Breach & Attack Simulation: See Your Organization’s Cybersecurity Environment Through the Eyes of a Hacker

Author: Raz Kotler, VP Customer Operations, XM Cyber, Breach & Attack Simulation

The default framework for handling cybersecurity risk is well-established: Vulnerability management processes are instituted, security controls established and penetration tests (or red/purple team exercises) are periodically staged.

Yet despite this tried-and-true formula, risk has grown ever more difficult to manage. Cybersecurity breaches continue to rise each year, despite the best efforts of defenders. Many organizations struggle to effectively prioritize remedial projects or understand the context of internal vulnerabilities. They also misconfigure controls or rely on static, episodic testing that creates something like a snapshot of organizational security rather than a continuous video feed. As a result, attacks grow costlier and more frequent with every passing day.

So what’s the answer for organizations that wish to seize the initiative and aggressively lower their exposure to growing risk? It’s not simply throwing more money at the problem or layering in new solutions. To get the best results, organizations need to fundamentally rethink the way they approach security by shedding their reactive posture and seeing their security environments through the eyes of an attacker. In other words, it’s time to play offense while playing defense.

How Breach and Attack Simulation Platforms Allow You to Adopt the Attacker’s Mindset

Red/purple team exercises are a core cybersecurity tool because they allow an organization to better assess risk by testing its own defenses for vulnerabilities, then remediating any issues. It’s an active, rather than a reactive, security measure.

Yet while conventional pen testing or red teaming can help defenders inhabit the mind of an attacker, they do so in a very limited fashion. Because these exercises are time and resource-intensive, they may be staged on a quarterly (or even yearly) basis. So while manual red teaming can allow you to see through the eyes of an attacker at a given point in time, it can’t provide continuous visibility into the state of an organization’s defenses.

Given how quickly changes occur within a security environment today, these lengthy dark periods are rife with potential trouble. Defenders simply can’t see how such changes affect the environment, nor pinpoint the ensuing vulnerabilities that may arise. They can see through the eyes of an attacker, but only for a relatively brief period of time.

Breach and attack simulation (BAS) platforms address this flaw by taking the principle of red or purple teaming and extending it to its full potential. Instead of relying on episodic snapshots of organizational risk, BAS platforms provide a continuous window into the viability of security environment defenses. They accomplish this by launching non-stop attack simulations within a controlled environment, using the techniques and attack paths that hackers are most likely to employ. Once vulnerabilities are identified, a BAS platform will provide prioritized remediation recommendations. In other words, BAS platforms offer all of the benefits of purple teaming - but in a continuous, automated fashion that enables 24/7 protection.

Typical Use Cases for BAS Platforms

Now that we’ve explored how BAS platforms allow organizations to mimic the mindset of attackers, let’s delve into some common use cases for this cutting-edge technology.

Critical Asset Risk Visibility

Every organization has “crown jewel” assets that are critical to business operations and continuity. The ability to understand and contextualize risks to these assets is imperative for developing an effective overarching security strategy.

BAS platforms make it simple to identify the likely attack paths and techniques a hacker would use to target crown jewel assets. Just identify the asset, and the simulated attacks are automatically calculated. The power of automation ensures that validation is continuous, providing dynamic testing for dynamic environments.

Network Segmentation

Organizations with network segmentation or zero trust network architecture require a simple way to ascertain if gaps exist or if a change has created a new vulnerability. A BAS platform can:

• Identify network misconfigurations, user behavior and other attack vectors that create vulnerabilities within OT environments.
• Show how PCI networks can be accessed and compromised.
• Pinpoint how attackers can compromise network devices, reducing exposure to critical systems.
• Provide real-time attacker visibility by reacting to any changes that make your network and assets vulnerable.

AWS Cloud Exposure

Cloud complexity and migration mandates have left many organizations struggling to strike the right balance between speed and security. An advanced BAS platform can show precisely how secure cloud data is and help assess risk.

Cloud policies for users, groups and roles can allow for escalation due to misconfigurations. The right BAS platform can identify issues in a single account, or from cross-account attacks. Continuous testing also shines a light on how attackers could access S3s, lambdas or other resources, while hybrid attacks are deterred by showing how attackers can target on-premise devices, then shift assets into the cloud.

Active Directory Infrastructure

Given the core role it plays, a successful attack on active directory infrastructure can cause profound damage. BAS platforms protect against this possibility by identifying how domain controllers can be compromised, while also showing how to protect against group policy attacks, credential harvesting, golden ticket and other tactics. Sophisticated attacks targeting DNS, DHCP and proxy servers can also be defeated.

Pinpoint remediations associated with excessive permissions, misconfigurations and other issues can help harden the active directory environment, significantly lowering the overall risk level.

APT and Threat Protection

The prospect of sophisticated APT attacks is enough to keep even the most seasoned security professional awake at night. With APTs seemingly growing more tenacious each year, constant vigilance is a must. A BAS solution can close gaps associated with missed vulnerabilities, IT hygiene problems, misconfigurations and user behavior.

These platforms can also simulate the kind of “under the radar” attacks that APTs can use to bypass security controls and evade alerts. By identifying the underlying conditions that increase risk, attack surfaces are reduced - and the odds of a breach are simultaneously lowered.

Compliance Maintenance

BAS platforms offer continuous assessment of whether risks are exposing your devices to compliance violations. Compliance can also be monitored post-penetration test to ensure that remediations haven’t raised any new compliance concerns.

Risk Reporting

An open dialogue about the state of risk within a security environment is crucial for ensuring that senior leadership understands what is truly at stake. The kind of information helps guide the direction of investment in both personnel and technology. BAS technology can support this endeavor by generating reports that provide an in-depth risk model that incorporates IT hygiene, vulnerabilities, user behavior, misconfigurations etc. This allows one to understand risk from the attacker’s point of view, allowing for a fuller perspective.

Reports can be generated based on use cases, allowing for visibility into how data, systems and networks can be compromised. Users can also take advantage of trendlines and risk quantification to gauge whether changes within an environment are reducing or enhancing risk.

In Conclusion

The mandate to maintain robust organizational security has never been more challenging to meet. Attackers grow more sophisticated, hybrid environments require special attention and the COVID-19 pandemic has suddenly made remote work the default mode for millions of workers - greatly increasing shadow IT risks. Succeeding in this kind of environment requires a true shift in thinking, not mere tactical adjustments.

Instead of waiting and reacting, defenders should seize the initiative and adopt the mindset and technique of attackers.

Instead of opting for episodic red team exercises and limited visibility, organizations should harness the power of automated testing and maintain continuous protection for crown jewel assets.

A BAS platform that offers all of the sophisticated features outlined above (such as XM Cyber for Attack Simulation) can help organizations see through the eyes of an attacker on a 24/7 basis - and enjoy the power of fully automated protection across a wide range of use cases.

Follow Us