Future of testing: Why Continuous Automated Red Teaming (CART) is making penetration testing and attack simulation tools outdated

The constantly changing cyber world and the rapid adoption of cloud and digital transformation have increased the attack surface multifolds. On the other hand, cyber attackers are using sophisticated techniques to make it harder for others to recognise their attacks. Here, they have an inherent advantage -they only need to succeed once. But, defenders must succeed every time to thwart the attacks. However, a key problem is that many times organisations don't have visibility of their complete attack surface that's changing dynamically, making them all the more vulnerable to cyber attacks.

Why traditional solutions are no longer sufficient to thwart attacks

Organisations have traditionally relied on red teaming to address the challenge. Red teaming is nothing but ethical hacking by security teams carried out on a larger and more extensive scale than traditional security testing to discover the organisation's attack surface, then launch simulated attacks to test their blind spots. Another advantage of red teaming is that it enables security teams to attack any target irrespective of the scope of an IP/application. In spite of these inherent advantages, red teaming is not viable for most organisations because it requires multiple tools, manual effort and only tests a fraction of an organisation’s assets at a specific time. And, this makes it challenging to scale, and is unaffordable for most organisations and is a point-in-time solution.

In addition to red testing, organisations have relied on penetration testing and Breach and Attack Simulation tools (BAS). While penetration testing can only be done on known systems or applications, BAS on the other hand requires hardware or software agents to install and function within an organisation. BAS tools simulate real threats and show how an attacker could spread if it has access to an organisation's internal systems.

The inherent challenges with traditional security solutions make a strong case for Continuous Automated Red Teaming (CART) - an emerging new technology which discovers the attack surface and launches safe attacks continuously. It also helps to prioritise the vulnerabilities that are most likely to be attacked, which are typically the path of least resistance. To put it simply, CART automates red teaming and is designed to scale the process and make it more efficient allowing for continuous discovery of one's attack surface and continuous testing. This makes CART a game changing strategy in cybersecurity. In addition, CART, unlike penetration testing, finds the attack surface automatically without any inputs. It then launches multiple-stage attacks that range from networks to applications to humans. And, unlike BAS, CART, uses an outside-in approach to attack and does not require any hardware or software.

Although hackers are sophisticated and have advanced detection and prevention capabilities, CART can help organisations stay ahead of the game by helping them think like a hacker. An organisation needs to have the ability to discover and map their attack surface and attack them continuously to see all possible ways that an attacker could gain access from the outside-in.

CART vs traditional Solutions: Why one needs to think like hackers

Today, CART makes way for a more efficient system allowing for continuous discovery of one's attack surface and continuous testing. At FireCompass, we have developed a SaaS platform for CART and Attack Surface Management (ASM). The ‘Attack & Recon Platform’ of FireCompass continuously indexes and monitors the deep, dark and surface webs. The platform automatically discovers an organisation’s digital attack surface including unknown exposed databases, code leaks, cloud buckets, and related security risks. It then launches multi-stage safe attacks, mimicking a real attacker, to help identify breach and attack paths that are otherwise missed out by conventional tools. The different types of attack playbooks includes ransomware, network and application attacks, and social engineering attacks. The platform works with zero knowledge and does not require any software or hardware to identify the risks of an organisation's digital attack surface.

FireCompass’ Attack & Recon Platform automates attack planning and thinking, which helps organisations with 20 times faster detection of security risks and 90 percent lower manual effort. Eliminating the need for multiple tools, the platform does not need any hardware, software or agents and takes virtually zero set-up time. The platform presents an exciting proposition for an organisation in the cyber security space to enable organisations to strengthen their security strategies to stay a step ahead of hackers.

Applications for Cohort 9 of the NetApp Excellerator and Cohort 3 of NetApp ExcellerateHER, NetApp’s accelerator program geared towards empowering women founders, is now open. Check here for more details. Link: https://bit.ly/3jV2VdW