1 00:00:05,050 --> 00:00:05,630 Awesome. 2 00:00:05,630 --> 00:00:07,430 Thank you, everybody, for joining today. 3 00:00:07,530 --> 00:00:09,810 First of all, thank you, Optiv. 4 00:00:09,910 --> 00:00:12,770 You have been an amazing partner since day one. 5 00:00:12,770 --> 00:00:18,270 Not only for supporting us this year, but you have supported us for quite some time. 6 00:00:20,230 --> 00:00:24,170 So we have a few questions that the team actually has for you. 7 00:00:24,170 --> 00:00:29,190 And what I would like to do is not to steal a little bit more of your time and just pass it up to John. 8 00:00:29,370 --> 00:00:31,970 And then we can kick it from there. 9 00:00:32,810 --> 00:00:33,550 Hey, guys. 10 00:00:33,550 --> 00:00:35,130 Thanks for joining us again. 11 00:00:35,130 --> 00:00:38,990 I appreciate your guys' contribution and support. 12 00:00:39,710 --> 00:00:41,830 I guess I'll just start it off. 13 00:00:42,370 --> 00:00:43,890 Introductions for our guests. 14 00:00:43,890 --> 00:00:44,650 Who are you? 15 00:00:44,650 --> 00:00:45,690 What do you do? 16 00:00:45,690 --> 00:00:46,830 Maybe your school? 17 00:00:47,090 --> 00:00:48,230 But yeah. 18 00:00:48,850 --> 00:00:49,530 Yeah. 19 00:00:49,530 --> 00:00:50,390 Keith Tomey. 20 00:00:50,390 --> 00:00:53,430 I'm a Technical Manager here at Optiv Tech and Pen. 21 00:00:53,530 --> 00:00:55,470 Been here about five years now. 22 00:00:55,550 --> 00:00:58,550 Been in the industry for over 28 years. 23 00:00:58,550 --> 00:01:00,630 The last time directly in Offensive Security. 24 00:01:00,630 --> 00:01:09,950 So my role here from a technical management perspective is to help the team build out their methodologies, tooling, things of that sort. 25 00:01:10,250 --> 00:01:15,130 Specialties would be physical penetration testing as well as adversarial simulation. 26 00:01:15,130 --> 00:01:17,230 So that's my spiel. 27 00:01:21,450 --> 00:01:21,910 Cool. 28 00:01:21,910 --> 00:01:22,150 Yeah. 29 00:01:22,150 --> 00:01:23,310 My name is Will Winkler. 30 00:01:23,310 --> 00:01:25,190 I'm also a consultant here at Optiv. 31 00:01:25,190 --> 00:01:27,470 I work on the attack and penetration team. 32 00:01:27,550 --> 00:01:30,610 I'm actually one of the red team operators here at Optiv. 33 00:01:31,170 --> 00:01:35,830 And along with that, I kind of specialize in physical engagements and social engineering. 34 00:01:37,690 --> 00:01:38,650 Hey, everyone. 35 00:01:38,650 --> 00:01:39,650 I'm Ari Ansarouche. 36 00:01:39,650 --> 00:01:41,210 Everyone's welcome to call me Ari. 37 00:01:41,370 --> 00:01:46,110 I am also a senior consultant at Optiv's attack and pen team. 38 00:01:46,150 --> 00:01:51,150 I have also come to specialize in some of the more physical side of things. 39 00:01:51,210 --> 00:01:52,790 It's also what I enjoy the most. 40 00:01:52,790 --> 00:01:54,190 So that kind of works out. 41 00:01:54,230 --> 00:01:59,210 And I graduated from the University of Richmond with a degree in information security. 42 00:02:00,970 --> 00:02:01,870 Thank you, Ari. 43 00:02:03,110 --> 00:02:04,710 Next question. 44 00:02:04,830 --> 00:02:08,590 Why does your company believe red team operations are important? 45 00:02:10,170 --> 00:02:20,030 So, you know, there's a few points here that I kind of want to bring up when it comes to why we believe red team operations are important. 46 00:02:20,490 --> 00:02:25,490 I think first and foremost, is identifying vulnerabilities, right? 47 00:02:25,490 --> 00:02:33,130 So whenever we're going into a red team operation, we obviously want to identify those vulnerabilities, you know, for our potential clients. 48 00:02:34,210 --> 00:02:37,730 Specifically, you know, we're doing this by emulating real world attacks. 49 00:02:37,730 --> 00:02:43,110 And the reason we're doing that is because we want to use the same TTPs that real attackers are using. 50 00:02:43,330 --> 00:02:46,230 That kind of moves into my second point. 51 00:02:46,670 --> 00:02:50,930 That would be to enhance those defensive strategies, for those organizations. 52 00:02:50,930 --> 00:02:54,050 And that may be a logical security measure. 53 00:02:54,050 --> 00:03:03,190 It could be something as, you know, social engineering, security awareness, any of those different attack vectors, right? 54 00:03:03,190 --> 00:03:07,250 So we want to emulate any of those that could be potentially real world. 55 00:03:07,250 --> 00:03:18,610 And I think, you know, once we sort of give those opportunities to those clients and those organizations, that's going to allow them to be better trained and prepared, right? 56 00:03:18,610 --> 00:03:33,250 So a lot of times when we go into these adversarial simulations, is what we call it, when we move into these, there's only one or two people on the team that actually know from the client side that actually know that we're going to be performing these. 57 00:03:33,250 --> 00:03:42,550 So you get to see from a real world, you know, perspective, you know, that client gets to see how their IR is really responding to these things. 58 00:03:42,550 --> 00:03:44,430 What does the dwell time look like? 59 00:03:44,730 --> 00:03:55,130 And it lets us kind of give them, you know, different suggestions to remediate and bolster their defenses, right? 60 00:03:55,150 --> 00:04:04,830 And when it comes to more robust clients, clients that have been working with us, you know, for multiple years, typically, it's a little bit harder to be able to breach them. 61 00:04:04,930 --> 00:04:12,050 But when we do find something, it helps us really fine tune those policies and playbooks that they already have in place. 62 00:04:13,570 --> 00:04:14,290 Awesome. 63 00:04:15,510 --> 00:04:21,210 With the advent of AI and mainstream, how do you see it affecting the industry? 64 00:04:22,570 --> 00:04:23,850 I can take that one. 65 00:04:24,070 --> 00:04:25,990 It's so fascinating. 66 00:04:25,990 --> 00:04:33,190 And I do wish that this was a little bit more of like a back and forth dialogue, because I don't, you know, want to pretend to be like an authority on this particular subject. 67 00:04:33,890 --> 00:04:35,030 Hey, welcome. 68 00:04:35,030 --> 00:04:37,190 You're welcome to if I make a weird point. 69 00:04:37,690 --> 00:04:40,210 But actually, slow down. 70 00:04:40,210 --> 00:04:41,610 A couple caveats here. 71 00:04:41,690 --> 00:04:43,990 Not an expert on this at all. 72 00:04:43,990 --> 00:04:51,250 I'm coming from, I think, about the level of knowledge that a lot of us are kind of sitting at in terms of our understanding of how it works and kind of where it's going. 73 00:04:52,170 --> 00:04:56,630 Caveat number two, it's constantly changing, constantly evolving. 74 00:04:56,630 --> 00:05:08,710 Just yesterday, I'm sure a lot of us have seen like OpenAI releases the beta code interpreter that allows ChatGBT to write, execute, and test its own code. 75 00:05:08,730 --> 00:05:09,690 That's huge. 76 00:05:09,690 --> 00:05:13,910 So I almost had to just rethink my entire answer when I found that out. 77 00:05:13,910 --> 00:05:27,510 But number three caveat, I think, is that my perspective, our perspective, us three here that work at Optiv, the perspective is going to come from the way that Optiv conducts their red teams and their assessments, which is a little bit quicker of a cycle, 78 00:05:27,570 --> 00:05:28,970 a little bit tighter of a cycle. 79 00:05:29,090 --> 00:05:33,630 Our red teams, for example, usually last between three and four weeks, give or take. 80 00:05:33,770 --> 00:05:45,210 So coming from that perspective, all those other caveats, right now, I'm pretty optimistic, actually, about the impact that it's going to have on our side of the industry. 81 00:05:45,330 --> 00:05:54,970 I think it's actually going to be not unlike when a lot of the more reliable, solid, heavy-duty automated scanning tools kind of came out. 82 00:05:54,970 --> 00:05:56,810 So like take Nessus, for example. 83 00:05:57,770 --> 00:06:01,550 We all kind of know that Nessus did have an impact. 84 00:06:01,710 --> 00:06:03,270 Those types of tools did. 85 00:06:03,270 --> 00:06:12,750 And I'm sure that there is kind of a subtle impact that it made where a lot of teams out there would probably be larger if it wasn't for the advent of some of those automated tools. 86 00:06:12,750 --> 00:06:22,690 But we also know how kind of limited they are and how, in order to get the most out of them, we still kind of have to have our wheels kind of turning. 87 00:06:22,810 --> 00:06:29,110 We have to be here guiding everything, making sure that we're kind of pointing it in the right directions. 88 00:06:29,110 --> 00:06:31,770 So I picture it going similarly. 89 00:06:31,770 --> 00:06:36,350 I know it is kind of a false equivalence because AI is just capable of so much more. 90 00:06:36,710 --> 00:06:47,810 But as far as kind of where it is right now, as far as large language models, I think that it is going to be more of a tool that we can constantly reference, that speeds up our abilities. 91 00:06:47,810 --> 00:06:52,910 I use it all the time for scripting and bash one-liners and just little references here and there. 92 00:06:52,930 --> 00:07:02,590 But as far as it replacing us and what we do day-to-day, as of right now, I'm not super, super worried until we really push over to general AI. 93 00:07:02,590 --> 00:07:05,070 And then, I mean, it's all over anyway. 94 00:07:05,090 --> 00:07:07,990 So everything changes after that. 95 00:07:07,990 --> 00:07:10,270 So that's kind of where I am on the subject. 96 00:07:10,850 --> 00:07:11,350 Okay. 97 00:07:11,350 --> 00:07:15,590 It's a little bit of a bleak ending, but yeah, I appreciate it. 98 00:07:16,050 --> 00:07:18,550 I'll hand over the questions to Greg now. 99 00:07:18,830 --> 00:07:19,590 Awesome. 100 00:07:19,690 --> 00:07:20,790 My name is Greg Oldham. 101 00:07:20,790 --> 00:07:23,810 I just want to thank you guys again for all your support. 102 00:07:25,030 --> 00:07:31,370 My question is, so how does your company see red teaming making more positive impacts? 103 00:07:34,040 --> 00:07:35,760 Yeah, I'll take it. 104 00:07:35,900 --> 00:07:42,860 So, you know, by nature for red teaming, right, we have to stay focused on what the overall goal of a red team is, a red team assessment. 105 00:07:43,040 --> 00:07:47,460 At the end of the day, we're there to try to help secure the client's environments, right? 106 00:07:48,180 --> 00:07:56,100 We do a lot of crazy, cool stuff, you know, developing exploits and pulling off some crazy attack chains and things like that. 107 00:07:56,680 --> 00:08:01,420 But we do have to stay focused on the fact that we're trying to secure the client environments. 108 00:08:02,080 --> 00:08:06,820 So for us at Optiv to get to that point, it involves a lot of different aspects, right? 109 00:08:06,820 --> 00:08:09,400 We're starting to move heavily into cloud testing. 110 00:08:09,560 --> 00:08:20,180 As everybody's moving off prem, we're moving right into, you know, leveraging Azure and AWS and GCP and some other things to start to move into that space. 111 00:08:20,880 --> 00:08:29,260 As I already talked about with artificial intelligence, we're actually already tooling that to a certain perspective for business intelligence. 112 00:08:29,460 --> 00:08:33,980 So red team isn't just about, you know, the router switches and computers. 113 00:08:33,980 --> 00:08:39,320 A lot of times it's about what kind of intelligence can we get about our target beforehand, right? 114 00:08:39,320 --> 00:08:42,380 What can we learn about their culture beforehand? 115 00:08:42,680 --> 00:08:50,020 So we're using a platform to do that and some other tooling to start to build up that intelligence on an organization. 116 00:08:50,200 --> 00:08:55,240 And in addition to the other normal things that you would look at for assets. 117 00:08:56,760 --> 00:09:03,620 Also, I would think that, too, like for a successful red team, the way we envision it, red teams are super helpful. 118 00:09:03,900 --> 00:09:07,920 But you want to help the client go along with that in the early stages. 119 00:09:08,280 --> 00:09:16,060 If they've never had penetration tests done or they've never had a purple team done and have us come in for a red team, it's going to be an ugly day for them. 120 00:09:16,060 --> 00:09:18,120 And it's probably going to be a super win for us, right? 121 00:09:18,120 --> 00:09:19,800 It's going to be easy to do. 122 00:09:20,180 --> 00:09:23,300 So usually we want to guide that from a company. 123 00:09:23,300 --> 00:09:28,040 We want to try to guide their maturity along before we even engage a red team. 124 00:09:28,320 --> 00:09:38,400 Start with comprehensives, you know, guide them in remediation there, move into purple teams so they can see where their gaps are at and that identification and things of that sort. 125 00:09:38,460 --> 00:09:48,040 And then lastly, before I pass it back to you, you know, learning the defensive side is always critical for us. 126 00:09:48,040 --> 00:09:55,480 So, you know, we have to always engage with our own SOC and our own GTIC to start learning how these adversaries are simulating and things like that. 127 00:09:55,480 --> 00:10:02,280 So, you know, going back to the AI thing, you know, we're focusing on it from a defensive perspective. 128 00:10:02,320 --> 00:10:09,600 But when things start happening for the blue team, and we're going up against that, when they're using AI as well, it's going to be it's going to be tough. 129 00:10:10,080 --> 00:10:12,500 We're always going to have to have a brain plugged in somewhere, though. 130 00:10:12,500 --> 00:10:15,820 I don't ever think it's going to replace us at this point. 131 00:10:15,820 --> 00:10:16,880 But yeah, all right. 132 00:10:16,880 --> 00:10:19,500 I'll pass it back to you guys unless someone else has a comment on it. 133 00:10:20,240 --> 00:10:26,480 Well, do you guys have any words of wisdom to all the thousands of red teamers who are going to be watching this video? 134 00:10:27,960 --> 00:10:29,620 Yeah, I can start that one off. 135 00:10:30,740 --> 00:10:40,340 I think the most important thing, when you're starting in red teaming, is learning how to really think like an attacker, right? 136 00:10:40,420 --> 00:10:47,060 Like, you want to be able to adopt that mindset, we're using the same TTPs, and you're showing these real world scenarios to your client. 137 00:10:47,480 --> 00:10:58,140 And I think where it gets really hairy, and the most, to me, it's the most important thing is being adaptable and being creative with whatever you're doing. 138 00:10:58,720 --> 00:11:02,620 Because you're going to encounter so many different things on a red team. 139 00:11:02,760 --> 00:11:16,400 And you're going to have to come up with stuff on the fly, whether it's during a phone pretext, or if you're phishing someone and they have really, really, you know, robust spam filtering , how are you going to get your payload to them, right? 140 00:11:17,200 --> 00:11:24,700 There may or may not have been someone on our red team the other day that sent a fax with a malicious payload with the link. 141 00:11:24,700 --> 00:11:30,440 So it's really about being adaptive and creative and being able to problem solve creatively, right? 142 00:11:30,500 --> 00:11:37,660 While also maintaining keeping those same, you know, TTPs and stuff that you're showing a real world attack to your client. 143 00:11:38,400 --> 00:11:42,800 And yeah, I'll pass it over to Ari or Keith, if you guys have anything to add to that. 144 00:11:43,240 --> 00:11:49,700 Yeah, I'll take it to kind of relating to, you know, techniques and things, you have to stay hungry. 145 00:11:50,000 --> 00:11:57,360 You know, there's, there's a there's a saying that in this business, you know, it's almost like dog years, like you age pretty quick. 146 00:11:57,360 --> 00:12:00,980 So you have to stay enthusiastic about what you're doing. 147 00:12:00,980 --> 00:12:05,520 And you have to be doing it for the right reasons to keep yourself focused on what you need to learn. 148 00:12:05,520 --> 00:12:17,860 So that's one of the biggest things I would think it, I guess my age group I can recommend is, you know, do it for the right reasons and stay hungry with it, you're going to learning the techniques and things like that's going to come along with it. 149 00:12:17,860 --> 00:12:27,540 So don't shy away from physical aspects, physical is kind of you'll see, you know, the three of us all mentioned physical, physical pen trial, pen testing and things. 150 00:12:28,440 --> 00:12:36,720 That kind of goes along with the attitude, you need to be a red teamer, because it's forcing you to, to think out of the box, sometimes on the fly multiple times. 151 00:12:37,380 --> 00:12:40,420 You know, it's just that mindset of I'm a real bad guy. 152 00:12:40,440 --> 00:12:41,960 What can I do here? 153 00:12:41,980 --> 00:12:47,360 This has been done 1000 times, but this has never been thought about being done, I'm going to do it and it's going to work. 154 00:12:47,660 --> 00:12:51,180 And sometimes the organization that you're targeting is not going to recognize that. 155 00:12:51,720 --> 00:12:53,820 So, yeah, Ari. 156 00:12:54,760 --> 00:12:59,500 Yeah, yeah, actually, for one thing, I agree with both of my colleagues 100%. 157 00:12:59,500 --> 00:13:01,840 That's great advice. 158 00:13:01,840 --> 00:13:06,080 I would say, just to kind of sprinkle on maybe a little bit of specificity. 159 00:13:06,080 --> 00:13:25,020 I'm a huge proponent of, well, really anything Rostam does is amazing, but specifically his CRTO and CRTO2 courses, the Certified Red Team Operator, I think those are fantastic jumping off points to really start to get into a lot of this and, and kind of help to establish more of a baseline. 160 00:13:25,020 --> 00:13:37,400 If you have that baseline kind of set, then you can take Will's advice and kind of be able to think really, really creatively on how to deviate from that once the opportunity arises that you that you find that you have to. 161 00:13:37,420 --> 00:13:47,060 And then of course, to jump off of Tony's point, you have to make sure that you are sharpening your social engineering skills just as much as any other skill. 162 00:13:47,060 --> 00:13:51,620 It's one of those that I know a lot of us do like to avoid, if at all possible. 163 00:13:51,620 --> 00:13:59,180 A lot of us really found ourselves getting more and more into the side of IT things because we don't want to make a bunch of phone calls to strangers. 164 00:13:59,180 --> 00:14:10,440 So I think that's one thing that a lot of people do tend to kind of try to stay away from, but that is not super dissimilar to just not having a Phillips head in your toolbox. 165 00:14:11,420 --> 00:14:33,900 It's a glaring gap there that you're going to want to address because it's a pretty crucial tool, especially when it comes to red teaming, because so often it is a social engineering angle that ends up getting you that crucial foothold into the rest, where then your technical acumen can come through and kind of help you out and help you stay evasive and adroit. 166 00:14:33,900 --> 00:14:40,180 But man, to get that foothold, I've seen it play out more times than not that it has to be talking to Cheryl from accounting. 167 00:14:40,180 --> 00:14:41,760 That's the only way to get it. 168 00:14:42,740 --> 00:14:44,040 Yeah, solid advice. 169 00:14:44,720 --> 00:14:45,520 Awesome, guys. 170 00:14:45,520 --> 00:14:53,420 Well, I got to ask you, what do you think the importance of sponsoring community-driven activities such as the Red Team Village would be? 171 00:14:55,280 --> 00:14:56,380 Yeah, so I'll take it. 172 00:14:56,380 --> 00:14:58,020 I've been around the block a bit. 173 00:14:58,080 --> 00:15:01,560 I remember, I think my first DEF CON was 14. 174 00:15:02,720 --> 00:15:08,560 I've been, you know, going to DEF CON for a while and different events and things like that. 175 00:15:08,560 --> 00:15:20,160 And I remember before I was even on Offensive Security, being in there and going to different talks and, you know, learning from different people and wanting to be that guy, right? 176 00:15:20,160 --> 00:15:25,820 And trying to cultivate that next generation of red teamer, that's where you want to do it. 177 00:15:25,820 --> 00:15:36,740 And we want to help organizations be able to do that, be able to sponsor these events so that they can, you know, draw that community in and learn and bring up the next crop. 178 00:15:36,760 --> 00:15:38,680 You know, we always hear about the shortage. 179 00:15:38,680 --> 00:15:44,540 There's plenty of people that want to do this because it's a great field, right? 180 00:15:44,580 --> 00:15:49,820 But finding somebody that has all the things that need to be there, it's hard to do. 181 00:15:49,820 --> 00:15:54,360 So that gives us a little bit of exposure too to be able to engage the community. 182 00:15:54,620 --> 00:15:58,240 Yeah, super important to give back that way. 183 00:16:00,260 --> 00:16:04,840 Well, I guess that's mostly it for all of our questions. 184 00:16:04,840 --> 00:16:07,620 We're just going to end with some final words here. 185 00:16:07,700 --> 00:16:10,740 Any comment from Omar before then? 186 00:16:11,600 --> 00:16:17,700 No, once again, you know, thank you for your time here today and thank you for everybody watching and supporting the community. 187 00:16:17,700 --> 00:16:34,720 I think that to echo what Keith just mentioned, you know, to make sure that we have the new pipeline of, I call it my replacements, you know, actually contributing to the community like you're actually doing is superb. 188 00:16:34,740 --> 00:16:40,320 So thank you again for your support, not only at DEF CON, but throughout the year, you know, you guys are supporting us. 189 00:16:40,480 --> 00:16:44,180 So once again, you know, thank you Optif and thank you to the team. 190 00:16:46,120 --> 00:16:46,720 Absolutely. 191 00:16:46,720 --> 00:16:47,400 All right. 192 00:16:47,760 --> 00:16:48,920 Thanks, guys. 193 00:16:49,040 --> 00:16:50,720 Yeah, so much.