Four characteristics of actual attack and defense drill

Because the actual attack and defense drill is to simulate and reproduce the attack and defense process of real hackers , Therefore, it is also required that the tactics used by the attacker's personnel in the attack process can reach or even exceed that of the mafia or APT The attack level of the organization . It is different from the traditional vulnerability mining capability , The actual combat capability requires that the personnel have the ability to work on the real business system , The ability to make comprehensive use of various technical and non-technical means to carry out dynamic actual combat attack and defense . say concretely , The actual combat mainly has the following characteristics .

1、 Fully targeted at business systems

The traditional or general vulnerability mining work mainly aims at all kinds of IT Information system itself or equipment in the system 、 Agreements, etc , Such as all kinds Web System 、 operating system 、PC terminal 、IoT equipment 、 Industrial agreement 、 Blockchain protocol, etc ; The core goal of the actual attack and defense drill is to find and solve the business security and production security problems caused by network security problems , The attack process is aimed at the actually running business system or production equipment .

Besides , The traditional vulnerability mining work mainly focuses on the single point breakthrough of a single system . The actual attack and defense drill pays more attention to the complex system with multiple systems coexisting , It's a complex system running 、 Potential safety hazards in the management process . For most large and medium-sized government and enterprise organizations , It is very common that there are dozens or hundreds of different information systems inside .

2、 Must form an effective attack

Simple vulnerability mining work , Generally, it is only necessary to prove the existence of the vulnerability , Submit vulnerability Report . But in the actual business environment , The existence of a vulnerability does not mean that an effective attack can be achieved . One side , This is because the actual triggering of a vulnerability may depend on a number of conditions , These conditions may not be available in the actual business environment ; On the other hand , Even if the vulnerability is valid , But if only a single breakthrough can be achieved , And can not achieve the preset ultimate goal , Also cannot complete effective attack .

3、 Various methods can be allowed

Exploit and exploit a single vulnerability , Often only a partial technical goal can be achieved . But in fact , In the vast majority of actual combat offensive and defensive exercises , The red team needs to continuously break through multiple peripheral systems or associated systems , In order to finally achieve the planned attack target . in other words , Need to master a series of vulnerabilities , And be able to conduct internal IT framework 、 Effective analysis of operation management mechanism , It is possible to find an effective attack path , Realize effective attack under the actual attack and defense exercise environment .

in fact , In the actual attack and defense drill , The red team may need several days in a row , A whole set of attacks can only be completed by multi person cooperation . Besides , Social engineering methods are not allowed for general vulnerability excavation or penetration testing . But in the actual combat environment , Social engineering is an essential attack , Because a real attacker must use this skill . in fact , Take people as a breakthrough , It is often the best choice of the attacker in the actual attack and defense drill .

4、 In a dynamic attack and defense environment

The simple vulnerability excavation generally does not need to consider the attack and defense process , In other words, there is no need to consider human participation . But in the actual attack and defense drill , The defender actually has a professional team for safe operation and maintenance 24 Hours on duty . Once the attacker starts to act , It is possible to be detected by the defender . And once the defender finds the intrusion , Various countermeasures will also be taken 、 Entrapment and attack tracing . therefore , The actual combat ability requires that the attacker members must master certain identity hiding skills , Master anonymous network 、 No kill technology 、 Authority maintenance and other security countermeasures .