From Compliance to Covert Ops: Demystifying the Offensive Security Landscape

The merits of deploying offensive testing to strengthen an organization’s security posture are well-understood by today’s security leadership. Much to the relief of defenders, obtaining approval for an offensive security exercise has never been easier.

However, the process of selecting the most appropriate offensive testing solution requires untangling overlapping definitions and vaguely defined terminology that leaves security teams more confused than when they started. 

How is an Adversary Emulation different from a Red Team? What about this new Breach and Attack Simulation (BAS) tool that has been receiving great publicity recently? Would it be simpler to just invest in a Penetration Test instead? 

To help break all this down, we will provide a framework to understand the value proposition of different offensive security services from a defender’s perspective, focusing on the core assumptions underlying each solution’s methodology. We will also identify important factors that help with narrowing down which form of offensive testing is best suited for your organization. 

The Ends and The Means

To understand the differences between types of offensive testing, consider the following: 

• Are defenses being tested against attacks in general, or specific adversaries? Are offensive techniques being emulated for maximum realism, or simulated for rapid validation?

This framework allows us to classify offensive security services into four general categories.

Figure 1. Four general categories.

Although there is often methodological overlap between the four quadrants, this model can be used to make sense of industry terminology from a defender’s point of view by focusing on the how and the why of conducting offensive security testing.

To use a domestic analogy, let’s assume you want to ensure your home is safe from being broken into. The type of test you choose will dictate what you learn about your security posture.

• Breach and Attack Simulation (BAS) focuses on the repeatable execution of individual attacks, usually in an automated fashion, targeting specific defensive capabilities, much like trying the door handle every few hours to make sure the lock is engaged. Crucially, the focus is on ensuring that the lock’s status is validated, and not on the specific mechanics of how the handle was engaged.
• Penetration Testing, on the other hand, is a time-bound, scoped assessment targeting a specific goal, usually with the full awareness of the internal security team. This is like hiring a professional burglar to attempt breaking in within a set duration, but with certain limits - lock picking is okay, but smashing the window is out of bounds!
• Red Teaming, whether TTP-Driven or not, is a comprehensive exercise that targets an organization similar to how a real-life adversary would, often with no warning provided to defenders. Continuing our analogy, this is similar to tasking professionals with breaking into your house from start to finish, like a real burglar, with few restrictions. In this situation, you may want to smash the window to see if the home security service you paid for is worth the money.  

The Right Tool for the Job

When selecting an offensive security service, organizations should first ensure that foundational defensive controls are in place. Engaging a Red Team without having validated basic controls will surface findings that would likely also have been discovered with Penetration Testing.

1. First, leverage BAS to identify gaps and misconfigurations and validate the functionality of security tools.
   
   
2. Subsequently, conducting Penetration Tests on internal networks and web applications can unearth additional vulnerabilities and attack paths in custom software and business logic.
   
   
3. Finally, engaging in a Red Team will test defenders’ readiness to combat a targeted, real-world attack by a sophisticated adversary. The choice of whether a Red Team is TTP-agnostic or TTP-driven (Adversary Emulation vs Simulation) will depend on whether you are concerned about specific threat actors or groups and are interested in testing tailored defenses, such as detection rules for TTPs used to target your industry. 

While it is tempting to jump directly to the “most realistic” form of security testing, this misconception results in limited value being obtained from an offensive security exercise. Adversaries will take the path of least resistance into an organization - before smashing the window, a burglar will pick your lock, but before that, they will certainly just try the handle.