Adversary Simulation

Why Adversary Simulation Services Matter to Your Organisation?

Organisations face a variety of different threats from a broad spectrum of different attackers. Understanding which threats relate to your organisation, which should be actively defended against, which should be monitored by technical assurance & testing services and which risks aren’t relevant is challenging in an ever-changing threat landscape.

Having the requisite skills and tools to detect, protect and respond to the cyber-criminals requires an understanding of where an attacker is likely to strike, how to block that attack and how to respond should a malicious actor gain a foothold in your systems.

Adversary simulation services include a number of different techniques including red teams who carry out reconnaissance and attempt to break into your systems, purple teams who build and test plans to block attackers, and external threat assessments that assist your organisation to uncover exposed and forgotten assets. Using the intelligence and knowledge from these teams allows your organisation to better understand the risks it faces and create mitigation plans to ensure your critical information and system assets are as well protected as possible.

Red Team

Red Teaming comes in many flavours but relies on the fundamental premise: the replication/simulation of tactics, techniques, and procedures (TTPs) performed by known threat actors.

A Tesserent Red Teaming Engagement is a complex, comprehensive and multi-layered attack simulation on an organisation.

A Red team uses a custom set of tactics, techniques and procedures (TTPs) to assess your organisation's cyber resiliency against real-world adversaries. The Red Team assessment starts with the alignment/definition of objectives/goals and rules of the engagement, then defines the test plan and finally execution of the plan.

By mimicking a real cyber-attack, the output of your Tesserent Red Team engagement will provide your organisation with a detailed snapshot of the current level of your cyber resilience, covering your people, processes, and your technology. The report will guide you on how to prioritise improvements to your detection and response capabilities helping your company stay ahead of the adversaries.

Red Team exercises focus on all the vectors that real adversaries would. To simulate a real-world scenario, only key stakeholders are made aware of the exercise.

Purple Team

Purple Teaming uses intelligence gathered on threat actors to build a test plan to replicate the tactics, techniques and procedures (TTPs) that are most likely trying to breach your organisation's cybersecurity posture, usually targeting people, processes and technology but not limited to it.

Purple Team engagements merge the Red Team and Blue Team to simulate TTPs from known threat actors to implement or improve your organisation's cybersecurity posture. Usually, when doing a Purple Team exercise, the parts involved in the simulation select the threat actor based on information provided by Threat Intelligence teams. This is intended to tailor the defensive teams regarding threats targeting your organisation's industry and other demographics.

As an outcome, a Purple Team engagement is the best tool to check the detection and response in place, as well as to identify blind spots and solve them at execution/testing time.

Click to learn more about purple teaming

Gold Team

Testing your response plan and your crisis management skills is a vital step in ensuring a successful response to an incident. A Gold Teaming exercise provides a safe environment to test your policies, plans and procedures and hone your response skills before they’re needed.

We’ll collaborate with your team to develop a credible scenario that will involve, not just your IT team, but all facets of the business typically involved in a crisis response.

A tabletop exercise / Gold Team engagement is a discussion-based exercise that is aimed at testing and validating the current incident response plan and playbooks of an organisation. A facilitator will drive the discussion by presenting a scenario and various injections based on the scenario created. The scenario is typically customised according to the target organisation’s technology stack and is based on the most current threat intelligence.

The following parts of the business are recommended to be involved in a Gold Team engagement:

• IT team
• Legal
• Public Relations and Internal Communications
• Senior Management

Potential scenarios include testing your response to a:

• Ransomware Breach,
• Distributed Denial of Service Attack,
• Malicious Insider, or
• Data Breach.

At the end of a Tesserent Gold Teaming engagement, you’ll know what your next steps are for improving your Incident Response readiness.

External Attack Surface Assessment

Tesserent External Attack Surface Assessment will assist your organisation to uncover exposed and forgotten assets.

Our methodology is designed to simulate what a real threat actor would focus on and will utilise similar tactics, techniques and procedures (TTPs) as a Red Team would do.

At the end of the engagement, you will receive a report that will outline your organisation’s attack surface.