CYBERSECURITY REVIEW 19 JUNE - 2023Red Team engagements are exercises where a third-party simulates an attacker to test an organization's controls as authentically as possible. These types of engagements can identify gaps in your controls, processes, or incident response capabilities and are a valuable part of a high functioning security program. One tool used by Red Team engagements is the exploitation of vulnerable systems to further their objective. Recently some Red Teams have begun using Zero Day exploits as part of their testing. A Zero Day is a vulnerability that is exploited before a patch or fix is available. The use of Zero Days in Red Teams or for testing purposes is somewhat controversial, as is the discussion around appropriate vulnerability disclosure practices. Putting those complexities aside, its first worth asking what value is there in defenders seeing and experiencing Zero Day exploits in a Red Team engagement?Intuitively security teams know that some of the most important controls we implement are the least exciting. Network segmentation, asset management, patching cadence, principle of least privilege are all concepts that make up the foundation of our security programs. However, in practice its difficult to stay focused on the basics and always ensure our environments follow these disciplines closely. It's too easy to be drawn to exciting technologies to hunt more complex threats. Expensive and time-consuming implementations of Security Incident Event Managers (SIEM) or Data Loss Prevention technologies pull overworked teams away from the basics. Are these solutions sometimes necessary, absolutely. Do they also compete against maintaining proper basic hardening of our environments, definitely. STRENGTHENING ORGANIZATIONS' NETWORK SECURITY By Brenden Smith, CISO, FirstBankBrenden SmithCISO INSIGHTS
< Page 9 | Page 11 >