Red Teaming

NIST, citing CNSSI 4009, defines a red team as a group of people authorized and organized to emulate a potential adversary's attack or exploitation capabilities against an enterprise's security posture. Its objective is to demonstrate the impacts of successful attacks and to show what works for the defenders, the blue team, in an operational environment.

A red team exercise reflects real-world conditions. It is a simulated adversarial attempt to compromise an organization's missions or business processes, meant to give an assessment of the security capabilities of the organization and its systems.

CISA conducts red team assessments at an organization's request, simulating real-world threat actors to assess the organization's detection and response capabilities. In the first phase, the red team tries to gain and keep persistent access to the enterprise network without being detected; in the second, it tries to trigger a security response from the organization's people, processes, or technology. Trusted agents inside the organization set the targets, and the findings come with recommendations for improving the organization's security posture.

Defenders use the results to test their own controls. CISA recommends testing existing security controls against the adversary behaviors documented in an assessment and analyzing how detection and prevention technologies perform. In one assessed organization, CISA noted as a strength that it ran regular, proactive penetration tests and adversarial assessments and hardened its network based on the findings.