, along with the sensitive data, we also need to identify what are the key people to my organization.
What if someone has compromised their personal account? What will happen to the organization?
So, this can be a challenge for people who are looking to build their team.
Moving on to the next slide.
Next slide is here, right?
Okay. How many of you know about this A-Team?
Three? Four? Okay.
So, recently in 2010 or 2012, there was a movie acted by Bradley Cooper.
Okay. So, the A-Team.
The team and skill set.
This is how, for example, just consider the A-Team.
This is how a team should be.
Like, the team must be diverse.
This is not an one-man job.
They'll have to work together as a team or work solo sometimes.
Also, they'll have to work under an excessive amount of pressure.
They should be able to handle that pressure.
It is really important.
For example, we know that Colonel Hannibal, right?
He's also the leader of A-Team.
And sometimes, he's a solo player.
And the A-Team, they're strong individually and stronger as a team.
That is an important thing to have.
You need to handle things personally.
And you need to handle things alone.
And you need to handle things as a team.
That should be a skill set.
So, the team should also contain non-technical people.
We talked about technical people, right?
We talked that in order to build a red team, we need highly technical people in different areas of attack simulation and offensive security operations.
But along with that, the team should also contain non-technical people.
So, how many of you here have ever created a phishing campaign against any kind of organization?
Give me some hearts.
How many of you have hosted a phishing campaign?
Yeah, I am seeing a couple of hearts in there.
So, let me ask you a question.
So, usually, the technical guys in your team or very people-managed and friendly guys, who are usually writing the phishing emails?
The technical guy or more friendly HR-like persons?
Who is creating the phishing emails for you?
Guys, you can...
If it is you, then you can give me a heart.
Otherwise, you can just give me a palm or something.
I am not seeing anything.
Okay, I can see a couple of guys.
They are saying that they do write their own phishing campaign emails.
So, I will tell you something.
Just imagine, a hardcore technical guy is writing a phishing email to someone like a business executive.
For example, if I am writing a phishing email, that will be more technical.
There will be these technical jaggons and there will be a lot of technical ways.
We don't want that, right?
So, if there is a non-technical guy or a business guy or a human resources person in our team, we can ask them to write the phishing email for us.
The meaning...
They can connect with people compared to the technical guys.
They are more friendly guys.
They are more into human resources and they can connect with other people pretty easily.
They speak a different language.
So, it is always better to have non-technical people in our offensive team.
It always helps.
Could you please go to the next slide?
Yeah, we have the next slide.
So, this is the phase 2 of iHeartLaw, like internal team operations.
So, a couple of points here.
A couple of steps here.
So, external infrastructure.
It is always essential to mimic an adversary's actions.
So, we need to build an external Red Team infrastructure.
For the beginning, start with open source C tools, implants, frameworks, and other tools.
We can modify it based on your requirements.
Also, be friends.
Okay, the third point.
Identifying the business-specific risk.
So, being in an internal Red Team is all about your organization and your organization's security posture,
and deployed defense mechanisms, etc.
So, it is a key point to identify the business-specific risk.
It can vary based on the businesses and based on organizations.
And the fourth point.
Always be friends with the organization's Blue Team.
If you have a Blue Team in your company, be friends with them.
Just try to understand what they are doing in their daily lives.
What are the tools and techniques which they are using for detecting the attackers.
It is always good to be in a good relationship with your company's cyber defense system or cyber defense team.
All of your organizational activities are there to make the Blue Team much stronger.
So, it is very essential to have a good relationship with your cyber defense team.
Okay.
Also, don't take it personally.
I just asked you to be friends with your organization's Blue Team.
Once I tried to be friends with an organization's Blue Team,
and in the end, she became my girlfriend.
That's a long story.
So, always don't try so hard.
Just formally be friends with the Blue Team of your organization.
Don't take it personally.
Just a personal advice.
Okay.
Moving on to the next slide.
Phase 3.
Could you please go to the Phase 3 slide?
Okay, Phase 3.
Actually, this is where we begin to work in our plan.
You can see, this is Phase 3 where we start working.
So, we can use improved tools, techniques, and procedures.
And we know about the current security mechanisms, right?
We talked about current security mechanisms in Phase 1 and Phase 2.
For example, the need of using improved TTPs.
For example, what if your organization is not allowing PowerShell or any other scripts?
That is where we need to improve our TTPs, right?
Initially, we identified that the current organization,
they do not allow PowerShell scripts or any other scripts, Wscripts, Cscripts, anything.
They are not allowing anything.
So, in that case, we need to make some changes in our techniques and improvise.
We should find the next feasible option.
For example, in this case, we can try running unmanaged PowerShell.
Maybe the different systems, they are not considering unmanaged PowerShell executables as malicious.
So, sometimes we can bypass the different mechanisms in there.
From Phase 1 and 2, we had identified the Crown Jewels and Pupil.
And the vulnerable path needs to be fixed.
The vulnerable path which can lead the Crown Jewels into a breach.
Also, the next point, evaluation of incident response process.
This is also important.
What is your organization's process once it's been compromised?
How much time did it take to detect the incident and respond to it?
That is also important, very much important.
And using the output of the previous phases, we could really improvise and make a new RTO process documentation.
There is a final point, we can learn from the previous phases.
And what have we learned from the previous phases, we can improvise from that.
And we can create a new operations manual or new operations process to move further.
So, that is the end of Phase 3.
Moving on to the next slide, Phase 4, IRTO Phase 4.
We have the Phase 4 here.
So, it's like, for example, collaborative and continuous Pupil team exercises.
So, whatever tasks are being done by the red team, the end goal should be empowering the blue team, right?
So, it's always better to organize a collaborative and continuous Pupil team exercises.
Just join forces with the red teams and blue teams.
Also, bring in more tooling capabilities.
Many interesting platforms and tools are there, you know, we should empower the red teams and blue teams.
Also, you can perform a targeted campaign, targeted and very specific campaigns against the crown jewels and key people.
For example, business executives.
You guys can still see my screen, right?
Could you please give me some hearts if you can see the screens, I mean the slides?
Okay, okay, okay. Awesome, awesome, awesome.
Moving on to the next point, overt physical security assessment.
We know that, you know, physical security assessment, they are a very big part of red teaming activities.
So, we can, in phase three, phase four, we can start overt physical security assessment.
We can identify the most important data centers, manufacturing plants, processing centers or anything based on your company's business.
You know, it may differ, there may be, you know, different set of goals based on your company's portfolio.
So, regarding the overt security assessment, you could just go to the premises,
walk around the premises with the person in charge and perform your review in front of the, you know, in front of the reviewer as well.
So, that is like, you are not breaking into anything. This is just overt physical security assessment.
You are just going to the client side and you are just walking around.
You are just trying to find as many as physical vulnerabilities in there and report them.
It is as simple as that.
So, you can, you know, as an example, you can refer the work of Devin Olam, you know, in YouTube.
He is a legend. He is the very best guy out there regarding physical, you know, security assessments.
He is really awesome.
Also, continuous awareness program for employees and key people.
Like, you know, after, for example, you have done a couple of phishing campaigns, fear phishing campaigns,
you know, you did some bad ESP drop and everything.
But from that, we need to share, we need to create a set of training series
and we need to perform continuous awareness and training programs for employees and the top manager
so that they can protect themselves from the future attacks of real adversaries.
That is really important.
Also, an operational tip, you know, when you go for a physical security assessment,
do not show up with military apparel or a tactical bag along with a laptop which is full of hacking stickers.
If you are going like this to the client side, you know, that raises a lot of eyebrows
and that is going to be really funny. People will be looking at you all the time.
Who is this guy, you know, wearing this tactical backpack and a laptop full of stickers?
So that's kind of very, you know, attractive thing, right?
So do not do that, even if you are doing a covert assessment or an overt assessment.
It's pretty important.
Going to the next slide, phase five, which is time to five.
Okay, so this is the final phase of IRTO framework.
By the time we reach phase five, we'll be having a kind of a matured team operations capabilities.
It is the time to grow some wings and fly away, right?
Not from the organization, but, you know, like capabilities wise, just, you know, fly away.
This is the phase where we have a matured team operations capabilities.
The main important thing would be by this time, you should have a significant improvement of organizational security posture.
Because we have passed four different phases, right?
We did many things, you know, from the phase one.
So by the time we reach phase five, it is very important to have significant improvement of organizational security posture.
So that is the clear proof of having a powerful and practical internal working.
It is important for both systems and the key people.
So you can also start, you know, covert physical security assessment, you know, instead of overt.
You could just go to client sites without telling them you are an internal employee, you could do assessment.
That will be very much fun.
So also, by the time we reach phase five, we will have highly skilled operators and we will be having custom tools to create custom security patterns.
Custom scripts and, you know, custom attack patterns.
That is very important. That is very interesting capability to have.
So also, continuous advisory simulation to keep the defendants on their toes.
So by the time we reach phase five, we attend many things, right?
And one of the things would be, one of the main thing would be having continuous advisory simulation.
Just to make sure that everything is going very well with the organization.
Finally, continuous routine operations with a very different process.
As an end result, we also will be having a very different process to carry this task forward.
You know, just repeat the process, make this as a cycle.
You know, continuous routine operation will be like, you know, the actual results of, you know, reaching phase five.
That is really important.
So we can assume that by the time we reach the phase five, you know, there will be a lot of significant changes within our internal security posture.
That is pretty important to have such a huge change.
And moving on to the next slide.
So the five phases which I have shown you, that is really customizable.
Like, you know, you can change that to your own needs and you can add your own points.
Even if you think that some of the points are misaligned in different phases, you can just modify the steps and you can make it your own.
That is pretty simple.
And coming back to the strategic and tactical plans, you can see, you know, there is a strategy plan, which is a total sum of a couple of tactical plans, right?
So the strategy plans, they are focusing on long-term objectives, where the tactical plans focus on short-term engagements.
So you can derive a couple of tactical plans and change them together, you know, just to reach the highest goal.
For example, you are planning, you are creating a strategy plan for one year.
So you can split that into three.
So each tactical plan is having four months to attain a certain role, a certain goal.
For example, earlier we mentioned, we need to identify the critical assets, key people and crown jewels, right?
So for the tactical plan on, you can take that as an objective and you can start identifying the critical assets and people.
Then you can try to, you know, perform adversarial simulation against those assets and people.
Just to identify, you know, are they vulnerable to phishing campaigns? What are the results?
And we got a couple of credentials from these people. What are the privileges for these credentials?
So by the end of the tactical plan one, you will have a clear set of reports, you know, for your very first objective.
So like that, we can, you know, change a couple of tactical plans to have a very long-term objective.
You know, that is the end goal of creating this IRTO platform.
You can create your own plans and both tactical and strategy.
Our end goal should be, you know, attaining the long-term objective.
Okay, cool. Could you go to the next slide, please?
Okay, this is the final slide. If you guys have any questions related to, you know, the team like faces and maturity models, you know, please feel free to ask me.
If you have any questions, you could just send some hearts and we can start talking.
Anyone?
Oh, okay.
Okay, so all those who have questions, please give some heart reacts so that I can unmute you all.
Actually, I can't hear you.
Yeah, I can see and strike. Just a second.
Could you please come near me? I can't hear you.
Can you hear me?
Yeah, tell me.
So, do you model your adversarial campaigns off of APTs?
Could you please come again?
Do you model your adversarial campaigns off of APTs?
Yeah, APT emulation, right?
Yes.
Yeah, we can, because I think I stated in one of my previous slides.
That is in phase two, I think.
Okay.
This adversarial emulation.
So, I mean, as a beginning in phase two, you can start doing emulation using, you know, Atomic Red Team or Caldera.
Also, you can use Mitre framework.
You know, there are a couple of APTs listed in there.
You can, you know, check those APTs and start collecting their commands and you can execute them in your, you know, test environment.
So, the end result would be, you can understand the detection capabilities of your Blue Team.
That is really cool.
Mitre is doing a wonderful job, you know, collecting all these emulation and, you know, simulation plans.
Okay, cool. Thank you.
Yeah, thank you.
So, you could always reach me on...
Is anyone asking any questions?
Could you please raise your hands or, like, you know, give me some hearts?
I'll come near you.
Could you throw some hearts? I'll come to you.
Okay.
So, if there are no questions, you can always reach me on Discord.
It is abh1474.
Also, you can reach me on my Twitter account, which is abhijitbr.
And...
Could you guys please move to the next slide?
Next slide, please. Okay.
And, yeah, thank you, everyone. Thank you for being here. Thank you to attend my talk.
Thanks a lot, everyone, for, you know, being in the virtual village hosted by DEF CON groups.
Thanks a lot.
Also, I would like to, you know, thank Jason Eastridge and DEF CON groups to give me this opportunity to stand here and take this presentation.
Also, I would like to thank TX and his fabulous DEF CON group, Delphi.
Also, DEF CON group Trivandrum, Mumbai.
Thank you. Thank you, everyone.
Okay, so...
Okay.