Search icon
Cart icon
Close icon
You have no products in your basket yet
Save more on your purchases!
Savings automatically calculated. No voucher code required
Arrow left icon
All Products
Best Sellers
New Releases
Learning Hub
Free Learning
Arrow right icon
Over 7,000 tech titles at $9.99 each with AI-powered learning assistants on new releases
Cybersecurity Attacks – Red Team Strategies
Cybersecurity Attacks – Red Team Strategies

Cybersecurity Attacks – Red Team Strategies: A practical guide to building a penetration testing program having homefield advantage

By Johann Rehberger
$29.99 $9.99
Book Mar 2020 524 pages 1st Edition
$29.99 $9.99
$15.99 Monthly
$29.99 $9.99
$15.99 Monthly

What do you get with eBook?

Product feature icon Instant access to your Digital eBook purchase
Product feature icon Download this book in EPUB and PDF formats
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Buy Now
Table of content icon View table of contents Preview book icon Preview Book

Cybersecurity Attacks – Red Team Strategies

Chapter 1: Establishing an Offensive Security Program

Establishing an offensive security program within an organization might seem a challenging task compared to just compromising its assets, but it is one of the most exciting tasks to perform as a penetration tester, lead, or manager. Being there to actively design a strategy for changing the security culture of an entire organization is a great opportunity, and it is rewarding and a lot of fun.

As a leader and manager of an offensive security team, it is critical to set clear principles and a vision and rules for the team. This chapter will discuss the aspects to consider and provide some ideas about how to build a strong foundation.

The following topics will be covered in this chapter:

  • Defining a practical mission for a cyber-operational red team program
  • Finding support among and influencing leadership to establish a red team program
  • Strategies on where in the organization the red team should be situated
  • ...

Defining the mission – the devil's advocate

At a high level, one of the best ways to look at a red team is to consider it the devil's advocate. The vision is to ensure alternative views are considered and that stakeholders are held accountable. The program is there to provide reality checks at times of forming a consensus. This is done by demonstrating not just the theoretical but the real-world impact of exploiting weaknesses and informing the organization's risk management process and leadership.

In many ways, an offensive program fulfills a security testing function within the organization, a sometimes rare but much-needed function in the modern world of software engineering, full-stack development, and DevOps.

To run an effective internal offensive security program, a simple yet inspiring mission to help communicate the purpose and motivate the team is important. The mission should be about what is being done, there is no reason to dive into how something...

Getting leadership support

To run a successful red team program, it is critical to have active leadership support.

One of the big benefits of an offensive security program and red teaming generally is that they are there to keep everyone honest. Trust but verify. The support of the Chief Security Officer (CSO) is probably easy to get, but the support must be beyond that; it must include the other executive levels of the organization as well. This can't be stressed enough; if you do not have executive buy-in, the effectiveness and outcomes of the program will be limited. Getting long term buy-in might be achieved by using various strategies, including providing data and providing actual breach results, explaining how they impact the organization.

Convincing leadership with data

When looking at data, it is useful to look at the competitive landscape and analyze recent breaches that have occurred in the industry, and the associated impact they have had on organizations...

Locating a red team in the organization chart

Initially, I would not spend too much time thinking about where in the organization the offensive security team should be located. If you are just starting out, it's most likely that only one full-time person is tasked with offensive security work. The more critical part at that stage is to get executive sign-off and support to perform offensive testing and deliver results. The bias should be toward action at first and to demonstrate a positive impact. In some organizations, the program is entirely outsourced, and only logistics are driven internally, although typically the desire to build an internal team will grow.

A typical organization structure will probably put the offensive security team in either the defense and response part of the company or as a function of a Security Assurance team. I have also seen offensive security teams being put in legal and compliance areas of companies. A lot of this depends on the size and structure...

The road ahead for offensive security

When it comes to successfully managing an offensive security program, it's critical to define an overall roadmap that acts as a foundation and guidance going forward. Think of a high-level plan for the next two or three years. Most likely the program will grow organically if the initial investments are fruitful and the return on investment is made visible. This is what I have observed across different organizations that have implemented an internal offensive security program. In the beginning, start out small, and one or two years later it grows into an actual team of full-time employees. Overall, there are possibly two options initially. One is to build a program and a team from scratch, and the other one is to use already existing resources that can be leveraged.

Building a new program from scratch

If you are starting out from scratch it might seem rather intimidating, but it's also a great opportunity. The most likely scenario...

Providing different services to the organization

A useful way to look at an offensive security program is that it is providing services to the organization. If the reader is familiar with red teams that focus on business processes or other aspects of an organization, this topic is primarily focused on the cybersecurity angle.

Providing service offerings means that other business groups, blue teams, and employees are our customers, so to speak. The modes of operation, responsibilities, and tasks of the penetration test team can differ quite a bit depending on what the scope and responsibilities are. It might or might not include design-level work and reviews such as threat modeling, but it certainly should include hands-on offensive penetration test work and finding and exploiting vulnerabilities for defensive purposes. Most of these services revolve around alternative analyses.

The following subsections are a list of services a penetration test team might provide to its customers...

Additional responsibilities of the offensive program

So far, we have pointed out some of the core tasks that a red team program will be carrying out. There are additional responsibilities that should be looked at and possibly be integrated into the program. Let's look at some of them in more detail.

Security education and training

The offensive security team can help change the culture of an organization and help improve the overall security IQ. As a part of operations, pen testers learn a lot about the people, processes, and technologies of the organization. The offensive team is also in a powerful position to ignite cultural change and help the organization improve its unique understanding of security.

Increasing the security IQ of the organization

In tandem with education and providing training, the job of the offensive program should be to improve the security IQ of the entire organization, including blue teams, service and product teams, human resources, and finance...

Training and education of the offensive security team

This aspect is commonly under-invested into organizations. To build a strong offensive security program and attract talent, it's critical to have a clear path of education for team members to evolve both individual career aspirations and the program itself. This includes being able to attend security conferences to learn and network, but also to present their own research and get inspired by the work of others to come up with the next great idea or operation.

It's not uncommon to get stuck in continuous operational work and to forget about training. There is a great analogy a mentor once told me. As far as I know, the story is based on something Abraham Lincoln said.

There is a woodcutter who cuts wood all day long. Over the course of time, his ax loses its sharpness. He gradually becomes slower and slower at cutting wood. He is just too busy cutting wood to sharpen his ax! One day, a friend tells him, Hey man, I...

Policies – principles, rules, and standards

Your organization probably already has policies around security testing in place, although probably in a different manner than you would expect. At the beginning stage, any form of penetration testing is most likely explicitly disallowed! To enable offensive security engineering, it's necessary to augment these rules and standards to provide a framework for the offensive team to perform its duties.

Policies and standards are also there to protect the offensive security team to ensure the team is working within an established and authorized set of policies. As the manager of the program, you should also ensure that everyone that carries out such activities has read and agreed to follow these rules. Again, there might already be an established process in your organization. If not, find yourself a way to track it.

Principles to guide and rules to follow

Penetration testing and offensive security are some of the most exciting...

Rules of engagement

A set of clear rules of engagement should be established and approved by leadership and the legal department to ensure that tools, techniques, and procedures can be applied to simulate and emulate adversaries effectively. A superior penetration testing team holds itself accountable to the highest possible standard and works with excellence. This includes business ethics.

Therefore, it's important to establish rules that the team follows. Some examples are as follows:

  • Do good! Always operate with due diligence.
  • Do not perform denial-of-service testing or deny access to systems intentionally without explicit authorization.
  • Consult the no-strike list before compromising assets. (A no-strike list is a set of assets or systems that are off-limits to the pen test team.)
  • Operate surgically, rather than carpet bombing targets.
  • Handle credentials and other sensitive security artifacts securely and safely during and after the conclusion of...

Standard operating procedure

A standard operating procedure (SOP) describing the overall workflow of how a penetration test or offensive security operation is created. It includes involved stakeholders, approvers, informed parties, other participants, and the objectives of the operations. An SOP is important in ensuring that a mature and repeatable process develops. Like the rules of engagement, it's advisable to seek legal counsel to ensure that the tactics and techniques highlighted do not violate company policy or laws.

There are considerations throughout an engagement, and procedures might vary depending on the service offering that the procedure discusses. The following diagram shows some of the possible cornerstones of a purple team service. The many stages and procedures are also present for red teams and penetration testing services.

It is useful to templatize the SOP in order to have a repeatable process so that the format can be reused:


Modeling the adversary

One of the core responsibilities of an offensive security team is to strategically model adversaries and threats that the organization faces. The program should be a direct contributor to the risk management process. At a high level, one might distinguish between external and internal adversaries, although the majority of the likely objectives for malicious activities have some form of external motivation. For instance, an internal employee might be blackmailed by a government agency to exfiltrate records from the customer databases. Even though this is seen as classic insider activity, the actual entity behind the scheme is external.

Understanding external adversaries

This is an actor or threat that originates and operates entirely from the outside of an organization. A typical example is a script kiddie or a nation-state that attempts to breach the perimeter of the organization. This adversary will focus on the attack surface of the organization, which...

Anatomy of a breach

There are a set of frameworks available that describe the typical progression of an adversary when compromising assets. There is, for instance, the Lockheed Martin Kill-Chain, which is quite popular (

Over the years, more refined and generic frameworks have also been established, such as the MITRE ATT&CK framework (, or the Unified Kill Chain (

The kill chain as defined by Lockheed Martin does have some limitations and only models a subset of adversaries. Later in the book we will do a more in-depth analysis and see how these frameworks can help you build strategies for your operations and cyber defense.

Not following any of these frameworks in particular, let's discuss the anatomy of a possible breach that a red team...

Modes of execution – surgical or carpet bombing

When performing operational red teaming, there are two basic approaches when it comes to compromising assets. The first one is to be very targeted and surgical, and the second one is to perform large-scale assessments and exploit attempts. Surprisingly, the second one often leads to a much better understanding of the environment and discovering unknowns. Let's explore this in a bit more detail.


A surgical operation typically requires more detailed planning and reconnaissance. This is a good approach when there are clear objectives being set as part of the operation. The goal is to stay under the radar for the entirety of the operation. A surgical approach could, for instance, be as targeted as sending a phishing mail to two or three people and navigating into the victim's inbox to retrieve access to sensitive email or stealing critical business information from the computers of the target.

Carpet bombing...

Environment and office space

You might wonder why I would put an extra section that talks about the work environment and office space. I have found this to be an extremely crucial aspect of security across the industry, especially among software engineers. Many of us now work in open offices and shared environments.

These days, everyone likes open offices; at least, that is what management is telling us. Rather than diving into what this means for software developers who also deal with sensitive information and intellectual property, let's discuss what this means for security engineers, particularly for security engineers who deal with clear text passwords of systems and other employees, as well as potential information about unpatched vulnerabilities and so forth.

Open office versus closed office space

Personally, I'm not a big supporter of open offices, although for pen testing, an open office does work surprisingly well, with one caveat: ensure that only pen...


In this first chapter, we explored the foundations of how to build a successful pen test program within your organization. This includes ways to influence leadership to support an offensive security program and defining a clear mission to bootstrap efforts. We discussed the services a red team can provide to the organization and what it takes to establish an offensive security program within your organization.

To safely and securely operate, we highlighted the creation of rules of engagement and SOPs.

Furthermore, we learned about the basics of what adversaries your organizations might be facing and how systems get breached, and some tips to convey that information to other stakeholders.

In the next chapter, we will explore how to manage and grow a red team, and how to further develop the overall program to improve its maturity.


  1. Name at least two objectives and goals for establishing a red team program.
  2. What services can an internal offensive security program provide to the organization?
  3. What are rules of engagement, and why is it important to establish them?
  4. Name at least three external adversaries your organization might face.
Left arrow icon Right arrow icon
Download code icon Download Code

Key benefits

  • Build, manage, and measure an offensive red team program
  • Leverage the homefield advantage to stay ahead of your adversaries
  • Understand core adversarial tactics and techniques, and protect pentesters and pentesting assets


It's now more important than ever for organizations to be ready to detect and respond to security events and breaches. Preventive measures alone are not enough for dealing with adversaries. A well-rounded prevention, detection, and response program is required. This book will guide you through the stages of building a red team program, including strategies and homefield advantage opportunities to boost security. The book starts by guiding you through establishing, managing, and measuring a red team program, including effective ways for sharing results and findings to raise awareness. Gradually, you'll learn about progressive operations such as cryptocurrency mining, focused privacy testing, targeting telemetry, and even blue team tooling. Later, you'll discover knowledge graphs and how to build them, then become well-versed with basic to advanced techniques related to hunting for credentials, and learn to automate Microsoft Office and browsers to your advantage. Finally, you'll get to grips with protecting assets using decoys, auditing, and alerting with examples for major operating systems. By the end of this book, you'll have learned how to build, manage, and measure a red team program effectively and be well-versed with the fundamental operational techniques required to enhance your existing skills.

What you will learn

Understand the risks associated with security breaches Implement strategies for building an effective penetration testing team Map out the homefield using knowledge graphs Hunt credentials using indexing and other practical techniques Gain blue team tooling insights to enhance your red team skills Communicate results and influence decision makers with appropriate data

Product Details

Country selected

Publication date : Mar 31, 2020
Length 524 pages
Edition : 1st Edition
Language : English
ISBN-13 : 9781838828868
Category :
Concepts :

What do you get with eBook?

Product feature icon Instant access to your Digital eBook purchase
Product feature icon Download this book in EPUB and PDF formats
Product feature icon Access this title in our online reader with advanced features
Product feature icon DRM FREE - Read whenever, wherever and however you want
Buy Now

Product Details

Publication date : Mar 31, 2020
Length 524 pages
Edition : 1st Edition
Language : English
ISBN-13 : 9781838828868
Category :
Concepts :

Table of Contents

17 Chapters
Preface Chevron down icon Chevron up icon
1. Section 1: Embracing the Red Chevron down icon Chevron up icon
2. Chapter 1: Establishing an Offensive Security Program Chevron down icon Chevron up icon
3. Chapter 2: Managing an Offensive Security Team Chevron down icon Chevron up icon
4. Chapter 3: Measuring an Offensive Security Program Chevron down icon Chevron up icon
5. Chapter 4: Progressive Red Teaming Operations Chevron down icon Chevron up icon
6. Section 2: Tactics and Techniques Chevron down icon Chevron up icon
7. Chapter 5: Situational Awareness – Mapping Out the Homefield Using Graph Databases Chevron down icon Chevron up icon
8. Chapter 6: Building a Comprehensive Knowledge Graph Chevron down icon Chevron up icon
9. Chapter 7: Hunting for Credentials Chevron down icon Chevron up icon
10. Chapter 8: Advanced Credential Hunting Chevron down icon Chevron up icon
11. Chapter 9: Powerful Automation Chevron down icon Chevron up icon
12. Chapter 10: Protecting the Pen Tester Chevron down icon Chevron up icon
13. Chapter 11: Traps, Deceptions, and Honeypots Chevron down icon Chevron up icon
14. Chapter 12: Blue Team Tactics for the Red Team Chevron down icon Chevron up icon
15. Assessments Chevron down icon Chevron up icon
16. Another Book You May Enjoy Chevron down icon Chevron up icon

Customer reviews

Top Reviews
Rating distribution
Empty star icon Empty star icon Empty star icon Empty star icon Empty star icon 0
(0 Ratings)
5 star 0%
4 star 0%
3 star 0%
2 star 0%
1 star 0%
Filter icon Filter
Top Reviews

Filter reviews by

No reviews found
Get free access to Packt library with over 7500+ books and video courses for 7 days!
Start Free Trial


How do I buy and download an eBook? Chevron down icon Chevron up icon

Where there is an eBook version of a title available, you can buy it from the book details for that title. Add either the standalone eBook or the eBook and print book bundle to your shopping cart. Your eBook will show in your cart as a product on its own. After completing checkout and payment in the normal way, you will receive your receipt on the screen containing a link to a personalised PDF download file. This link will remain active for 30 days. You can download backup copies of the file by logging in to your account at any time.

If you already have Adobe reader installed, then clicking on the link will download and open the PDF file directly. If you don't, then save the PDF file on your machine and download the Reader to view it.

Please Note: Packt eBooks are non-returnable and non-refundable.

Packt eBook and Licensing When you buy an eBook from Packt Publishing, completing your purchase means you accept the terms of our licence agreement. Please read the full text of the agreement. In it we have tried to balance the need for the ebook to be usable for you the reader with our needs to protect the rights of us as Publishers and of our authors. In summary, the agreement says:

  • You may make copies of your eBook for your own use onto any machine
  • You may not pass copies of the eBook on to anyone else
How can I make a purchase on your website? Chevron down icon Chevron up icon

If you want to purchase a video course, eBook or Bundle (Print+eBook) please follow below steps:

  1. Register on our website using your email address and the password.
  2. Search for the title by name or ISBN using the search option.
  3. Select the title you want to purchase.
  4. Choose the format you wish to purchase the title in; if you order the Print Book, you get a free eBook copy of the same title. 
  5. Proceed with the checkout process (payment to be made using Credit Card, Debit Cart, or PayPal)
Where can I access support around an eBook? Chevron down icon Chevron up icon
  • If you experience a problem with using or installing Adobe Reader, the contact Adobe directly.
  • To view the errata for the book, see and view the pages for the title you have.
  • To view your account details or to download a new copy of the book go to
  • To contact us directly if a problem is not resolved, use
What eBook formats do Packt support? Chevron down icon Chevron up icon

Our eBooks are currently available in a variety of formats such as PDF and ePubs. In the future, this may well change with trends and development in technology, but please note that our PDFs are not Adobe eBook Reader format, which has greater restrictions on security.

You will need to use Adobe Reader v9 or later in order to read Packt's PDF eBooks.

What are the benefits of eBooks? Chevron down icon Chevron up icon
  • You can get the information you need immediately
  • You can easily take them with you on a laptop
  • You can download them an unlimited number of times
  • You can print them out
  • They are copy-paste enabled
  • They are searchable
  • There is no password protection
  • They are lower price than print
  • They save resources and space
What is an eBook? Chevron down icon Chevron up icon

Packt eBooks are a complete electronic version of the print edition, available in PDF and ePub formats. Every piece of content down to the page numbering is the same. Because we save the costs of printing and shipping the book to you, we are able to offer eBooks at a lower cost than print editions.

When you have purchased an eBook, simply login to your account and click on the link in Your Download Area. We recommend you saving the file to your hard drive before opening it.

For optimal viewing of our eBooks, we recommend you download and install the free Adobe Reader version 9.