Offensive Services – Bitdefender TechZone

Abstract

Bitdefender Offensive Security Services use ethical hacking to stress-test your defenses. Penetration testing and Red Teaming can help you identify and mitigate vulnerabilities, risks and improve your response capabilities.

Gone are the days of security as a checkbox exercise. For truly effective security, a skeptical mindset is required. We must constantly scrutinize our defenses, searching for weaknesses that could be exploited by adversaries.

Offensive security services, conducted by ethical hackers who mimic real-world attacks, go beyond simply testing prevention. They stress-test your entire security posture - prevention, protection, detection, and response mechanisms.

Bitdefender Offensive Services help you identify and mitigate vulnerabilities, risks and improve your response capabilities in your IT infrastructure. We offer two key services to achieve this:

Penetration Testing: This service identifies vulnerabilities and risks by simulating real-world attacks, helping you understand your security posture of specific assets.
Red Teaming: This service takes it a step further by simulating real-world attacker behavior, across interconnected assets, allowing you to test your detection and response capabilities against advanced threats like ransomware.

Both methods are designed to proactively assess security gaps in any environment, whether on-premises, cloud, or hybrid. These assessments are not a one-time solution but should be part of a regular security strategy. We recommend conducting penetration testing and red teaming at least annually. You may also need them more frequently following major changes to your IT infrastructure or before launching new web or mobile applications.

Penetration Testing	Red Teaming
The primary objective is to identify as many vulnerabilities as possible, in a limited scope.	The primary objective is to stress and enhance organizational ability to detect and respond to adversaries.
Defined Scope.	Open Scoped, designed to demonstrate critical impact to a business or organization. Targets people, processes, and technology.
Known to all stakeholders.	Only the Exercise Working Group is aware of the exercise.
Identifies and exploits vulnerabilities.	Emulates real adversary behavior.
Reports with actionable recommendations.	Reports with analysis and recommendations across the prevention, detection and response spectrum.

Penetration Testing

Penetration testing (Pentesting) is a proactive security measure where experts simulate cyber-attacks on your IT systems to find vulnerabilities before real attackers do. This process involves testing your network and applications to identify weaknesses that could be exploited to infiltrate your network, abuse services, disrupt operations, and exfiltrate sensitive data.

The main goal is to reduce risk by uncovering exploitable system vulnerabilities, assessing the potential damage of a successful attack, and recommending corrective actions to close those critical vulnerabilities. This process also ensures adherence to security assessment guidance that is recommended and/or prescribed in cybersecurity industry frameworks like SOC 2, PCI DSS, ISO/IEC 27001, HIPPA, GDPR, NIST, etc. Penetration tests also facilitate security readiness processes for mergers and acquisitions. After the penetration test is performed, the M&A can know their security posture, the options that exist to improve it, and meet due diligence requirements for investment/acquisition and supplier onboarding needs for enterprise customers.

Penetration Testing types

Penetration testing can be conducted in three ways:

Black-box Testing - The tester receives no information or access other than the scope of work. Testing is done from an anonymous user perspective, typically with only the target URL or IP addresses. The testing is limited to the access the tester manages to find or exploit.
Grey-box Testing - The tester receives limited information and access, such as credentials for accessing the targets and limited documentation (e.g., API documentation, network architecture diagrams). There is also limited technical information from the developer/administrator. This approach goes beyond black-box testing and is more comprehensive, as the tester can assess functions accessible to logged in users.
White-box Testing - The tester receives full access to information about the targets, including full admin access to the target application and servers, complete documentation (e.g., technical specifications, security requirements, detailed network architecture diagrams), full source code, and full support from technical stakeholders (e.g., developer and administrator). This method is the most comprehensive and requires additional effort to review all provided information to identify all possible vulnerabilities.

	Black-Box	Grey-Box	White-Box
Credentials	No	Yes	Yes
Documentation	No	Yes	Yes
Source Code	No	No	Yes

Penetration Testing Methodology

Our penetration testing methodology include five steps:

The Scoping and Planning Phase lays the groundwork for a successful penetration test. This crucial stage involves defining the scope, goals, and boundaries of the assessment. Our team works closely with you to identify the specific systems, networks, and applications that require evaluation. We then determine the most effective testing approach, whether it's a black-box simulation of an external attacker, a white-box test with full knowledge of your system, or a gray-box approach with some internal information. Setting clear objectives, timelines, and the resources required ensures everyone involved understands the goals and expectations.
The Reconnaissance Phase initiates the penetration testing process by gathering critical intelligence about the target systems. Our team actively gathers publicly available information about the target system through techniques like email header analysis, OSINT (Open-Source Intelligence), and basic analysis from webscraping. We leverage specialized tools and techniques to complement this information gathering. The results from both passive and active reconnaissance techniques are meticulously compiled and analyzed.
Scanning Phase maps and analyzes the target network’s infrastructure. This phase is conducted so our team can define the network components and functionality. Building upon intelligence gathered during reconnaissance, the scanning process begins by identifying live systems and open ports. Scanners then investigate further, exploring the services running on those ports and their specific versions. This initial scan helps map the attack surface, providing a comprehensive picture of the interconnected systems. The process then expands outwards, utilizing techniques like port scanning, service fingerprinting, network enumeration (identifying services, shares, and potential accounts), and identification of potential access points. This initial discovery phase allows testers to gradually build out the network topology and prioritize the most critical targets for further manual exploration.
Once there’s an understanding of the network resources, active services, and exposed items, Vulnerability discovery and analysis can take place. We focus on pinpointing security weaknesses and exploitable vulnerabilities within the target systems. Then we leverage a combination of automated and manual scanning techniques to efficiently detect known vulnerabilities, also delve deeper by analyzing configuration settings, patch levels, and the overall system architecture to uncover any potential security flaws. Identified vulnerabilities are meticulously validated through further testing and analysis to confirm their legitimacy and potential impact. Finally, we prioritize the vulnerabilities based on their severity, exploitability, and potential damage they could cause to your systems.
The Exploitation Phase delves deeper to assess the true impact of the identified vulnerabilities. Through detailed analysis of the identified vulnerabilities, our team methodically seeks to understand whether any of these can be exploited on the in-scope asset. Our team strategically employs various exploitation techniques and tools to attempt to gain unauthorized access to target systems or information. This process is carefully designed to demonstrate the feasibility of real-world attacks while avoiding harm to your systems. All exploitation attempts and their outcomes are meticulously recorded for later analysis, providing valuable insights for remediation.
The Reporting Phase culminates the penetration testing process by providing you with actionable recommendations within 5 days after completing the test. Each penetration test report actively analyzes your system, offering detailed descriptions of identified vulnerabilities. We assign severity ratings based on the Common Vulnerability Scoring System (CVSS) to provide information on which issues are to be prioritized. Our report explains the potential impact of each vulnerability, outlines possible exploitation scenarios, and provides steps to replicate the vulnerabilities for verification. To further substantiate our findings, we capture screenshots as evidence. Finally, the report clearly recommends actionable steps to effectively remediate the identified issues, ensuring your systems are secure and resilient against potential threats.

Penetration tests are conducted following industry best practices and recognized standards to ensure a thorough and rigorous evaluation. This means we leverage established frameworks to identify and exploit vulnerabilities in your systems.

For example, we use the Open Web Application Security Project Application Security Verification Standard (OWASP ASVS) in our web application penetration testing. We further ensure the quality of our assessments by adhering to the rigorous methodologies outlined by CREST, as a CREST-accredited organization.

Penetration Testing Services

Network Infrastructure Penetration Testing involves testing a client's network infrastructure. This can be done from either an external or an internal network perspective. For instance, one of the checks that is performed is to scan for outdated network services that contain vulnerabilities or configurations that would allow unauthorized access to information.
Web Application Penetration Testing involves testing a web application and its associated functionality. This process is crucial to ensure the security and integrity of your web applications. The methodology is based on various industry standards, but primarily relies on the OWASP Top 10, OWASP Web Security Testing Guide, and OWASP Application Security Verification Standard. We employ a comprehensive approach to identify vulnerabilities. For example, by verifying authentication and authorization, we can ensure only authorized users can access specific areas of your application. Testing injections allows us to verify protection against attacks that insert malicious code into your application.
Thick Client Penetration Testing involves testing a bundled application for security weaknesses in their processing both locally and server-side, including checking for weaknesses in proprietary protocols. Thick client application penetration tests can be performed on Windows and macOS operating systems. The methodology is primarily driven by the OWASP Desktop App Security Top 10. For example, we identify known vulnerabilities to find and fix common security flaws in your application. Additionally, by checking for sensitive information in files, we ensure your application doesn't store sensitive data insecurely.
Web API Penetration Testing involves testing an API and its associated functionality. This process is crucial to ensure the security and integrity of your APIs. The methodology is based on various industry standards but is primarily driven by the OWASP API Security Project Security Top 10. For example, we ensure that only authorized users can access your API by checking for broken authentication and verifying object-level authorization to confirm that users can only access their own data.
Mobile Application Penetration Testing involves testing a mobile application and its associated functionality to ensure its security. Mobile application penetration tests can cover both iOS and Android operating systems. The methodology is based on various industry standards, but is primarily driven by the OWASP Mobile Security Testing Guide, and OWASP Mobile Application Security Verification Standard. For example, we check for insecure communication to ensure data transmitted between the app and servers is encrypted and protected. Additionally, we verify that sensitive data is not stored insecurely on mobile devices.
Wireless Penetration Testing involves a consultant simulating an attacker to test the security of your Wi-Fi network. For example, we will check for weak authentication and rogue access points. This ensures that only authorized users can connect to your wireless network and helps to detect unauthorized access points that could compromise your network security.

Red Teaming

Red Teaming (also known as Adversarial Attack Simulation Exercises, AASE) is a security practice that simulates real-life threat actors to demonstrate how attackers would attempt to compromise critical functions and underlying systems of your organization. It goes beyond a penetration test by using ethical hacking with Techniques, Tactics, and Procedures (TTPs) derived from the MITRE ATT&CK Framework to identify feasible attack paths (including social engineering and physical security) through a series of interconnected systems/assets.

The main goal is to provide a clear understanding of your Blue Team's actual visibility and detection coverage. This helps identify gaps, prioritize development of new detection rules, understand potential attack vectors, and offers actionable insights to improve defenses.

Red Teaming Threat Modeling

Threat modeling involves creating attack simulation scenarios by considering the most likely adversaries, the attack vectors they might use, and the potential vulnerabilities these attacks could exploit. The goal of these exercises is to assess the capability to prevent, detect, and respond to cyberattacks that may impact organizations. Red teaming exercises mirror real-world attacks, imitate tactics used by determined and skilled adversaries.

Bitdefender Red teaming utilizes and references frameworks like MITRE ATT&CK®, OSINT, and Singapore's AASE guidelines to craft realistic attack simulations.

The MITRE ATT&CK Framework includes a documented knowledge base of TTPs employed by real-world attackers. The framework consists of a detailed list of tactics which includes Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration, Command and Control. Each of these tactics comprises several techniques that can be replicated by Red Teaming in attack simulations.
The OSINT Framework guides Red Teaming on how to collect information from publicly available sources. This information can be anything from social media posts to company reports, including links to search engines, social media platforms, and tools such as Maltego, Shodan, and Metasploit.
Singapore AASE guideline supports financial institutions by providing best practices and recommendations for assessing and enhancing resilience against sophisticated attacks through Adversarial Attack Simulation Exercises.

Red Teaming Engagement

We offer two versions of our red team service, designed to provide different outcomes and objectives depending on your requirements.

Adversary Emulation: This approach focuses on testing your defenses against pre-defined attack simulations based on your specific threat model. This allows us to target specific security controls and tailor the testing to your organization's vulnerabilities.
Objective-based Simulated Attack: In this approach, the red team seeks to achieve goals set by you such as gaining access to a specific internal system, downloading certain corporate secrets, etc. They will employ a wide range of tactics to achieve these objectives. The red team employs stealth to achieve its objective without awareness from the defensive team. This method provides a realistic test of your overall security posture.

During the scoping phase, we perform an analysis of the most suitable approach based on your needs, concerns and budget.

Each organization has a different threat model, and we can propose scenarios that address these issues. The red team could start by performing classic phishing attacks to get an initial foothold in the network or simulate an attacker that had already gained access to a computing device on the corporate network.

Red Teaming Reports

Each Red Teaming report contains an executive summary and details the results and observations for each phase of the assessment. These phases include the attack path, findings, methodology, and an Incident Response section. The report also provides an overall evaluation of how your organization's prevention, detection, and response capabilities responded to the execution of the attack techniques. Finally, it includes recommendations to mitigate identified risks.

Data Security Compliance

We take care of all data possessed during penetration testing and red teaming. All data and logs downloaded are encrypted using AES-256 encryption. Data is shared only with the consultants involved in the project. Any information obtained during the red team assessment would be deleted upon request.

More Resources

Offensive Services official website: Offensive Services