Services -Red Offering

Red Team Exercise

Red Teaming is the simulation of a real-world and fully motivated attack against a company, in order to test the effectiveness of its technology, policies and people. For this reason, it involves aspects of Social Engineering, Physical and Logical Security, in order to gain access to pre-defined information assets.

Our Ethical Hackers perform the Red Team Exercise according to the following phases summarized here:

  • Planning: activities carried out alongside the customer to precisely define the objective of the exercise (flag), its duration, the perimeter (assets, processes and people), any possible exclusion.
  • Information Gathering: collection of detailed information on the target, through social engineering activities, vulnerability scanning, services’ enumeration, retrieval and analysis of compromised documents relating to business targets, phishing, vishing, open source intelligence ... During this phase, it is carried out also the so-called weaponization, that is developing the most effective attack plans to achieve the goal of the assignment.
  • Execution: this is the active phase of the Red Team Exercise in which ideas, tools and knowledge acquired in the previous phase are put into action, such as: sending malware; compromising servers, applications and networks; escalation of privileges and maintenance of persistence in order to exfiltrate sensitive data until the agreed target is acquired.
  • Analysis and reporting: re-elaboration of all the activities carried out, the objectives achieved, the technological, procedural or human vulnerabilities found and the recommendations for remedial actions that the customer should implement.

Purple Team Exercise

For those Companies equipped both with an internal or an external Security Operations Center (SOC), we provide the so called Purple Team Assessment. This represents a bridge between Red and Blue Teams and aims to maximize the respective and combined effectiveness of the two.
In particular, our goal is to evaluate the security team’s ability to prevent, detect and respond to cyber attacks and to coach it step-by-step on improvement techniques at each phase of the attack lifecycle itself.

After a Red Team Exercise performed by our Ethical Hackers, we analyse together with the Customer’s SOC the collected evidences and we cooperate in the implementation of new detection and protection controls and rules for immediate fine-tuning.