Continuous Automated Red Teaming (CART) is an emerging technology that arms security teams with an ongoing and automated process of testing the security of a system by emulating the activities of an attacker. CART is a form of offensive security which simulates real-world attacks and assesses the security posture of an organization. The goal of CART is to automate red teaming so organizations can remediate vulnerabilities with increased speed.
How does Continuous Automated Red Teaming work?
The first stage in the CART workflow is mapping the organization’s digital attack surface from the perspective of a threat actor. In order for asset discovery to be fully automated this should be done using an integrated EASM solution. This approach to reconnaissance is not dissimilar to those used by nation-state threat actors.
This initial step can include trying to find the following:
- Exposed credentials
- Vulnerable databases
- Unprotected cloud assets and buckets
- Open ports
Once the vulnerability is located, the simulated attack is launched in a multi-stage operation from the CART attack engine. The aim is to identify the attack paths and blind spots that enable the vulnerability to be exploited by threat actors. Finally, the risks are categorized, and steps are provided to aid mitigation.
If done effectively, the CART program means:
- Testing systems for weaknesses is done regularly
- Systems are monitored to uncover threats
- Risk level of the threats is communicated
- Data is collected on how your systems are behaving
- Discovered vulnerabilities are resolved
Continuous Automated Red Teaming vs. Penetration Testing
Scope
- CART: Has a much broader scope than conventional security testing as it is goal-focused instead of objective. This means that anything can be attacked, which more accurately simulates a real-world attack, and provides a better overall assessment of an organization’s security posture.
- Penetration testing: The scope is often very small, often testing individual IPs or applications. These tests are designed to test the integrity of individual systems in isolation, not considering whether vulnerabilities or misconfigurations in an out-of-scope system could result in a breach. This is a summary that you can learn more about here.
Frequency
- CART: Continuous Automated Red Teaming is, as the name suggests, continuous. It involves ongoing and automated simulated attacks on the system to identify vulnerabilities and weaknesses. Because it is continuous, it can identify new threats and vulnerabilities as they emerge.
- Penetration Testing: Traditional penetration testing is generally conducted at specific intervals, such as annually or semi-annually, and involves manual efforts by ethical hackers. This means it is more of a snapshot of the security posture at a particular point in time.
Scalability
- CART: Because it’s automated, CART is more scalable. It can be employed across large networks and systems with relatively little human intervention, making it suitable for organizations that need frequent and extensive testing.
- Penetration Testing: Due to its manual nature, traditional penetration testing is less scalable and can be more resource-intensive, especially for large organizations with complex networks. Manual testing is also expensive, limiting the amount of testing an organization can achieve
How does Continuous Automated Red Teaming benefit your business?
CART employs a continuous approach, as opposed to being a one-time event, allowing for ongoing monitoring and testing. CART utilizes automation, reducing human error and enabling efficient and timely testing. CART simulates real-world adversaries to identify vulnerabilities in a dynamic and evolving manner.
Ideally, a CART tool is consistently updated to deliver the most realistic testing experience and be reflective of the latest discovered threats and vulnerabilities. This differs from traditional penetration testing, which is often planned in advance and may become outdated quickly due to the rapidly changing threat landscape.
To identify the attack vectors that could be exploited, Hadrian uses a proactive, automated, and adaptive approach to identifying and addressing security vulnerabilities. Our platform uses data from past discovery and reconnaissance to determine the best course of action for which assets to test and how to test them. Hadrian ensures that organizations are able to reduce the exploitable risks that a threat actor could exploit.
