--- title: Challenging an organization’s cloud security posture with rigorous Red Team assessments description: Identity cloud security gaps. Strengthen cloud security posture through proactive red team assessments. Overcome cybersecurity risk due to remote work. image: https://blog.aujas.com/hubfs/Banner.jpg --- [![Aujas Logo-1](https://blog.aujas.com/hs-fs/hubfs/Aujas%20Logo-1.webp?width=951&name=Aujas%20Logo-1.webp "Aujas Logo-1")](https://www.aujas.com/) - Services - [Identity and Access Management](https://www.aujas.com/robotics-iam-identity-access-management-services) - [Identity Governance Fast Track](https://www.aujas.com/iam-identity-governance-fast-track) - [Privileged Identity Management Fast Track](https://www.aujas.com/privileged-identity-management) - [Cloud Single Sign-on Fast Track](https://www.aujas.com/cloud-sso) - [Robotics Driven IAM](https://www.aujas.com/robotics-iam-services) - [Risk Aware IAM](https://www.aujas.com/risk-aware-iam) - [Consumer IAM](https://www.aujas.com/consumer-identity-and-access-management) - [Cybersecurity Advisory Services](https://www.aujas.com/cybersecurity-advisory-services) - [Cyber Risk Management](https://www.aujas.com/cyber-risk-management-services) - [Integrated Compliance Management](https://www.aujas.com/cybersecurity-compliance-services) - [GRC Technology Automation](https://www.aujas.com/grc-technology-automation-services) - [Third Party Risk Management](https://www.aujas.com/third-party-risk-management) - [Privacy and Data Protection](https://www.aujas.com/data-privacy-data-protection-services) - [Security Verification](https://www.aujas.com/security-verification-services) - [On-Demand Security Assessment](https://www.aujas.com/on-demand-security-testing-and-services) - [Breach & Attack Simulation](https://www.aujas.com/automated-continuous-attack-simulation) - [IoT Security Assessment](https://www.aujas.com/internet-of-things-security-assessment) - [Red Teaming](https://www.aujas.com/red-teaming-services) - [Integrated Security Assurance Program](https://www.aujas.com/isap) - [DDoS Simulation](https://www.aujas.com/ddos-attack-simulation-services) - [DevSecOps](https://www.aujas.com/devsecops) - [API Security](https://www.aujas.com/api-security) - [Security Engineering](https://www.aujas.com/security-engineering-services) - [Secure Software Development](https://www.aujas.com/secure-software-development) - [Ecosystem Engineering](https://www.aujas.com/ecosystem-engineering) - [Custom Security Development](https://www.aujas.com/custom-security-solution-development) - [Registered Device Management Platform](https://www.aujas.com/registered-device-management-platform) - [Managed Detection and Response](https://www.aujas.com/managed-detection-and-response-services) - [Offensive Security Services](https://www.aujas.com/offensive-security-services) - [OT Security Services](https://www.aujas.com/ot-security-services) - [Microsoft Sentinel](https://www.aujas.com/sentinel) - [Threat Management](https://www.aujas.com/threat-management-service) - [SIEM & Security Monitoring](https://www.aujas.com/siem-security-monitoring) - [SecOps Orchestration](https://www.aujas.com/security-orchestration-automation-and-response) - [Google SecOps](https://www.aujas.com/googlesecops) - [Cloud Security](https://www.aujas.com/cloud-computing-security-services) - [AWS Cloud Security Services](https://www.aujas.com/aws-cloud-security-services) - [Cloud Security Foundation](https://www.aujas.com/cloud-security-foundation) - [Cloud Risk Management](https://www.aujas.com/cloud-risk-management) - [Cloud Security Engineering](https://www.aujas.com/cloud-security-engineering) - Products - [PALM](https://www.aujas.com/platform-for-access-lifecycle-management) - [Saksham](https://saksham.aujas.com) - [CodeSign](https://codesign.aujas.com) - [Aadhaar Registered Device Manager](https://www.aujas.com/registered-device-management-platform) - Company - [About us](https://www.aujas.com/about-us) - [Investor Relations](https://www.aujas.com/investor-relations) - [Team](https://www.aujas.com/team) - [Partnership](https://www.aujas.com/partnership) - [Contact us](https://www.aujas.com/contact-us) - [Careers](https://www.aujas.com/cybersecurity-careers) - Resources - [Blog](https://blog.aujas.com) - [Collaterals](https://www.aujas.com/collaterals) - [Case Studies](https://www.aujas.com/case-study) - [Contact Sales](https://www.aujas.com/contact-us) - ![](https://blog.aujas.com/hubfs/Aujas%202020/blue-search.png) ![blue-search](https://blog.aujas.com/hubfs/Aujas%202020/blue-search.png "blue-search") ![Aujas Cybersecurity Logo 2024](https://blog.aujas.com/hubfs/Aujas%20Cybersecurity%20Logo%202024.webp "Aujas Cybersecurity Logo 2024") - Services - [Identity and Access Management](https://www.aujas.com/robotics-iam-identity-access-management-services) - [Identity Governance Fast Track](https://www.aujas.com/iam-identity-governance-fast-track) - [Privileged Identity Management Fast Track](https://www.aujas.com/privileged-identity-management) - [Cloud Single Sign-on Fast Track](https://www.aujas.com/cloud-sso) - [Robotics Driven IAM](https://www.aujas.com/robotics-iam-services) - [Risk Aware IAM](https://www.aujas.com/risk-aware-iam) - [Consumer IAM](https://www.aujas.com/consumer-identity-and-access-management) - [Cybersecurity Advisory Services](https://www.aujas.com/cybersecurity-advisory-services) - [Cyber Risk Management](https://www.aujas.com/cyber-risk-management-services) - [Integrated Compliance Management](https://www.aujas.com/cybersecurity-compliance-services) - [GRC Technology Automation](https://www.aujas.com/grc-technology-automation-services) - [Third Party Risk Management](https://www.aujas.com/third-party-risk-management) - [Privacy and Data Protection](https://www.aujas.com/data-privacy-data-protection-services) - [Security Verification](https://www.aujas.com/security-verification-services) - [On-Demand Security Assessment](https://www.aujas.com/on-demand-security-testing-and-services) - [Breach & Attack Simulation](https://www.aujas.com/automated-continuous-attack-simulation) - [IoT Security Assessment](https://www.aujas.com/internet-of-things-security-assessment) - [Red Teaming](https://www.aujas.com/red-teaming-services) - [Integrated Security Assurance Program](https://www.aujas.com/isap) - [DDoS Simulation](https://www.aujas.com/ddos-attack-simulation-services) - [DevSecOps](https://www.aujas.com/devsecops) - [API Security](https://www.aujas.com/api-security) - [Security Engineering](https://www.aujas.com/security-engineering-services) - [Secure Software Development](https://www.aujas.com/secure-software-development) - [Ecosystem Engineering](https://www.aujas.com/ecosystem-engineering) - [Custom Security Development](https://www.aujas.com/custom-security-solution-development) - [Registered Device Management Platform](https://www.aujas.com/registered-device-management-platform) - [Managed Detection and Response](https://www.aujas.com/managed-detection-and-response-services) - [Offensive Security Services](https://www.aujas.com/offensive-security-services) - [OT Security Services](https://www.aujas.com/ot-security-services) - [Microsoft Sentinel](https://www.aujas.com/sentinel) - [Threat Management](https://www.aujas.com/threat-management-service) - [SIEM & Security Monitoring](https://www.aujas.com/siem-security-monitoring) - [SecOps Orchestration](https://www.aujas.com/security-orchestration-automation-and-response) - [Google SecOps](https://www.aujas.com/googlesecops) - [Cloud Security](https://www.aujas.com/cloud-computing-security-services) - [AWS Cloud Security Services](https://www.aujas.com/aws-cloud-security-services) - [Cloud Security Foundation](https://www.aujas.com/cloud-security-foundation) - [Cloud Risk Management](https://www.aujas.com/cloud-risk-management) - [Cloud Security Engineering](https://www.aujas.com/cloud-security-engineering) - Products - [PALM](https://www.aujas.com/platform-for-access-lifecycle-management) - [Saksham](https://saksham.aujas.com) - [CodeSign](https://codesign.aujas.com) - [Aadhaar Registered Device Manager](https://www.aujas.com/registered-device-management-platform) - Company - [About us](https://www.aujas.com/about-us) - [Investor Relations](https://www.aujas.com/investor-relations) - [Team](https://www.aujas.com/team) - [Partnership](https://www.aujas.com/partnership) - [Contact us](https://www.aujas.com/contact-us) - [Careers](https://www.aujas.com/cybersecurity-careers) - Resources - [Blog](https://blog.aujas.com) - [Collaterals](https://www.aujas.com/collaterals) - [Case Studies](https://www.aujas.com/case-study) - [Contact Sales](https://www.aujas.com/contact-us) - ![](https://blog.aujas.com/hubfs/Aujas%202020/blue-search.png) ![](https://blog.aujas.com/hubfs/Aujas%202020/close.png)     # Challenging an organization’s cloud security posture with rigorous Red Team assessments - ![Harpreet Singh Passi](https://blog.aujas.com/hubfs/Harpreet.jpg)[Harpreet Singh Passi](https://blog.aujas.com/author/harpreet-singh-passi) - Sep 15, 2020 SHARE [Red teaming](https://www.aujas.com/red-teaming-service) is in talks these days, but very few organizations are walking the talk. Some are too confident about their costly infrastructure; some think that it is the same as [VAPT](https://www.aujas.com/vulnerability-management-using-savp), and some do not care. **The questions remain the same:** - Are we safe from hackers? - Do we have adequate configurations in place? - Are we doing enough due diligence to protect the business? Here is an ideal use case scenario on how to initiate a red team assessment to test cyber defenses. The assessment focuses more on the approach and coverage using the MITRE framework. The framework advantages included scoping and tailoring TTP for progress tracking, clarity on project phases, and the goals which should be achieved. **Here are the benefits of using the framework vis-à-vis the disadvantages:** ![Mitre Attack Blog](https://blog.aujas.com/hs-fs/hubfs/Mitre%20Attack%20Blog.jpg?width=673&name=Mitre%20Attack%20Blog.jpg) ## MITRE Approach Two matrices by MITRE offer a simplified approach to the overall activity. The first matrix is related to passive and active enumeration, and the second about active exploitation. We will be calling this Phase 1 or PRE-ATT&CK and Phase 2 or ATT&CK, respectively. Comparing Phase 1 to reconnaissance would suffice. However, there is much more in the PRE-ATT&CK phase than just recon when looked at it from an adversary standpoint. **Phase 1 - PRE ATT&CK Phase** This phase has three sub-phases: - **Target Identification:** The organization can be chosen depending on the sector, interest, and goal. - **Information Gathering:** This involves active and passive information gathering related to people, organization, and processes. - **Adversary OPSEC:** Here, the adversary prepares itself by setting up C2, creating bots, fake accounts, and framing stealth breach techniques. **Phase 2: ATT&CK Phase** In this phase, multiple plans are devised based on the collected information. For this initiative, the red team can formulate two plans. - **Plan A:** Gain initial foothold using web application vulnerabilities. - **Plan B:** Social engineering by using phishing and vishing techniques; since this can be too easy, this can be considered as a backup plan. We will see how to execute Plan A in action as we advance. ## **The Red Team Approach** The project can be initiated with a meeting to discuss the objectives and goals. The Red Team usually has two objectives. One is to assess the security of the targeted organization, and the other is to follow the framework and leverage the same techniques used by a real adversary. Create a Red Team and assign each one of respective tasks to kickstart the initiative. Regular informal meetings can be held to provide updates, distribute tasks, and track tasks, etc. **Phase 1: PRE ATT&CK** Conduct passive reconnaissance at various fronts to discover information like IP address ranges, web applications, email IDs, credentials (if any), physical locations, and anything that could be of help. Adopt the usage of OSINT tools, shodan, scripts, spiderfoot, and social media to squeeze out the information from all possible places. The essence of this phase is to gather information, and once the data is collected, you can evaluate them to verify which of them can be of help and what can be kept for future use. Shown below are the tactics and techniques that can get covered as a part of phase 1. This includes using spiderfoot to gather information, LinkedIn to collect employee data and emails, DNS recon usage, setting up empire C2, persona development, identification of 3rd party software, connect with targets of interest through social media platforms, etc. ![Redteaming - Mitreattack](https://blog.aujas.com/hs-fs/hubfs/Redteaming%20-%20Mitreattack.jpg?width=837&name=Redteaming%20-%20Mitreattack.jpg) **This phase can give the red team useful inputs to execute Plan A & Plan B:** - Information on web applications and IP addresses - Improperly configured web applications - Plan A (Exploit) - Personal information and contacts – Plan B (Social Engineering) **Phase 2: ATT&CK Plan A:** Identify a website used by the organization, this can be an AWS cloud-based application dashboard which can help you quickly get access to the directories. By going through the directories, you can gain access to the file path to download the contents. Go through the content and grab the two AWS keys: SECRET\_KEY and ACCESS\_KEY. You can use these keys to connect and configure AWS in your system. The data buckets are to be dumped, and you can move around like in a typical UNIX environment. Now, search the buckets for data. The files might reveal multiple LDAP service accounts and passwords used in the application. If you know of the types of software in use, during the information gathering phase, check for Office 365 on the list. Gain access to the mailbox. Check whether Office 365 has Two Factor Authentication (2FA) enabled. Most of them don’t activate it and do not use their mobile numbers for registration. If they haven’t registered, use your mobile number to register and cover the persistence part. If the user changes the password was changed, reset it using the second factor. Whenever a new registration is done for some application, they send a confirmation email on the mail ID. Using this information and searching through the emails, you can successfully register other applications along with the credentials. From an application standpoint, you can move laterally from one application to another. You can also plan your last pass, and that can be the privilege escalation. In this case, the AWS [penetration testing](https://www.aujas.com/crest-certified-penetration-testing-services) toolkit named PACU can be of help. You can generate AWS management console links by using the keys you have collected. ![AWS](https://blog.aujas.com/hs-fs/hubfs/AWS.png?width=863&name=AWS.png) The management console will usually have the information related to the payments you have made, the services you have opted for, including confidential information. You can cover a lot TTPs as a part of the attack phase. TTPs can be covered in a random order, not necessarily in one order. Use admin credentials identified in the publicly disclosed files to stop the billing cycle and create a direct impact rather than going through all the phases. **Phase 2 - Tactics and Techniques ![Red Teaming-1](https://blog.aujas.com/hs-fs/hubfs/Red%20Teaming-1.jpg?width=725&name=Red%20Teaming-1.jpg)** **Timelines ![Redteaming - Timeline](https://blog.aujas.com/hs-fs/hubfs/Redteaming%20-%20Timeline.jpg?width=671&name=Redteaming%20-%20Timeline.jpg)** ## Conclusion A proactive red team assessment is always fruitful. You can identify critical gaps in defense controls, which, if left unassessed, can lead to potential losses in terms of cost, reputation, and data. A Red Team assessment can help in the mitigation of severe security risks and up gradation of every organization’s security posture, reinforcing management, and client confidence. The MITRE framework can be new to many security teams, from an execution point of view. From an enterprise security perspective, the security teams can leverage the MITRE framework to evaluate current gaps in defense controls, SOC capabilities, to improve the security maturity level of the organization **Key lessons from a six-week Red Team assessment includes:** - Be proactive in strengthening security posture. - We are never secure. There is always a risk. Reduce it to an acceptable level. - Effective security due diligence is needed to produce tangible value. Now the question remains, are we safe from hackers? No, hackers will always be there, and so will be threats & vulnerabilities. Changing environments and new upgrades can give rise to new vulnerabilities. [Security assessments](https://www.aujas.com/on-demand-security-testing-and-services) must be continuous and periodic because hackers need 1% luck, whereas you required 100% protection. **Keen to know more about [Red Team assessments](https://www.aujas.com/red-teaming-service) and how it can help you discover [cloud security risks](https://www.aujas.com/cloud-computing-security-services)? Mail us at [contact@aujas.com.](mailto:contact@aujas.com)** ![Footer-Logo](https://blog.aujas.com/hubfs/Aujas%202019/Footer/Footer-Logo.png "Footer-Logo") ## Reach Us [+1 201 389 9011](tel:+1%20201%20389%209011) ## Write To Us **Sales:** [contact@aujas.com](mailto:contact@aujas.com) **Jobs:** [careers@aujas.com](mailto:careers@aujas.com) **HR Queries:** [HRopsteam@aujas.com](mailto:hropsteam@aujas.com)   - [1](https://www.linkedin.com/company/aujas-cybersecurity) - [2](https://twitter.com/AujasIRM) - [3](https://www.facebook.com/AujasCybersec/?ref=py_c) - [4](https://www.youtube.com/@AujasCybersecurity) ## [Identity and Access Management](https://www.aujas.com/identity-access-management-services) - [Identity Governance Fast Track](https://www.aujas.com/iam-identity-governance-fast-track) - [PIM Fast Track](https://www.aujas.com/privileged-identity-management) - [Cloud Single Sign-on Fast Track](https://www.aujas.com/cloud-sso) - [Robotics Driven IAM](https://www.aujas.com/robotics-iam-services) - [Risk Aware IAM](https://www.aujas.com/risk-aware-iam) - [Consumer IAM](https://www.aujas.com/consumer-identity-and-access-management) ## [Cybersecurity Advisory Services](https://www.aujas.com/cybersecurity-advisory-services) - [Cyber Risk Management](https://www.aujas.com/cyber-risk-management-services) - [Integrated Compliance Management](https://www.aujas.com/cybersecurity-compliance-services) - [GRC Automation](https://www.aujas.com/grc-technology-automation-service) - [Third Party Risk Management](https://www.aujas.com/third-party-risk-management-old) - [Privacy and Data Protection](https://www.aujas.com/data-privacy-data-protection-services) ## Company - [About us](https://www.aujas.com/about-us) - [Careers](https://www.aujas.com/cybersecurity-careers) - [Contact us](https://www.aujas.com/contact-us) ## Resources - [Blog](https://blog.aujas.com) - [Collaterals](https://www.aujas.com/collaterals) - [Case Study](https://www.aujas.com/case-study) ## [Security Verification](https://www.aujas.com/security-verification-services) - [Threat Simulation](https://www.aujas.com/threat-simulations) - [loT Security](https://www.aujas.com/internet-of-things-security-assessment) - [Penetration Testing](https://www.aujas.com/crest-certified-penetration-testing-services) ## [Security Engineering](https://www.aujas.com/security-engineering-services) - [Secure Development](https://www.aujas.com/secure-software-development) - [Ecosystem Engineering](https://www.aujas.com/ecosystem-engineering) - [CodeSign Platform](https://codesign.aujas.com/) - [Custom Security Development](https://www.aujas.com/custom-security-solution-development) ## [Managed Detection and Response](https://www.aujas.com/managed-threat-detection-and-response-services) - [Threat Management](https://www.aujas.com/threat-management) - [SIEM & Security Monitoring](https://www.aujas.com/siem-security-monitoring) - [Automated & Continous Attack Simulation](https://www.aujas.com/automated-continuous-attack-simulation) - [SecOps Orchestration](https://www.aujas.com/security-orchestration-automation-and-response) - [Google SecOps](https://www.aujas.com/googlesecops) ## [Identity and Access Management](https://www.aujas.com/identity-access-management-services) - [Identity Governance Fast Track](https://www.aujas.com/iam-identity-governance-fast-track) - [PIM Fast Track](https://www.aujas.com/privileged-identity-management) - [Cloud Single Sign-on Fast Track](https://www.aujas.com/cloud-sso) - [Robotics Driven IAM](https://www.aujas.com/robotics-iam-services) - [Risk Aware IAM](https://www.aujas.com/risk-aware-iam) - [Consumer IAM](https://www.aujas.com/consumer-identity-and-access-management) ## [Cybersecurity Advisory Services](https://www.aujas.com/cybersecurity-advisory-services) - [Cyber Risk Management](https://www.aujas.com/cyber-risk-management-services) - [Integrated Compliance Management](https://www.aujas.com/cybersecurity-compliance-services) - [GRC Automation](https://www.aujas.com/grc-technology-automation-service) - [Third Party Risk Management](https://www.aujas.com/third-party-risk-management-old) - [Privacy and Data Protection](https://www.aujas.com/data-privacy-data-protection-services) ## [Security Verification](https://www.aujas.com/security-verification-services) - [Threat Simulation](https://www.aujas.com/threat-simulations) - [loT Security](https://www.aujas.com/internet-of-things-security-assessment) - [Penetration Testing](https://www.aujas.com/crest-certified-penetration-testing-services) ## [Security Engineering](https://www.aujas.com/security-engineering-services) - [Secure Development](https://www.aujas.com/secure-software-development) - [Ecosystem Engineering](https://www.aujas.com/ecosystem-engineering) - [CodeSign Platform](https://codesign.aujas.com/) - [Custom Security Development](https://www.aujas.com/custom-security-solution-development) ## [Managed Threat Detection and Response](https://www.aujas.com/managed-threat-detection-and-response-services) - [Threat Management](https://www.aujas.com/threat-management) - [SIEM & Security Monitoring](https://www.aujas.com/siem-security-monitoring) - [Automated & Continous Attack Simulation](https://www.aujas.com/automated-continuous-attack-simulation) - [SecOps Orchestration](https://www.aujas.com/security-orchestration-automation-and-response) - [Google SecOps](https://www.aujas.com/googlesecops) ## Company - [About us](https://www.aujas.com/about-us) - [Careers](https://www.aujas.com/cybersecurity-careers) - [Contact us](https://www.aujas.com/contact-us) ## Resources - [Blog](https://blog.aujas.com) - [Collaterals](https://www.aujas.com/collaterals) - [Case Study](https://www.aujas.com/case-study) Copyrights © 2025 All Rights Reserved by Aujas. - [Terms of Use](https://www.aujas.com/terms-of-service) - [Privacy Policy](https://www.aujas.com/privacy-policy) - [Cookie Policy](https://www.aujas.com/cookie-policy) ![](https://px.ads.linkedin.com/collect/?pid=656027&fmt=gif) ![websights](https://ws.zoominfo.com/pixel/62839c658f43f50012ae3b9a)