Adversary Simulation

For those who are unaware, Adversary simulation is a type of Red Team engagement that mimics Tools, Techniques, Procedures and known threats to an organization. Globally accessible knowledge based of adversary tactics and techniques based on real world observations is collected under MITRE ATT&CK. This platform is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community. Adversary simulation is completely different from Penetration testing as this simulation uses (TTP's) used by real threat vectors and test how the applied defenses act against them.

ATT&CK provides analytics and intelligence for the real world threat actors including various APT groups. Let us consider a simple example of a ransomware. Once a system gets infected with ransomware, the capabilities it uses to encrypt and spread over network uses certain commands. Threat emulation runs the similar checks and validifies the strength, logging and detection capabilities of applied active defenses.

Municipal governments, universities and private businesses have spent more than $144 million responding to the biggest ransomware attacks of 2020 (so far), spending on everything from rebuilding networks and restoring backups to paying the hackers ransom. Introduction of BYOD (Bring our own device) has introduced malwares to the organization as well.

Different forms of malwares are introduced using variety of Tactics, Techniques and Procedures (TTP's)