First, it’s important to identify your objectives. Physical security is more than a compliance box to be checked off. Instead, you should view the physical security assessment as a part of a larger cyber assessment that is designed to meet your specific goals and expectations. For example, maybe you’re looking to validate the security of your current credentials system by seeing if the red team operators can bypass the need for a physical ID or biometrics to gain access to critical infrastructure or key facilities.

Once the objectives of the assessment are defined, the red team should conduct reconnaissance exercises to better understand their target. This is similar to the steps required for a cyber assessment. The more you know, the more effective your assessment will be. This includes examining the company’s “patterns of life” and third-party vendors to understand their roles at the company as well as the tools and processes they use as part of their everyday responsibilities. All of this reconnaissance feeds directly into the planning phase.  

During this phase, the red team should begin planning out their attack and identifying the different engagement points through which they want to evaluate their target. This also includes the different strategies they plan to use during the assessment, such as social engineering (showing up in person or calling over the phone), leveraging cyber tactics to surreptitiously add their operators to an access list, and so on. It’s crucial to coordinate your plan with the appropriate stakeholders as well as legal authorities. This not only ensures that the operation can continue if the red team is stopped or apprehended, but more importantly, it helps to ensure the safety of the team itself.

Next comes the execution phase, also known as the actual red team physical security assessment. During this phase, the red team will actually attempt to breach the target facility using previously agreed upon methods. This is a critical aspect of the execution phase, as the red team will need to abide by standard safety practices, rules of engagement regarding behavior, and other physical security precautions. This is also the stage at which operators will collect evidence on what they did during the assessment. This evidence is then used during the final reporting stage to help provide future-looking mitigation recommendations and recognize where the target security team performed well.

Red Team Physical Security Best Practices

By contrast, Red Teaming takes a broader perspective. While Penetration Testing focuses on breaking into specific systems, Red Teaming simulates a full-spectrum attack on your organization. It’s a realistic stress test that considers the human factor, organizational behaviors, physical security, and more. Red Teamers look at potential business impact rather than merely breaching the system.

4 Key Differences Between Penetration Testing and Red Teaming

1. Limit people in the know. The fewer people who know the assessment is underway, the more realistic and accurate the results. With a Red Team Simulation, we’re testing your ability to not only prevent an attack but to also respond to it. Leverage a small number of “trusted agents” who are read in to the assessment, but don’t let your defensive teams know. This way, their responses can be assessed as a true and accurate depiction of their ability to defend.
2. Have an objective. With penetration testing, the goal is to prove that vulnerabilities can be exploited. The potential risk of that exploitation is often left to the imagination. In a Red Team Attack Simulation, the goal is different. Exploitation of vulnerabilities enables the threat actor’s true objective. What is that objective? Is it to steal proprietary information? Is it to deploy ransomware? Create a persona to represent the simulated threat and let it serve as the guide for your Red Team.
3. Establish clear rules of engagement for the simulation, but don’t handcuff the team. Your organization relies upon your information systems to operate. While a determined adversary has no rules in terms of their activities, it is important to establish clear rules of engagement that define systems, networks, facilities, and personnel that are either in-scope or out-of-scope. An effective Red Team Simulation needs to be able to operate as closely as possible to that of the threat actor you’re attempting to emulate. This includes targeting users in your environment. Human error is one of the most common causes of security breaches. Forty-three percent of people have made mistakes at work that compromised cybersecurity, and 85% of data breaches are caused by human error.
4. Consolidate learnings to improve future detection and response – After your simulation is complete, it’s important to conduct a post-mortem to evaluate what went well and where there is room for future improvements. Many Red Team providers already offer this service as part of their services but if you’re planning on conducting a Red Team Attack Simulation in-house, this step is a critical part of ensuring future security benefits.
5. Don’t grow complacent – Finally, Red Team Simulations are an ongoing endeavor, and security teams will need to continually test their defenses if they hope to keep up with the rapidly evolving pace of cybercriminals. When creating a defense plan for your organization, be sure to incorporate periodic Red Team Attack Simulations to regularly evaluate current security protocols and identify any potential weaknesses. As you develop a deeper understanding of the threats to your environment, leverage alternative personas to simulate different attack objectives and continue to improve your defenses.