Incident?Simulation
Your ICT infrastructure is under attack. Let us be the first and only ones to succeed in this.
As an entrepreneur, you face a wide variety of challenges every day. One of these is maintaining the security of your company's assets. These exist not only physically, but increasingly also in electronic form. Industrial espionage, cyber attacks and targeted malware are just a few examples from a long list of risks. With our simulations (Attack Simulation, Red Teaming and Purple Teaming), we test the overall resilience of your organization to cyber attacks.
Selected references on the subject
Our Services
Attack Simulation
An attack simulation is the simulation of real cyber attacks with the aim of identifying security gaps and vulnerabilities in a system or network. The aim is to evaluate the effectiveness of security controls, identify potential entry points for attackers and provide actionable recommendations to improve security. Attack simulations can include various techniques, such as network and vulnerability scans, social engineering and the exploitation of known vulnerabilities.
The aim of an attack simulation is to identify relevant security gaps and vulnerabilities within key systems and services and to identify potential improvements so that future attacks cannot exploit the same gaps and weaknesses for a successful attack.
Purple Teaming
Purple Teaming is a collaborative approach in which the attacking team ("Red Team") and the defending team ("Blue Team") work together ("Purple Team"). This involves executing jointly defined attack techniques based on the MITRE ATT&CK Framework, for example, whereby the detection of the protection and detection systems involved is verified jointly at different points in the attack chain.
The goal of purple teaming is to jointly identify gaps and weaknesses within the detection capabilities and identify potential improvements so that future attacks can be detected faster, easier and more comprehensively.
Red Teaming
Red Teaming is a more comprehensive and sophisticated approach to simulation compared to an attack simulation. The attacking team ("Red Team") acts as an independent group, separate from the defending team of the organization and without their prior knowledge, in order to provide an objective and unbiased perspective. The attacking team carefully evaluates each step, assessing the risk of detection against the chances of success and the expected benefit of each attack technique used, with the aim of remaining undetected for as long as possible.
The aim of Red Teaming is to challenge and test existing and established detection and response processes by simulating a real adversary under the most realistic conditions possible, thus identifying possible discrepancies and weaknesses in these processes so that future attacks can be analyzed, understood and stopped more quickly.
Difference between Attack Simulation, Red Teaming and Purple Teaming
The aim of an attack simulation is to uncover security gaps and vulnerabilities that are particularly relevant for you and your company. As with red teaming, a real attacker is simulated, but for reasons of efficiency, no consideration is given to any detection and response capabilities.In contrast, red teaming takes existing detection and response processes into account by carefully weighing up and selecting the chosen attack techniques before execution in order to remain undetected as an attacker for as long as possible. This also uncovers and exploits vulnerabilities and security gaps, but the main focus is on testing your company's existing detection and response capabilities.
Purple Teaming, on the other hand, involves collaborative testing between the attacker and defender of a predefined series of attack techniques with the aim of uncovering any gaps and weaknesses in your company's detection capabilities as efficiently and comprehensively as possible.
| Attack Simulation | Red Teaming | Purple Teaming | |
|---|---|---|---|
| Focus | Weak points | Reaction | Detection |
| Goal | Identification of relevant attack paths to predefined targets (e.g. worst-case scenarios) | Evaluate detection and response capabilities for attacks on predefined targets | Identify weaknesses and gaps in the detection of attack techniques |
| Vulnerabilities | |||
| Stealthiness | |||
| Detection | |||
| Reaction | |||
| Informed parties | Affected teams and third-party providers | Necessary minimum (e.g. sponsor, account manager of affected third-party provider) | Blue Team, Affected teams and third-party providers |
Why Attack Simulation?
To effectively protect your company from cyber threats, you should carry out simulations. These offer a proactive and holistic approach that goes beyond traditional security checks and allows you to run through realistic attack scenarios - putting not only your infrastructure but also your processes and employees to the test.
Proactive Simulation
Traditional security assessments such as penetration tests limit the scope and instead focus on the depth of the test. In a real attack, such boundaries are not observed. In our attack simulations, the traditional scope is also eliminated, allowing us to proactively play out realistic attack scenarios. This not only checks your infrastructure, but also your processes and your employees in all areas.
Worst-Case Scenarios
Our attack simulations are tailored to the specific requirements of your organization and your business processes. To identify realistic and context-specific worst-case scenarios, these are developed together with your internal specialists. Such scenarios must be developed individually for each company and can, for example, include access to research results, payroll data, or the impairment of industrial and control systems. This approach ensures that critical scenarios for your organization are considered within the scope of the attack simulation.
Relevant Risks
In an attack simulation, your company is exposed to real attacks, all of which aim to control the predefined worst-case scenarios. This gives you a clear idea of the current threat situation in your company. Our security experts provide you with concrete answers to the question of which areas need to be protected more strongly and where the existing protection is already sufficient from a risk perspective. Based on this, individual packages of measures can be defined and implemented. One way to identify your current risk areas in a measurable way without interfering with your infrastructure is provided by our Cyber Security Assessment.
Possible modules of a simulation
A comprehensive security strategy requires the simulation of various attack scenarios in order to uncover potential vulnerabilities and develop effective defensive measures. Our attack simulation has a modular structure and can, for example, consist of a combination of the following modules.
External attack
Within a modern organization, it is often unavoidable that at least some IT systems are publicly accessible via the internet. This exposure makes the systems an interesting target for attack, as it allows sensitive data to be accessed directly and a first step towards the internal network to be taken. In this scenario, Redguard behaves like an external attacker trying to gain access to systems in your infrastructure that are accessible via the internet. Our security experts use both known and specifically tailored attack methods for your systems. If access is achieved, possible sensitive data is extracted and analyzed. Furthermore, attempts are made to penetrate into internal network areas.
Spear Phishing
This module mounts tailored phishing attacks on individual persons or groups. It involves an attempt to target the persons in a deliberately relevant context in order to encourage them to disclose sensitive information like customer data or login details or even to execute malware on their workstations. The findings of this module provide a clear impression of your current employee awareness and can be used furthermore as a basis for relevant training or evaluating technical measures. Last but not least, this external threat puts the perimeter security through its paces – and therewith also the responsible employees within your organization.
Malware Infection
All important data or information will at some point be processed or read by someone. Most commonly this will take place on the employees’ client devices. This means that in many cases, attackers will not have to penetrate central servers. Instead it is sufficient if they gain access to suitable client devices to obtain the data they seek. This scenario simulates infection of a client with malware as a means of accessing sensitive data. The next step is to place the device in your internal network and to manipulate it via the Internet using the command & control channel (C2). Additionally, we attempt to transfer sensitive data out of the company, which enables an assessment of the installed data loss prevention (DLP) systems and the defense mechanisms such as intrusion detection and prevention systems (IDS/IPS).
Social Engineering
Our company physically penetrates your business premises (without the use of force). In particular, this involves the use of social engineering. The underlying aim is to steal or least copy sensitive information in hard copy (e.g. documents), as well as to position technical eavesdropping devices. This module addresses a large number of issues: Firstly, the social engineering attack reviews the current awareness among your employees, while secondly assessing the internal security measures such as active security systems and other technical mechanisms.
Internal Attack
Placed on your internal network, we simulate an attacker who has gained access to your internal network. We uncover vulnerabilities and actively exploit them there. So-called exploits can be used, for example, or techniques such as the redirection of network traffic and technically supported social engineering (e.g. displaying false login masks). The aim of this scenario is to determine what an attacker can achieve once it has penetrated your internal network, for example, through malware. This scenario enables well-founded statements to be made about the security status of the internal network and simulates the potential damage that could be caused by a failure of the perimeter security.