Red vs. Bank: Surviving a Three Year Red Team
summary
Three-year continuous red team runs 24/7/365 with an open scope (mainframe excluded), using a point-of-presence device hidden in a tissue box to emulate ceded internal access and buying hardware to develop an IoT zero-day; external breach attempts average 84 days and never succeed, time-to-detection improves from 102 days to 44 days to about 1 hour, then an internal open mail relay plus phishing yields three clicks, one crackable NetNTLM and domain compromise in ~15 minutes. Outcomes: Splunk and DNS anomaly rules, NAC, deception honeypots, a dedicated testing FTE, heavy fixes and higher cost/stress.
AI-written summary · about
chapters (20)
- 0:00Three-year red team intro
- 1:03Defining red teaming and its purpose
- 3:28Traditional red team limits
- 6:58Why continuous red teaming
- 8:00First six months attempts
- 9:25Learning from perimeter scans
- 10:08Facilitated access deployment
- 12:14Zero-day exploits on IoT
- 14:00Restarting access after detection
- 17:12Twelve to twenty-four months hunting
- 19:19Blue team detection speed
- 21:00Red team persistence
- 23:04Final breach via phishing
- 27:15Missed detection opportunities
- 28:39Lessons learned debrief
- 31:06Value of continuous red teaming
- 33:12How to implement continuous
- 35:02Managing team stress
- 38:14Balancing false positives
- 40:21Threat hunting validation
related talks
54mHacked in hours: Red team assessments unveiling vulnerabilities
35mRed Teaming AWS: Practice What You Preach/
47mPenetration Testing & Red Teaming for Healthcare
49mStories from the trenches - How a red team exercise gained full control of a client network
33mBuilding Red Team Capability
27mRed-Teaming for Scraping
40mFantastic Red-Team Attacks and How to Find Them
12mIntroduction To Red Team Tooling And Opsec