At first glance, it seems like pen testing, red teaming, and threat hunting all seem like fancy ways of saying the same thing — test to make sure your data is protected from attackers. These strategies all seemed to overlap in more ways than one, so I set out to do a little investigating on my end to make sure I understood each of them individually and their unique purpose to an organization’s security posture. The goal here is to provide you with a slightly less technical understanding of each of these strategies at a high-level.
These terms have a common goal of protecting data from attackers. Each of them can be extremely useful, and as you’ll see, picking one over the other really depends on what your goals are. Frequently, here at MPG, we see a combination of these services requested, so organizations are getting the broader sense of what these test results bring back.
Let’s dive into the similarities and differences between pen testing, red teaming, and threat hunting.
What is Pen Testing?
Wikipedia definition: “A penetration test, colloquially known as a pen test, pentest or ethical hacking, is an authorized simulated cyberattack on a computer system, performed to evaluate the security of the system.”
Objective of a Pen Test: Find and Identify as many vulnerabilities as possible in a computer system, that may lead to a breach.
Sometimes, pen testing simulations are known by the teams they are impacting; other times they are not. These tests are commonly focused on exploiting known vulnerabilities that have not been patched properly, if at all.
Pen Testing Examples:
- Web Assessments: Discovering and exploiting web-related vulnerabilities such as Cross Site Scripting (XSS) and Structured Query Language (SQL) Injection
- Network Assessments: Discovering and exploiting network related vulnerabilities such as insecure protocols, services, and applications
What is Red Teaming or a Red Team Assessment?
Wikipedia definition: “A Red Team Assessment is similar to a penetration test in many ways but is more targeted. The goal of the Red Team Assessment is NOT to find as many vulnerabilities as possible. The goal is to test the organization's detection and response capabilities. The red team will try to get in and access sensitive information in any way possible, as quietly as possible.”
Objective: Find an entrance to specific information without causing alarm from internal systems, thus also testing the organization’s response capabilities, time to response, etc.
In a few different articles that I found pen testing and red teaming are compared to pirates and ninjas. The idea is that “pirates,” or pen testers, come in loudly and fiercely to take anything and everything that they can. They are less discrete, and you're well aware of the attack. On the other hand, “ninjas,” or a red teams, focus on more controlled, and stealth attacks. They have a specific thing (i.e specific data) `that are trying to take and don’t bother with other distractions.
Red Teaming Examples:
- Phishing: Enticing unsuspecting users into navigating to malicious sites or conducting malicious activity
- Code Execution: Leveraging social engineering in conjunction with weaknesses in system security to obtain the ability to execute malicious code on a victim's machine
What is Threat Hunting?
Wikipedia definition: "Threat hunting is an active cyber defense activity. It is the process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security solutions.”
Objective: Find existing threats by first looking for a breach, then working backward to find their mode of access and what actions they took during the breach.
All of the defensive measures in the world won’t matter if there’s already a threat actor inside your environment exfiltrating data. At MindPoint Group, we then take our learnings from this activity and develop new automated detections to alert on the types of activities we discover.
Threat Hunting Examples:
- Antivirus: System security tool to detect malicious payloads
- Threat Intelligence Resources: Human-produced intelligence, customer telemetry, scanning and crawling open sources of information
The Pen Testing, Red Teaming, and Threat Hunting Overlap
If you’re a visual learner like me, fear not! We created this diagram to show where these three tests overlap and where they differ.
In conclusion, all these tests have their place and purpose in your cybersecurity strategy. As organizations continue to face evolving cyberthreats, your job to protect your organization’s data only becomes more crucial to success.
For over a decade, MindPoint Group has helped organizations of every size, complexity, and sophistication design, implement, manage, and advance their cybersecurity defensive capabilities and operations—all to protect and support their missions and businesses. Learn more about our vulnerability management services (including pen testing, red teaming, and threat hunting) to see how we can help your org.
Related articles:
How to hack through a pass-back attack >
