Powering up red team operations
The use of red teams — ethical hackers who identify system vulnerabilities — can be an effective way for organizations to find and fix problems before malicious cyber actors exploit. The demand for such red team security assessments, however, far outstrips the supply of those who can do them — and the time and expertise it takes for a red team to create required infrastructure is a critical limiting factor. The Defense Advanced Research Project Agency wants to address that problem through automation.
To evade detection as they move laterally through networks evaluating protections, red team behaviors inevitably create “signatures” or the tactics, techniques and procedures they use that can indicate their presence. If blue teams spot those signatures early on in an exercise, the assessment shuts down. If blue teams can see those signatures in networks outside the one being assessed, then the red team stands to lose the time and resources it has invested in building an operational infrastructure that emulates sophisticated threats. This failure damages the long-term effectiveness of the red team.
Because it takes a red team so much time and subject matter expertise to build a test infrastructure – including domain names, IP addresses, virtual servers and other components — that mimics sophisticated threats, evades detection and reduces signatures, the Defense Advanced Research Project Agency wants to automate some of that work.
The Signature Management using Operational Knowledge and Environments (SMOKE) program aims to develop tools to automate the planning and deployment of threat-emulated, attribution-aware cyber infrastructure.
A Dec. 6 broad agency announcement describes two task areas that will “enable red teams to plan, build, and deploy cyber infrastructure that is informed by machine-readable signatures of sophisticated cyber threats.”
The first task involves the development and deployment of the cyber infrastructure required for network security assessments. DARPA wants tools that will automate the acquisition, management and disposal of both infrastructure resources and cyber personas used for infrastructure interactions. It also wants tools that can recommend and execute various contingency plans based information provided by signature sensors, which are the basis of the second task – developing tools that will help automate the discovery of adversaries’ signatures.
With these tools, red teams will be able “to increase the scale, efficiency, duration, and effectiveness of cyber security assessments,” DARPA said. “Moreover, red teams will be able to provide longer cyber security assessments for a larger number of concurrent networks because of their ability to remain hidden for longer.”
Proposals are due Jan. 31.
About the Author
Susan Miller is executive editor at GCN.
Over a career spent in tech media, Miller has worked in editorial, print production and online, starting on the copy desk at IDG’s ComputerWorld, moving to print production for Federal Computer Week and later helping launch websites and email newsletter delivery for FCW. After a turn at Virginia’s Center for Innovative Technology, where she worked to promote technology-based economic development, she rejoined what was to become 1105 Media in 2004, eventually managing content and production for all the company’s government-focused websites. Miller shifted back to editorial in 2012, when she began working with GCN.
Miller has a BA and MA from West Chester University and did Ph.D. work in English at the University of Delaware.
Connect with Susan at [email protected] or @sjaymiller.
