[00:05.050 --> 00:05.630]  Awesome.
[00:05.630 --> 00:07.430]  Thank you, everybody, for joining today.
[00:07.530 --> 00:09.810]  First of all, thank you, Optiv.
[00:09.910 --> 00:12.770]  You have been an amazing partner since day one.
[00:12.770 --> 00:18.270]  Not only for supporting us this year, but you have supported us for quite some time.
[00:20.230 --> 00:24.170]  So we have a few questions that the team actually has for you.
[00:24.170 --> 00:29.190]  And what I would like to do is not to steal a little bit more of your time and just pass it up to John.
[00:29.370 --> 00:31.970]  And then we can kick it from there.
[00:32.810 --> 00:33.550]  Hey, guys.
[00:33.550 --> 00:35.130]  Thanks for joining us again.
[00:35.130 --> 00:38.990]  I appreciate your guys' contribution and support.
[00:39.710 --> 00:41.830]  I guess I'll just start it off.
[00:42.370 --> 00:43.890]  Introductions for our guests.
[00:43.890 --> 00:44.650]  Who are you?
[00:44.650 --> 00:45.690]  What do you do?
[00:45.690 --> 00:46.830]  Maybe your school?
[00:47.090 --> 00:48.230]  But yeah.
[00:48.850 --> 00:49.530]  Yeah.
[00:49.530 --> 00:50.390]  Keith Tomey.
[00:50.390 --> 00:53.430]  I'm a Technical Manager here at Optiv Tech and Pen.
[00:53.530 --> 00:55.470]  Been here about five years now.
[00:55.550 --> 00:58.550]  Been in the industry for over 28 years.
[00:58.550 --> 01:00.630]  The last time directly in Offensive Security.
[01:00.630 --> 01:09.950]  So my role here from a technical management perspective is to help the team build out their methodologies, tooling, things of that sort.
[01:10.250 --> 01:15.130]  Specialties would be physical penetration testing as well as adversarial simulation.
[01:15.130 --> 01:17.230]  So that's my spiel.
[01:21.450 --> 01:21.910]  Cool.
[01:21.910 --> 01:22.150]  Yeah.
[01:22.150 --> 01:23.310]  My name is Will Winkler.
[01:23.310 --> 01:25.190]  I'm also a consultant here at Optiv.
[01:25.190 --> 01:27.470]  I work on the attack and penetration team.
[01:27.550 --> 01:30.610]  I'm actually one of the red team operators here at Optiv.
[01:31.170 --> 01:35.830]  And along with that, I kind of specialize in physical engagements and social engineering.
[01:37.690 --> 01:38.650]  Hey, everyone.
[01:38.650 --> 01:39.650]  I'm Ari Ansarouche.
[01:39.650 --> 01:41.210]  Everyone's welcome to call me Ari.
[01:41.370 --> 01:46.110]  I am also a senior consultant at Optiv's attack and pen team.
[01:46.150 --> 01:51.150]  I have also come to specialize in some of the more physical side of things.
[01:51.210 --> 01:52.790]  It's also what I enjoy the most.
[01:52.790 --> 01:54.190]  So that kind of works out.
[01:54.230 --> 01:59.210]  And I graduated from the University of Richmond with a degree in information security.
[02:00.970 --> 02:01.870]  Thank you, Ari.
[02:03.110 --> 02:04.710]  Next question.
[02:04.830 --> 02:08.590]  Why does your company believe red team operations are important?
[02:10.170 --> 02:20.030]  So, you know, there's a few points here that I kind of want to bring up when it comes to why we believe red team operations are important.
[02:20.490 --> 02:25.490]  I think first and foremost, is identifying vulnerabilities, right?
[02:25.490 --> 02:33.130]  So whenever we're going into a red team operation, we obviously want to identify those vulnerabilities, you know, for our potential clients.
[02:34.210 --> 02:37.730]  Specifically, you know, we're doing this by emulating real world attacks.
[02:37.730 --> 02:43.110]  And the reason we're doing that is because we want to use the same TTPs that real attackers are using.
[02:43.330 --> 02:46.230]  That kind of moves into my second point.
[02:46.670 --> 02:50.930]  That would be to enhance those defensive strategies, for those organizations.
[02:50.930 --> 02:54.050]  And that may be a logical security measure.
[02:54.050 --> 03:03.190]  It could be something as, you know, social engineering, security awareness, any of those different attack vectors, right?
[03:03.190 --> 03:07.250]  So we want to emulate any of those that could be potentially real world.
[03:07.250 --> 03:18.610]  And I think, you know, once we sort of give those opportunities to those clients and those organizations, that's going to allow them to be better trained and prepared, right?
[03:18.610 --> 03:33.250]  So a lot of times when we go into these adversarial simulations, is what we call it, when we move into these, there's only one or two people on the team that actually know from the client side that actually know that we're going to be performing these.
[03:33.250 --> 03:42.550]  So you get to see from a real world, you know, perspective, you know, that client gets to see how their IR is really responding to these things.
[03:42.550 --> 03:44.430]  What does the dwell time look like?
[03:44.730 --> 03:55.130]  And it lets us kind of give them, you know, different suggestions to remediate and bolster their defenses, right?
[03:55.150 --> 04:04.830]  And when it comes to more robust clients, clients that have been working with us, you know, for multiple years, typically, it's a little bit harder to be able to breach them.
[04:04.930 --> 04:12.050]  But when we do find something, it helps us really fine tune those policies and playbooks that they already have in place.
[04:13.570 --> 04:14.290]  Awesome.
[04:15.510 --> 04:21.210]  With the advent of AI and mainstream, how do you see it affecting the industry?
[04:22.570 --> 04:23.850]  I can take that one.
[04:24.070 --> 04:25.990]  It's so fascinating.
[04:25.990 --> 04:33.190]  And I do wish that this was a little bit more of like a back and forth dialogue, because I don't, you know, want to pretend to be like an authority on this particular subject.
[04:33.890 --> 04:35.030]  Hey, welcome.
[04:35.030 --> 04:37.190]  You're welcome to if I make a weird point.
[04:37.690 --> 04:40.210]  But actually, slow down.
[04:40.210 --> 04:41.610]  A couple caveats here.
[04:41.690 --> 04:43.990]  Not an expert on this at all.
[04:43.990 --> 04:51.250]  I'm coming from, I think, about the level of knowledge that a lot of us are kind of sitting at in terms of our understanding of how it works and kind of where it's going.
[04:52.170 --> 04:56.630]  Caveat number two, it's constantly changing, constantly evolving.
[04:56.630 --> 05:08.710]  Just yesterday, I'm sure a lot of us have seen like OpenAI releases the beta code interpreter that allows ChatGBT to write, execute, and test its own code.
[05:08.730 --> 05:09.690]  That's huge.
[05:09.690 --> 05:13.910]  So I almost had to just rethink my entire answer when I found that out.
[05:13.910 --> 05:27.510]  But number three caveat, I think, is that my perspective, our perspective, us three here that work at Optiv, the perspective is going to come from the way that Optiv conducts their red teams and their assessments, which is a little bit quicker of a cycle,
[05:27.570 --> 05:28.970]  a little bit tighter of a cycle.
[05:29.090 --> 05:33.630]  Our red teams, for example, usually last between three and four weeks, give or take.
[05:33.770 --> 05:45.210]  So coming from that perspective, all those other caveats, right now, I'm pretty optimistic, actually, about the impact that it's going to have on our side of the industry.
[05:45.330 --> 05:54.970]  I think it's actually going to be not unlike when a lot of the more reliable, solid, heavy-duty automated scanning tools kind of came out.
[05:54.970 --> 05:56.810]  So like take Nessus, for example.
[05:57.770 --> 06:01.550]  We all kind of know that Nessus did have an impact.
[06:01.710 --> 06:03.270]  Those types of tools did.
[06:03.270 --> 06:12.750]  And I'm sure that there is kind of a subtle impact that it made where a lot of teams out there would probably be larger if it wasn't for the advent of some of those automated tools.
[06:12.750 --> 06:22.690]  But we also know how kind of limited they are and how, in order to get the most out of them, we still kind of have to have our wheels kind of turning.
[06:22.810 --> 06:29.110]  We have to be here guiding everything, making sure that we're kind of pointing it in the right directions.
[06:29.110 --> 06:31.770]  So I picture it going similarly.
[06:31.770 --> 06:36.350]  I know it is kind of a false equivalence because AI is just capable of so much more.
[06:36.710 --> 06:47.810]  But as far as kind of where it is right now, as far as large language models, I think that it is going to be more of a tool that we can constantly reference, that speeds up our abilities.
[06:47.810 --> 06:52.910]  I use it all the time for scripting and bash one-liners and just little references here and there.
[06:52.930 --> 07:02.590]  But as far as it replacing us and what we do day-to-day, as of right now, I'm not super, super worried until we really push over to general AI.
[07:02.590 --> 07:05.070]  And then, I mean, it's all over anyway.
[07:05.090 --> 07:07.990]  So everything changes after that.
[07:07.990 --> 07:10.270]  So that's kind of where I am on the subject.
[07:10.850 --> 07:11.350]  Okay.
[07:11.350 --> 07:15.590]  It's a little bit of a bleak ending, but yeah, I appreciate it.
[07:16.050 --> 07:18.550]  I'll hand over the questions to Greg now.
[07:18.830 --> 07:19.590]  Awesome.
[07:19.690 --> 07:20.790]  My name is Greg Oldham.
[07:20.790 --> 07:23.810]  I just want to thank you guys again for all your support.
[07:25.030 --> 07:31.370]  My question is, so how does your company see red teaming making more positive impacts?
[07:34.040 --> 07:35.760]  Yeah, I'll take it.
[07:35.900 --> 07:42.860]  So, you know, by nature for red teaming, right, we have to stay focused on what the overall goal of a red team is, a red team assessment.
[07:43.040 --> 07:47.460]  At the end of the day, we're there to try to help secure the client's environments, right?
[07:48.180 --> 07:56.100]  We do a lot of crazy, cool stuff, you know, developing exploits and pulling off some crazy attack chains and things like that.
[07:56.680 --> 08:01.420]  But we do have to stay focused on the fact that we're trying to secure the client environments.
[08:02.080 --> 08:06.820]  So for us at Optiv to get to that point, it involves a lot of different aspects, right?
[08:06.820 --> 08:09.400]  We're starting to move heavily into cloud testing.
[08:09.560 --> 08:20.180]  As everybody's moving off prem, we're moving right into, you know, leveraging Azure and AWS and GCP and some other things to start to move into that space.
[08:20.880 --> 08:29.260]  As I already talked about with artificial intelligence, we're actually already tooling that to a certain perspective for business intelligence.
[08:29.460 --> 08:33.980]  So red team isn't just about, you know, the router switches and computers.
[08:33.980 --> 08:39.320]  A lot of times it's about what kind of intelligence can we get about our target beforehand, right?
[08:39.320 --> 08:42.380]  What can we learn about their culture beforehand?
[08:42.680 --> 08:50.020]  So we're using a platform to do that and some other tooling to start to build up that intelligence on an organization.
[08:50.200 --> 08:55.240]  And in addition to the other normal things that you would look at for assets.
[08:56.760 --> 09:03.620]  Also, I would think that, too, like for a successful red team, the way we envision it, red teams are super helpful.
[09:03.900 --> 09:07.920]  But you want to help the client go along with that in the early stages.
[09:08.280 --> 09:16.060]  If they've never had penetration tests done or they've never had a purple team done and have us come in for a red team, it's going to be an ugly day for them.
[09:16.060 --> 09:18.120]  And it's probably going to be a super win for us, right?
[09:18.120 --> 09:19.800]  It's going to be easy to do.
[09:20.180 --> 09:23.300]  So usually we want to guide that from a company.
[09:23.300 --> 09:28.040]  We want to try to guide their maturity along before we even engage a red team.
[09:28.320 --> 09:38.400]  Start with comprehensives, you know, guide them in remediation there, move into purple teams so they can see where their gaps are at and that identification and things of that sort.
[09:38.460 --> 09:48.040]  And then lastly, before I pass it back to you, you know, learning the defensive side is always critical for us.
[09:48.040 --> 09:55.480]  So, you know, we have to always engage with our own SOC and our own GTIC to start learning how these adversaries are simulating and things like that.
[09:55.480 --> 10:02.280]  So, you know, going back to the AI thing, you know, we're focusing on it from a defensive perspective.
[10:02.320 --> 10:09.600]  But when things start happening for the blue team, and we're going up against that, when they're using AI as well, it's going to be it's going to be tough.
[10:10.080 --> 10:12.500]  We're always going to have to have a brain plugged in somewhere, though.
[10:12.500 --> 10:15.820]  I don't ever think it's going to replace us at this point.
[10:15.820 --> 10:16.880]  But yeah, all right.
[10:16.880 --> 10:19.500]  I'll pass it back to you guys unless someone else has a comment on it.
[10:20.240 --> 10:26.480]  Well, do you guys have any words of wisdom to all the thousands of red teamers who are going to be watching this video?
[10:27.960 --> 10:29.620]  Yeah, I can start that one off.
[10:30.740 --> 10:40.340]  I think the most important thing, when you're starting in red teaming, is learning how to really think like an attacker, right?
[10:40.420 --> 10:47.060]  Like, you want to be able to adopt that mindset, we're using the same TTPs, and you're showing these real world scenarios to your client.
[10:47.480 --> 10:58.140]  And I think where it gets really hairy, and the most, to me, it's the most important thing is being adaptable and being creative with whatever you're doing.
[10:58.720 --> 11:02.620]  Because you're going to encounter so many different things on a red team.
[11:02.760 --> 11:16.400]  And you're going to have to come up with stuff on the fly, whether it's during a phone pretext, or if you're phishing someone and they have really, really, you know, robust spam filtering , how are you going to get your payload to them, right?
[11:17.200 --> 11:24.700]  There may or may not have been someone on our red team the other day that sent a fax with a malicious payload with the link.
[11:24.700 --> 11:30.440]  So it's really about being adaptive and creative and being able to problem solve creatively, right?
[11:30.500 --> 11:37.660]  While also maintaining keeping those same, you know, TTPs and stuff that you're showing a real world attack to your client.
[11:38.400 --> 11:42.800]  And yeah, I'll pass it over to Ari or Keith, if you guys have anything to add to that.
[11:43.240 --> 11:49.700]  Yeah, I'll take it to kind of relating to, you know, techniques and things, you have to stay hungry.
[11:50.000 --> 11:57.360]  You know, there's, there's a there's a saying that in this business, you know, it's almost like dog years, like you age pretty quick.
[11:57.360 --> 12:00.980]  So you have to stay enthusiastic about what you're doing.
[12:00.980 --> 12:05.520]  And you have to be doing it for the right reasons to keep yourself focused on what you need to learn.
[12:05.520 --> 12:17.860]  So that's one of the biggest things I would think it, I guess my age group I can recommend is, you know, do it for the right reasons and stay hungry with it, you're going to learning the techniques and things like that's going to come along with it.
[12:17.860 --> 12:27.540]  So don't shy away from physical aspects, physical is kind of you'll see, you know, the three of us all mentioned physical, physical pen trial, pen testing and things.
[12:28.440 --> 12:36.720]  That kind of goes along with the attitude, you need to be a red teamer, because it's forcing you to, to think out of the box, sometimes on the fly multiple times.
[12:37.380 --> 12:40.420]  You know, it's just that mindset of I'm a real bad guy.
[12:40.440 --> 12:41.960]  What can I do here?
[12:41.980 --> 12:47.360]  This has been done 1000 times, but this has never been thought about being done, I'm going to do it and it's going to work.
[12:47.660 --> 12:51.180]  And sometimes the organization that you're targeting is not going to recognize that.
[12:51.720 --> 12:53.820]  So, yeah, Ari.
[12:54.760 --> 12:59.500]  Yeah, yeah, actually, for one thing, I agree with both of my colleagues 100%.
[12:59.500 --> 13:01.840]  That's great advice.
[13:01.840 --> 13:06.080]  I would say, just to kind of sprinkle on maybe a little bit of specificity.
[13:06.080 --> 13:25.020]  I'm a huge proponent of, well, really anything Rostam does is amazing, but specifically his CRTO and CRTO2 courses, the Certified Red Team Operator, I think those are fantastic jumping off points to really start to get into a lot of this and, and kind of help to establish more of a baseline.
[13:25.020 --> 13:37.400]  If you have that baseline kind of set, then you can take Will's advice and kind of be able to think really, really creatively on how to deviate from that once the opportunity arises that you that you find that you have to.
[13:37.420 --> 13:47.060]  And then of course, to jump off of Tony's point, you have to make sure that you are sharpening your social engineering skills just as much as any other skill.
[13:47.060 --> 13:51.620]  It's one of those that I know a lot of us do like to avoid, if at all possible.
[13:51.620 --> 13:59.180]  A lot of us really found ourselves getting more and more into the side of IT things because we don't want to make a bunch of phone calls to strangers.
[13:59.180 --> 14:10.440]  So I think that's one thing that a lot of people do tend to kind of try to stay away from, but that is not super dissimilar to just not having a Phillips head in your toolbox.
[14:11.420 --> 14:33.900]  It's a glaring gap there that you're going to want to address because it's a pretty crucial tool, especially when it comes to red teaming, because so often it is a social engineering angle that ends up getting you that crucial foothold into the rest, where then your technical acumen can come through and kind of help you out and help you stay evasive and adroit.
[14:33.900 --> 14:40.180]  But man, to get that foothold, I've seen it play out more times than not that it has to be talking to Cheryl from accounting.
[14:40.180 --> 14:41.760]  That's the only way to get it.
[14:42.740 --> 14:44.040]  Yeah, solid advice.
[14:44.720 --> 14:45.520]  Awesome, guys.
[14:45.520 --> 14:53.420]  Well, I got to ask you, what do you think the importance of sponsoring community-driven activities such as the Red Team Village would be?
[14:55.280 --> 14:56.380]  Yeah, so I'll take it.
[14:56.380 --> 14:58.020]  I've been around the block a bit.
[14:58.080 --> 15:01.560]  I remember, I think my first DEF CON was 14.
[15:02.720 --> 15:08.560]  I've been, you know, going to DEF CON for a while and different events and things like that.
[15:08.560 --> 15:20.160]  And I remember before I was even on Offensive Security, being in there and going to different talks and, you know, learning from different people and wanting to be that guy, right?
[15:20.160 --> 15:25.820]  And trying to cultivate that next generation of red teamer, that's where you want to do it.
[15:25.820 --> 15:36.740]  And we want to help organizations be able to do that, be able to sponsor these events so that they can, you know, draw that community in and learn and bring up the next crop.
[15:36.760 --> 15:38.680]  You know, we always hear about the shortage.
[15:38.680 --> 15:44.540]  There's plenty of people that want to do this because it's a great field, right?
[15:44.580 --> 15:49.820]  But finding somebody that has all the things that need to be there, it's hard to do.
[15:49.820 --> 15:54.360]  So that gives us a little bit of exposure too to be able to engage the community.
[15:54.620 --> 15:58.240]  Yeah, super important to give back that way.
[16:00.260 --> 16:04.840]  Well, I guess that's mostly it for all of our questions.
[16:04.840 --> 16:07.620]  We're just going to end with some final words here.
[16:07.700 --> 16:10.740]  Any comment from Omar before then?
[16:11.600 --> 16:17.700]  No, once again, you know, thank you for your time here today and thank you for everybody watching and supporting the community.
[16:17.700 --> 16:34.720]  I think that to echo what Keith just mentioned, you know, to make sure that we have the new pipeline of, I call it my replacements, you know, actually contributing to the community like you're actually doing is superb.
[16:34.740 --> 16:40.320]  So thank you again for your support, not only at DEF CON, but throughout the year, you know, you guys are supporting us.
[16:40.480 --> 16:44.180]  So once again, you know, thank you Optif and thank you to the team.
[16:46.120 --> 16:46.720]  Absolutely.
[16:46.720 --> 16:47.400]  All right.
[16:47.760 --> 16:48.920]  Thanks, guys.
[16:49.040 --> 16:50.720]  Yeah, so much.