Flavijus Piliponis â stock.ado
CISA red team reveals why some SOCs fail and others succeed
CISA tested two critical infrastructure SOCs with similar red team tactics. The results expose dangerous gaps in detection, response and credential security.
"It was the best of times, it was the worst of times…"
Charles Dickens didn't write this in regard to red team testing, but the paradox illustrating how people experience the same event in different ways could relate to how various organizations' systems might fare differently when faced with the same red team simulation.
CISA this week published the results of simultaneous assessments its red team conducted against two critical infrastructure organizations. In both tests, the red team gained initial access to the victim's environment -- but one victim fared worse than the other.
Advisory AA26-237A, "A Tale of Two SOCs: Insights from Two Red Team Assessments," details how CISA penetrated both networks, resulting in "Organization A," from the government services and facilities sector, not detecting the intrusion, while "Organization B," from the water and wastewater systems sector, did. Both exercises reveal important lessons for CISOs.
"This alert raises legitimate concerns regarding the state of cybersecurity and offers areas for improvement across people, process and technology," said Theresa Lanowitz, an analyst at Omdia, a division of Informa TechTarget.
Two tests, two outcomes
Organization A
CISA's red team gained initial access to Organization A after identifying an app with default credentials that enabled it to send phishing emails from an internal email address. After infiltrating four workstations, the team used a modified open source attack path tool to evade detection and scrape Active Directory data. It escalated the attack using Machine Account Quota, an AD setting that permits users who are not admins to create up to 10 accounts in a domain by default, and misconfigured AD Certificate Service templates.
From there, the team accessed databases after finding cleartext and static credentials. It also exploited elevated permissions in Microsoft Entra ID that enabled the team to view SOC members' emails and Teams messages.
The report noted that while Organization A's SOC received low- and medium-severity EDR alerts, it did not respond to them. CISA attributed this to alert fatigue, organizational silos and insufficient alert escalation procedures.
Organization B
CISA's red team infiltrated Organization B's network after three users clicked on spear phishing emails. The victim's SOC received a medium-severity alert for each click and isolated the workstations within two, 10 and 20 minutes -- but not before the red team executed LDAP queries that gathered domain AD data, including users, groups and devices.
At this point, to advance the exercise, IT staff members at Organization B who were aware of the simulation executed a payload that provided the red team access as if it had evaded detection. The red team subsequently found cleartext credentials for a domain service account, achieved CDSync privileges and obtained AD account credentials.
The red team also accessed a bastion host using FTP credentials to log in over SSH, which enabled access to the OT network, but Organization B's SOC successfully isolated the host in the OT DMZ. The red team also attempted to breach the organization's cloud systems using cleartext credentials it found for Entra ID Connect, but an automated alert from Microsoft prompted the SOC to block the suspicious login.
What CISOs need to know
Omdia's Lanowitz said the CISA report has important takeaways for cybersecurity leaders.
"Tooling alone is not effective or sufficient," she said. "People are the weakest link. Processes are codified and implemented to provide the repeatable rules and actions used by tooling and humans to create an organized defense."
Other key lessons for CISOs and their SOCs include the following.
Tune detection tools
"Without well-defined baselines and alert filtering, false positives and routine alerts overwhelm defenders, obscuring real threats," CISA wrote in the report. Organizations should establish baselines and set proper alert filtering to ensure the SOC can detect true threats and reduce false positives.
"Gone are the days of an overwhelming number of false positives from security tools. Modern tooling allows security teams to establish a baseline and effectively identify routine business activity," Lanowitz said.
Eliminate silos
"It is important to note the impact of organizational silos on impeding decisive action by security teams," Lanowitz said. "The institutionalized bureaucracy that prevented effective incident response is indicative of lack of cyber resiliency."
A cyber-resilient organization, she added, prioritizes communication, has agreed-upon procedures and empowers action. This includes aligning the line of business and security to remove organizational silos, which requires trust and collaboration.
Follow basic security hygiene in and out of the cloud
"Learning that both organizations underestimated risks in cloud environments is not surprising," Lanowitz said, pointing to the importance of organizations understanding their entire attack surface -- including in the cloud -- and having visibility into all assets. Recent Omdia research, she added, found that only 41% of organizations collect asset configuration data for threat and exposure remediation processes.
Key hygiene best practices include basing permissions on the principle of least privilege and extending conditional access beyond human users to include nonhuman identities. Eliminate static credentials and never store them in cleartext. In addition, establish cloud incident detection, response and remediation processes, and implement mature procedures to revoke or refresh tokens following a cyberincident.
Failing a red team simulation -- while potentially painful -- can lead to a meaningful outcome: stronger security from lessons learned. Or, as Dickens wrote in A Tale of Two Cities, "there is prodigious strength in sorrow and despair."
Sharon Shea is executive editor of TechTarget Cybersecurity.
