WEBVTT 00:05.050 --> 00:05.630 Awesome. 00:05.630 --> 00:07.430 Thank you, everybody, for joining today. 00:07.530 --> 00:09.810 First of all, thank you, Optiv. 00:09.910 --> 00:12.770 You have been an amazing partner since day one. 00:12.770 --> 00:18.270 Not only for supporting us this year, but you have supported us for quite some time. 00:20.230 --> 00:24.170 So we have a few questions that the team actually has for you. 00:24.170 --> 00:29.190 And what I would like to do is not to steal a little bit more of your time and just pass it up to John. 00:29.370 --> 00:31.970 And then we can kick it from there. 00:32.810 --> 00:33.550 Hey, guys. 00:33.550 --> 00:35.130 Thanks for joining us again. 00:35.130 --> 00:38.990 I appreciate your guys' contribution and support. 00:39.710 --> 00:41.830 I guess I'll just start it off. 00:42.370 --> 00:43.890 Introductions for our guests. 00:43.890 --> 00:44.650 Who are you? 00:44.650 --> 00:45.690 What do you do? 00:45.690 --> 00:46.830 Maybe your school? 00:47.090 --> 00:48.230 But yeah. 00:48.850 --> 00:49.530 Yeah. 00:49.530 --> 00:50.390 Keith Tomey. 00:50.390 --> 00:53.430 I'm a Technical Manager here at Optiv Tech and Pen. 00:53.530 --> 00:55.470 Been here about five years now. 00:55.550 --> 00:58.550 Been in the industry for over 28 years. 00:58.550 --> 01:00.630 The last time directly in Offensive Security. 01:00.630 --> 01:09.950 So my role here from a technical management perspective is to help the team build out their methodologies, tooling, things of that sort. 01:10.250 --> 01:15.130 Specialties would be physical penetration testing as well as adversarial simulation. 01:15.130 --> 01:17.230 So that's my spiel. 01:21.450 --> 01:21.910 Cool. 01:21.910 --> 01:22.150 Yeah. 01:22.150 --> 01:23.310 My name is Will Winkler. 01:23.310 --> 01:25.190 I'm also a consultant here at Optiv. 01:25.190 --> 01:27.470 I work on the attack and penetration team. 01:27.550 --> 01:30.610 I'm actually one of the red team operators here at Optiv. 01:31.170 --> 01:35.830 And along with that, I kind of specialize in physical engagements and social engineering. 01:37.690 --> 01:38.650 Hey, everyone. 01:38.650 --> 01:39.650 I'm Ari Ansarouche. 01:39.650 --> 01:41.210 Everyone's welcome to call me Ari. 01:41.370 --> 01:46.110 I am also a senior consultant at Optiv's attack and pen team. 01:46.150 --> 01:51.150 I have also come to specialize in some of the more physical side of things. 01:51.210 --> 01:52.790 It's also what I enjoy the most. 01:52.790 --> 01:54.190 So that kind of works out. 01:54.230 --> 01:59.210 And I graduated from the University of Richmond with a degree in information security. 02:00.970 --> 02:01.870 Thank you, Ari. 02:03.110 --> 02:04.710 Next question. 02:04.830 --> 02:08.590 Why does your company believe red team operations are important? 02:10.170 --> 02:20.030 So, you know, there's a few points here that I kind of want to bring up when it comes to why we believe red team operations are important. 02:20.490 --> 02:25.490 I think first and foremost, is identifying vulnerabilities, right? 02:25.490 --> 02:33.130 So whenever we're going into a red team operation, we obviously want to identify those vulnerabilities, you know, for our potential clients. 02:34.210 --> 02:37.730 Specifically, you know, we're doing this by emulating real world attacks. 02:37.730 --> 02:43.110 And the reason we're doing that is because we want to use the same TTPs that real attackers are using. 02:43.330 --> 02:46.230 That kind of moves into my second point. 02:46.670 --> 02:50.930 That would be to enhance those defensive strategies, for those organizations. 02:50.930 --> 02:54.050 And that may be a logical security measure. 02:54.050 --> 03:03.190 It could be something as, you know, social engineering, security awareness, any of those different attack vectors, right? 03:03.190 --> 03:07.250 So we want to emulate any of those that could be potentially real world. 03:07.250 --> 03:18.610 And I think, you know, once we sort of give those opportunities to those clients and those organizations, that's going to allow them to be better trained and prepared, right? 03:18.610 --> 03:33.250 So a lot of times when we go into these adversarial simulations, is what we call it, when we move into these, there's only one or two people on the team that actually know from the client side that actually know that we're going to be performing these. 03:33.250 --> 03:42.550 So you get to see from a real world, you know, perspective, you know, that client gets to see how their IR is really responding to these things. 03:42.550 --> 03:44.430 What does the dwell time look like? 03:44.730 --> 03:55.130 And it lets us kind of give them, you know, different suggestions to remediate and bolster their defenses, right? 03:55.150 --> 04:04.830 And when it comes to more robust clients, clients that have been working with us, you know, for multiple years, typically, it's a little bit harder to be able to breach them. 04:04.930 --> 04:12.050 But when we do find something, it helps us really fine tune those policies and playbooks that they already have in place. 04:13.570 --> 04:14.290 Awesome. 04:15.510 --> 04:21.210 With the advent of AI and mainstream, how do you see it affecting the industry? 04:22.570 --> 04:23.850 I can take that one. 04:24.070 --> 04:25.990 It's so fascinating. 04:25.990 --> 04:33.190 And I do wish that this was a little bit more of like a back and forth dialogue, because I don't, you know, want to pretend to be like an authority on this particular subject. 04:33.890 --> 04:35.030 Hey, welcome. 04:35.030 --> 04:37.190 You're welcome to if I make a weird point. 04:37.690 --> 04:40.210 But actually, slow down. 04:40.210 --> 04:41.610 A couple caveats here. 04:41.690 --> 04:43.990 Not an expert on this at all. 04:43.990 --> 04:51.250 I'm coming from, I think, about the level of knowledge that a lot of us are kind of sitting at in terms of our understanding of how it works and kind of where it's going. 04:52.170 --> 04:56.630 Caveat number two, it's constantly changing, constantly evolving. 04:56.630 --> 05:08.710 Just yesterday, I'm sure a lot of us have seen like OpenAI releases the beta code interpreter that allows ChatGBT to write, execute, and test its own code. 05:08.730 --> 05:09.690 That's huge. 05:09.690 --> 05:13.910 So I almost had to just rethink my entire answer when I found that out. 05:13.910 --> 05:27.510 But number three caveat, I think, is that my perspective, our perspective, us three here that work at Optiv, the perspective is going to come from the way that Optiv conducts their red teams and their assessments, which is a little bit quicker of a cycle, 05:27.570 --> 05:28.970 a little bit tighter of a cycle. 05:29.090 --> 05:33.630 Our red teams, for example, usually last between three and four weeks, give or take. 05:33.770 --> 05:45.210 So coming from that perspective, all those other caveats, right now, I'm pretty optimistic, actually, about the impact that it's going to have on our side of the industry. 05:45.330 --> 05:54.970 I think it's actually going to be not unlike when a lot of the more reliable, solid, heavy-duty automated scanning tools kind of came out. 05:54.970 --> 05:56.810 So like take Nessus, for example. 05:57.770 --> 06:01.550 We all kind of know that Nessus did have an impact. 06:01.710 --> 06:03.270 Those types of tools did. 06:03.270 --> 06:12.750 And I'm sure that there is kind of a subtle impact that it made where a lot of teams out there would probably be larger if it wasn't for the advent of some of those automated tools. 06:12.750 --> 06:22.690 But we also know how kind of limited they are and how, in order to get the most out of them, we still kind of have to have our wheels kind of turning. 06:22.810 --> 06:29.110 We have to be here guiding everything, making sure that we're kind of pointing it in the right directions. 06:29.110 --> 06:31.770 So I picture it going similarly. 06:31.770 --> 06:36.350 I know it is kind of a false equivalence because AI is just capable of so much more. 06:36.710 --> 06:47.810 But as far as kind of where it is right now, as far as large language models, I think that it is going to be more of a tool that we can constantly reference, that speeds up our abilities. 06:47.810 --> 06:52.910 I use it all the time for scripting and bash one-liners and just little references here and there. 06:52.930 --> 07:02.590 But as far as it replacing us and what we do day-to-day, as of right now, I'm not super, super worried until we really push over to general AI. 07:02.590 --> 07:05.070 And then, I mean, it's all over anyway. 07:05.090 --> 07:07.990 So everything changes after that. 07:07.990 --> 07:10.270 So that's kind of where I am on the subject. 07:10.850 --> 07:11.350 Okay. 07:11.350 --> 07:15.590 It's a little bit of a bleak ending, but yeah, I appreciate it. 07:16.050 --> 07:18.550 I'll hand over the questions to Greg now. 07:18.830 --> 07:19.590 Awesome. 07:19.690 --> 07:20.790 My name is Greg Oldham. 07:20.790 --> 07:23.810 I just want to thank you guys again for all your support. 07:25.030 --> 07:31.370 My question is, so how does your company see red teaming making more positive impacts? 07:34.040 --> 07:35.760 Yeah, I'll take it. 07:35.900 --> 07:42.860 So, you know, by nature for red teaming, right, we have to stay focused on what the overall goal of a red team is, a red team assessment. 07:43.040 --> 07:47.460 At the end of the day, we're there to try to help secure the client's environments, right? 07:48.180 --> 07:56.100 We do a lot of crazy, cool stuff, you know, developing exploits and pulling off some crazy attack chains and things like that. 07:56.680 --> 08:01.420 But we do have to stay focused on the fact that we're trying to secure the client environments. 08:02.080 --> 08:06.820 So for us at Optiv to get to that point, it involves a lot of different aspects, right? 08:06.820 --> 08:09.400 We're starting to move heavily into cloud testing. 08:09.560 --> 08:20.180 As everybody's moving off prem, we're moving right into, you know, leveraging Azure and AWS and GCP and some other things to start to move into that space. 08:20.880 --> 08:29.260 As I already talked about with artificial intelligence, we're actually already tooling that to a certain perspective for business intelligence. 08:29.460 --> 08:33.980 So red team isn't just about, you know, the router switches and computers. 08:33.980 --> 08:39.320 A lot of times it's about what kind of intelligence can we get about our target beforehand, right? 08:39.320 --> 08:42.380 What can we learn about their culture beforehand? 08:42.680 --> 08:50.020 So we're using a platform to do that and some other tooling to start to build up that intelligence on an organization. 08:50.200 --> 08:55.240 And in addition to the other normal things that you would look at for assets. 08:56.760 --> 09:03.620 Also, I would think that, too, like for a successful red team, the way we envision it, red teams are super helpful. 09:03.900 --> 09:07.920 But you want to help the client go along with that in the early stages. 09:08.280 --> 09:16.060 If they've never had penetration tests done or they've never had a purple team done and have us come in for a red team, it's going to be an ugly day for them. 09:16.060 --> 09:18.120 And it's probably going to be a super win for us, right? 09:18.120 --> 09:19.800 It's going to be easy to do. 09:20.180 --> 09:23.300 So usually we want to guide that from a company. 09:23.300 --> 09:28.040 We want to try to guide their maturity along before we even engage a red team. 09:28.320 --> 09:38.400 Start with comprehensives, you know, guide them in remediation there, move into purple teams so they can see where their gaps are at and that identification and things of that sort. 09:38.460 --> 09:48.040 And then lastly, before I pass it back to you, you know, learning the defensive side is always critical for us. 09:48.040 --> 09:55.480 So, you know, we have to always engage with our own SOC and our own GTIC to start learning how these adversaries are simulating and things like that. 09:55.480 --> 10:02.280 So, you know, going back to the AI thing, you know, we're focusing on it from a defensive perspective. 10:02.320 --> 10:09.600 But when things start happening for the blue team, and we're going up against that, when they're using AI as well, it's going to be it's going to be tough. 10:10.080 --> 10:12.500 We're always going to have to have a brain plugged in somewhere, though. 10:12.500 --> 10:15.820 I don't ever think it's going to replace us at this point. 10:15.820 --> 10:16.880 But yeah, all right. 10:16.880 --> 10:19.500 I'll pass it back to you guys unless someone else has a comment on it. 10:20.240 --> 10:26.480 Well, do you guys have any words of wisdom to all the thousands of red teamers who are going to be watching this video? 10:27.960 --> 10:29.620 Yeah, I can start that one off. 10:30.740 --> 10:40.340 I think the most important thing, when you're starting in red teaming, is learning how to really think like an attacker, right? 10:40.420 --> 10:47.060 Like, you want to be able to adopt that mindset, we're using the same TTPs, and you're showing these real world scenarios to your client. 10:47.480 --> 10:58.140 And I think where it gets really hairy, and the most, to me, it's the most important thing is being adaptable and being creative with whatever you're doing. 10:58.720 --> 11:02.620 Because you're going to encounter so many different things on a red team. 11:02.760 --> 11:16.400 And you're going to have to come up with stuff on the fly, whether it's during a phone pretext, or if you're phishing someone and they have really, really, you know, robust spam filtering , how are you going to get your payload to them, right? 11:17.200 --> 11:24.700 There may or may not have been someone on our red team the other day that sent a fax with a malicious payload with the link. 11:24.700 --> 11:30.440 So it's really about being adaptive and creative and being able to problem solve creatively, right? 11:30.500 --> 11:37.660 While also maintaining keeping those same, you know, TTPs and stuff that you're showing a real world attack to your client. 11:38.400 --> 11:42.800 And yeah, I'll pass it over to Ari or Keith, if you guys have anything to add to that. 11:43.240 --> 11:49.700 Yeah, I'll take it to kind of relating to, you know, techniques and things, you have to stay hungry. 11:50.000 --> 11:57.360 You know, there's, there's a there's a saying that in this business, you know, it's almost like dog years, like you age pretty quick. 11:57.360 --> 12:00.980 So you have to stay enthusiastic about what you're doing. 12:00.980 --> 12:05.520 And you have to be doing it for the right reasons to keep yourself focused on what you need to learn. 12:05.520 --> 12:17.860 So that's one of the biggest things I would think it, I guess my age group I can recommend is, you know, do it for the right reasons and stay hungry with it, you're going to learning the techniques and things like that's going to come along with it. 12:17.860 --> 12:27.540 So don't shy away from physical aspects, physical is kind of you'll see, you know, the three of us all mentioned physical, physical pen trial, pen testing and things. 12:28.440 --> 12:36.720 That kind of goes along with the attitude, you need to be a red teamer, because it's forcing you to, to think out of the box, sometimes on the fly multiple times. 12:37.380 --> 12:40.420 You know, it's just that mindset of I'm a real bad guy. 12:40.440 --> 12:41.960 What can I do here? 12:41.980 --> 12:47.360 This has been done 1000 times, but this has never been thought about being done, I'm going to do it and it's going to work. 12:47.660 --> 12:51.180 And sometimes the organization that you're targeting is not going to recognize that. 12:51.720 --> 12:53.820 So, yeah, Ari. 12:54.760 --> 12:59.500 Yeah, yeah, actually, for one thing, I agree with both of my colleagues 100%. 12:59.500 --> 13:01.840 That's great advice. 13:01.840 --> 13:06.080 I would say, just to kind of sprinkle on maybe a little bit of specificity. 13:06.080 --> 13:25.020 I'm a huge proponent of, well, really anything Rostam does is amazing, but specifically his CRTO and CRTO2 courses, the Certified Red Team Operator, I think those are fantastic jumping off points to really start to get into a lot of this and, and kind of help to establish more of a baseline. 13:25.020 --> 13:37.400 If you have that baseline kind of set, then you can take Will's advice and kind of be able to think really, really creatively on how to deviate from that once the opportunity arises that you that you find that you have to. 13:37.420 --> 13:47.060 And then of course, to jump off of Tony's point, you have to make sure that you are sharpening your social engineering skills just as much as any other skill. 13:47.060 --> 13:51.620 It's one of those that I know a lot of us do like to avoid, if at all possible. 13:51.620 --> 13:59.180 A lot of us really found ourselves getting more and more into the side of IT things because we don't want to make a bunch of phone calls to strangers. 13:59.180 --> 14:10.440 So I think that's one thing that a lot of people do tend to kind of try to stay away from, but that is not super dissimilar to just not having a Phillips head in your toolbox. 14:11.420 --> 14:33.900 It's a glaring gap there that you're going to want to address because it's a pretty crucial tool, especially when it comes to red teaming, because so often it is a social engineering angle that ends up getting you that crucial foothold into the rest, where then your technical acumen can come through and kind of help you out and help you stay evasive and adroit. 14:33.900 --> 14:40.180 But man, to get that foothold, I've seen it play out more times than not that it has to be talking to Cheryl from accounting. 14:40.180 --> 14:41.760 That's the only way to get it. 14:42.740 --> 14:44.040 Yeah, solid advice. 14:44.720 --> 14:45.520 Awesome, guys. 14:45.520 --> 14:53.420 Well, I got to ask you, what do you think the importance of sponsoring community-driven activities such as the Red Team Village would be? 14:55.280 --> 14:56.380 Yeah, so I'll take it. 14:56.380 --> 14:58.020 I've been around the block a bit. 14:58.080 --> 15:01.560 I remember, I think my first DEF CON was 14. 15:02.720 --> 15:08.560 I've been, you know, going to DEF CON for a while and different events and things like that. 15:08.560 --> 15:20.160 And I remember before I was even on Offensive Security, being in there and going to different talks and, you know, learning from different people and wanting to be that guy, right? 15:20.160 --> 15:25.820 And trying to cultivate that next generation of red teamer, that's where you want to do it. 15:25.820 --> 15:36.740 And we want to help organizations be able to do that, be able to sponsor these events so that they can, you know, draw that community in and learn and bring up the next crop. 15:36.760 --> 15:38.680 You know, we always hear about the shortage. 15:38.680 --> 15:44.540 There's plenty of people that want to do this because it's a great field, right? 15:44.580 --> 15:49.820 But finding somebody that has all the things that need to be there, it's hard to do. 15:49.820 --> 15:54.360 So that gives us a little bit of exposure too to be able to engage the community. 15:54.620 --> 15:58.240 Yeah, super important to give back that way. 16:00.260 --> 16:04.840 Well, I guess that's mostly it for all of our questions. 16:04.840 --> 16:07.620 We're just going to end with some final words here. 16:07.700 --> 16:10.740 Any comment from Omar before then? 16:11.600 --> 16:17.700 No, once again, you know, thank you for your time here today and thank you for everybody watching and supporting the community. 16:17.700 --> 16:34.720 I think that to echo what Keith just mentioned, you know, to make sure that we have the new pipeline of, I call it my replacements, you know, actually contributing to the community like you're actually doing is superb. 16:34.740 --> 16:40.320 So thank you again for your support, not only at DEF CON, but throughout the year, you know, you guys are supporting us. 16:40.480 --> 16:44.180 So once again, you know, thank you Optif and thank you to the team. 16:46.120 --> 16:46.720 Absolutely. 16:46.720 --> 16:47.400 All right. 16:47.760 --> 16:48.920 Thanks, guys. 16:49.040 --> 16:50.720 Yeah, so much.