9781718505100

Trevin Edgeworth has spent more than two decades in security, with a specialty in leading and building red team programs from the ground up. He has established and led red teams at American Express, Capital One, and Symantec, and has helped several additional organizations launch programs of their own. He also served as chief security officer at NortonLifeLock (now Gen Digital). A veteran of hundreds of red team operations, Trevin has served organizations across the technology, energy, manufacturing, and biotech industries. His deepest focus has been in financial services, where his teams have operated against some of the most critical institutions in the global financial system. Trevin has shared industry thought leadership in a variety of ways, including as a contributing columnist for SecurityWeek and as a guest on the CyberWire’s Hacking Humans podcast. He currently leads red team services for a global professional services firm.

Jordan Potti leads security assurance at a major technology company, where he founded its offensive security, AI security, and security architecture programs. He began his career on the red team of a global security vendor and is the co-creator of the Red Team Maturity Model, the framework organizations use to assess and expand their red team programs. His open source tools have revealed exposed data across the major cloud providers and helped push cloud storage security into the spotlight, and he has published CVEs in enterprise security products and contributed to major bug bounty programs. Jordan holds what remains a minority opinion among red teamers: that what matters most is not what you call the team or how clever its tradecraft is, but whether the organization is more secure because of it. This book is, in part, his attempt to make that opinion less fringe.

Noah Potti has spent his career building and leading red teams, breaking into companies that have hired him to do so. At Capital One, he helped establish one of banking’s first professional red team programs, then went on to lead the red team at Gen Digital and work on the Adversarial Engineering and Operations program at Okta, while consulting at Bishop Fox in between. His operations have ranged from stealthily gaining physical entry into corporate facilities to emulating adversaries across global enterprises over the long term. Noah has has authored offensive tooling and contributed modules to Metasploit and Hashcat. Breaking into systems taught him to focus on the few things that impact an attacker's actions, out of the many that don't. He's convinced defenders win the same way: by spending on the handful of paths that matter and ignoring the rest.

Foreword by HD Moore, Creator of Metasploit and founder of RunZero
Acknowledgments
Introduction

Part I: Build A Red Team Program
Chapter 1: Foundations of Red Teaming
Chapter 2: Assessing Your Organization's Environment
Chapter 3: Developing a Program Strategy
Chapter 4: Formalizing Your Operations

Part II: Leading the Program
Chapter 5: Building Strategic Partnerships
Chapter 6: Managing and Developing Talent
Chapter 7: Choosing the Right Metrics
Chapter 8: Communicating Risk
Chapter 9: Attacker Infrastructure
Chapter 10: Annual Planning

Part III: Conducting Operations
Chapter 11: Project Management
Chapter 12: Designing an Operation
Chapter 13: Execution Case Study: Emulating ShinyHunters
Chapter 14: Reports
Chapter 15: Outbriefs
Chapter 16: Driving Findings to Resolution

Part IV: Tactical Methodologies
Chapter 17: Initial Access Vectors
Chapter 18: Establishing Persistence
Chapter 19: Expanding Access
Chapter 20: Acting on Objectives

Appendix A: Walking Deck Slides
Appendix B: Nimble Finding Template
Appendix C: Red Team Process Documentation
Appendix D: Queen for a Day Letter
Appendix E: The Red Team Development Matrix
Appendix F: Rules of Engagement
Appendix G: Sample Operation Report
Appendix H: Sample Style Guide
Appendix I: Reporting Rubric

Index