Red Team Operations
Red team operations are authorized security assessments that emulate realistic adversary behavior to test how well an organization detects, responds to, and learns from an intrusion.
itOffensive security and application security | OpenSkills.info
Intro
Red Team Operations
Red team operations test a defense as a connected system. An authorized team pursues an agreed objective while emulating realistic adversary behavior. The work tests people, processes, and technology together.
This goal separates a red team operation from a vulnerability scan. A scanner finds possible weaknesses. A penetration test validates selected weaknesses. A red team operation asks whether an adversary can achieve a defined objective and how the organization responds along the way.
Authorization is the first control. A written rules of engagement defines scope, timing, permitted actions, prohibited actions, contacts, evidence handling, and stop conditions. Technical ability never expands that authority. If an action falls outside the rules, you do not perform it.
The operational cycle
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
Supports
- Planning, execution, analysis, and reporting for technical security assessments
- Assessment plans, rules of engagement, logistics, data handling, and incident response
- Penetration testing phases, evidence collection, mitigation analysis, and retesting
- The limits of assessment results and the need to interpret findings in context
- https://csrc.nist.gov/pubs/sp/800/115/final
Supports
- Official publication identity, scope, date, authors, and current download
- Security testing as a process for finding vulnerabilities and verifying requirements
- https://www.cisa.gov/sites/default/files/publications/VM_Assessments_Fact_Sheet_RTA_508C.pdf
Supports
- Red team assessment as a comprehensive evaluation of an information technology environment
- Threat simulation and measurable events used to evaluate people, processes, and technology
- Adversary emulation tied to business-level risk and defensive response
- https://attack.mitre.org/tactics/
Supports
- Tactics as the reason an adversary performs an action
- Enterprise tactic names and their role in describing adversary goals
- https://attack.mitre.org/techniques/enterprise/
Supports
- Techniques as ways adversaries achieve tactical goals
- Enterprise technique and sub-technique knowledge for behavior mapping
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-059a
Supports
- A red team assessment that tested detection and response capabilities
- Mapping observed activity to MITRE ATT&CK tactics and techniques
- Turning assessment observations into monitoring, hardening, and control-validation recommendations
- The value of regular assessments and testing defensive processes
- https://github.com/sindresorhus/awesome
Supports
- Awesome Hacking as a curated list in the security section
- https://github.com/carpedm20/awesome-hacking
Supports
- Discovery of Nmap, Metasploit, Wireshark, and OWASP ZAP as relevant security tools
- https://nmap.org/book/man.html
Supports
- Nmap host discovery, port scanning, service detection, scripting, timing, and output
- Nmap as a network exploration and security auditing tool
- https://docs.rapid7.com/metasploit/
Supports
- Metasploit workflow for target data, vulnerability validation, controlled exploitation, evidence, cleanup, and reporting
- https://www.wireshark.org/docs/wsug_html_chunked/
Supports
- Wireshark packet capture, display filters, protocol analysis, and statistics
- https://www.zaproxy.org/docs/
Supports
- ZAP desktop, automation, API, and web application testing documentation