- What is the difference between penetration testing
and red teaming?
And which ones should I focus on?
So here's the thing,
penetration testing is basically,
kind of an attack,
and or you can say an assessment
to test the company's security controls.
Are they vulnerable?
Is there any vulnerabilities there?
And try to carry on an attack
and see if you can get inside the organization
and reach their critical systems.
But penetration testing, there's two things,
two main things that are missing.
The first one is that,
you don't test the security team
behind all of these defenses.
You don't test the SOC team,
you don't test the incident response team.
They knew about this attack,
they know the IPs are being used.
They see the attack, they just don't react to it.
So they let you do all your attack
without them detecting or without them stopping you
or preventing you from this attack.
You'll only test the security controls of the organization.
That's the first thing.
And the second thing that,
you don't build this attack based on intelligence data,
based on threat intelligence.
You don't simulate real attacks
that's happened in the world.
So you might be focusing on what vulnerabilities,
you might be focusing on a different public facing services.
Whatever you've found, vulnerabilities in them or not,
these are not the highest priority
for the organization right now.
Because the attacks that's actually happening
on the organization
are coming through spear phishing attacks or endpoints,
whatever the type attackers use against endpoints.
So, you're focusing on the server side,
where the real attacks are focusing on the client side.
And you give a different sense
of what is the vulnerabilities,
it needs to be brutalized,
it needs to be patched right now.
For an organization, it's really important for them to know.
They have tons of vulnerabilities.
There is no organization
that patched all their vulnerabilities,
that has, they don't have mis-configurations,
they don't have any issue.
All the organizations they have tons
of vulnerabilities they need to fix.
Tons of alerts you need to read and so on.
But the idea is what to brutalize first.
And if you are working just in penetration testing
or penetration testing assessments,
it might not give a good sense of what needs
to be brutalized first.
Penetration Testing assistants are still useful
for different, for compliance, for basic security controls
but it doesn't provide, it's not based on intelligence
it's not based on, doesn't improve the security team,
which is why red teaming comes and help.
So red teaming is all about simulating real attacks.
It's looking at what other attacks is happening right now
against this organization
or similar organization to this one.
And then, from there,
they start to simulate these attacks,
starting to follow their tactics and techniques
and procedures and creating their own special malware or,
or weapons, or you've been using tools that hasn't been,
that has been encrypted and skated enough
to bypass multiple security controls and defenses.
They carry their attack against the security controls,
against the security teams working there.
They have no idea this attack is actually happening
or this red teaming assessment's actually happening.
And the attack is, is running in complete black box.
They are going through all the defenses.
They are bypassing all the defenses
and really testing the organization
against the attacks that's happening nowadays,
happening to them or to organizations like them.
So that's how red teaming is really,
really important for organization.
So if you're building your career
in, in the offensive side,
which one you should focus on?
Well, in penetration testing, you'll learn the basics,
the foundation of the offensive side
and of how the attack actually work.
But to really become competent,
to really become one
of the top candidates applying
for any penetration testing jobs,
then focusing on red team
and learn how real attacks look like
is the next level that will take you
from here to there.
You take your career and your resume into way higher level
because you understand the real attacks.
Now you are worth to the company you're working for,
whatever you're working for,
a company to carry assessment for
or to other organizations
that carry assessments to other companies.
You are worth all the attacks
that you are saving the organization from,
or saving the clients of your organization from.
You're worth the millions that
will be using in this target around somewhere attacks
or different immediate attacks that's happening.
So this is how worth you are.
Penetration testing is something that
is now the majority of people has went
through studying penetration testing at some point.
Most of the people who'll start in cybersecurity,
start with penetration testing.
That's how I started and this,
the move maybe to incident response or to malware analysis.
But there's so many people who hear about cyber security
through penetration testing.
There is way more candidates than the jobs
that are actually opening for, for this type of jobs.
So to really stand out,
you need to jump from penetration testing to red teaming.
From how I can do simple attacks, just,
you know, using Metasploit and Kali Linux and,
and all of that
to actually how I can simulate a real attack
how I can be, how I can carry an attack
that's similar to a nation state attacks
or target ransomware attacks
or the attack that cost companies millions of dollars.
This is how valuable
this type of knowledge or this type of attacks are.
So my advice to you is that learn the penetration testing
until you have the foundation, the basic foundation
and then move to red teaming
and learn how the real attacks actually look like
and carry out this red teaming assessments for you.
That's my video for today and see you in the next video.