When it comes to conducting a successful red team exercise, it often involves building a level of trust against the target organisation. This trust will allow the consultant to exploit weaknesses in people and immature business processes, to gain access to systems, infrastructure or physical locations. Some activities used to build trust with an organisation may involve weeks of preparation through reconnaissance. This preparation builds confidence for the consultant during the physical attack stage of the exercise. For example, confidently tailgating into a building or facility, as the consultant has in-depth knowledge of the target environment prior to arriving.
Alcorn Group have a proven track record of delivering quality red team engagements through our client base. Our methodology covers several techniques used during these engagements to ensure success and quality for our clients. An example of such techniques to build this trust is using fake conference calls. Often physical access can be quite tedious (especially for smaller locations), where finding a vacant desk or room can be troublesome due to foot traffic. Alcorn Group frequently use phones to avoid conversation and gain access to a meeting room.
To take this a step further, Alcorn Group consultants have developed a service to streamline this process and add some flexibility. It can be used by anyone on an active engagement where physical assets are in scope. The service provides auto-answering ‘conference’ type calling capability, which will auto-play background noise, like that of a conference call. The consultants can then put this on speaker in a meeting room while they proceed to target the conference equipment and any other devices in the room.
Should a staff member walk in on the consultant attending the ‘conference’ call, they can inform the simulated call that they need to wrap up and can continue the call later. This adds to the story and will allow the consultant the ability to discretely leave and re-establish somewhere else. This technique can also be used to challenge people who may accuse you of being in the wrong location, using the conference call as context as to why you are there.
This is just one of the many techniques the consultants at Alcorn Group use, amongst their repertoire of knowledge and experience, to ensure that they deliver a successful and quality Red Team Engagement.