As cited
Copy frozen at (site build).
A Tale of Two SOCs: Insights From Two Red Team Assessments
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
A Tale of Two SOCs: Insights From Two Red Team Assessments
The Cybersecurity and Infrastructure Security Agency (CISA) published findings from simultaneous red team assessments at two critical infrastructure organizations, comparing their defensive responses to simulated cyberattacks. Organization A failed to detect or contain the red team's full domain compromise and access to sensitive systems and cloud resources, while Organization B rapidly identified and isolated the initial compromise attempts, forcing the red team into an assume breach model. Both organizations shared common gaps in cloud security controls, credential management, and Active Directory (AD) configuration that enabled persistence and lateral movement.
Why it matters: Critical infrastructure operators, system administrators, and security teams must immediately audit and remediate their detection baselines, AD configurations (MAQ settings, ADCS templates, service account permissions), cleartext credential storage, cloud application permissions, and incident response procedures, as the same techniques exploited in these assessments are actively used by threat actors to achieve persistent domain compromise and cloud access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
A Tale of Two SOCs: Insights From Two Red Team Assessments
The Cybersecurity and Infrastructure Security Agency (CISA) published findings from simultaneous red team assessments at two critical infrastructure organizations, comparing their defensive responses to simulated cyberattacks. Organization A failed to detect or contain the red team's full domain compromise and access to sensitive systems and cloud resources, while Organization B rapidly identified and isolated the initial compromise attempts, forcing the red team into an assume breach model. Both organizations shared common gaps in cloud security controls, credential management, and Active Directory (AD) configuration that enabled persistence and lateral movement.
Why it matters: Critical infrastructure operators, system administrators, and security teams must immediately audit and remediate their detection baselines, AD configurations (MAQ settings, ADCS templates, service account permissions), cleartext credential storage, cloud application permissions, and incident response procedures, as the same techniques exploited in these assessments are actively used by threat actors to achieve persistent domain compromise and cloud access.
- Source published
- First seen by Cybersecurity Tracker