Unspoken Security Ep 12: Challenging Assumptions at the Intersection of Cyber & Physical Sec (Pt 1)

I think most red teams do pen testing as part of it, but pen testing can also stand on its own. If you look at your average red team engagement, you are running pen tests against different controls. It's just a lot more holistic.

Welcome to Unspoken Security by Zero Fox, the raw and gritty podcast for cybersecurity professionals who want to understand how threat actors are leveraging the internet. In each episode, your host AJ Nash engages with various industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding security. Ultimately, the lessons learned will enable security professionals to take an intel-driven, proactive approach to physical and cybersecurity that extends past the perimeter. Let's get started.

Hey, thanks for tuning in for another episode of Unspoken Security. Uh, this is a really special episode, the first time we're going to have two guests on. Uh, as a result, there was a lot of content and this episode ran really long, uh, enough that we decided we didn't want to cut any of the content out. It's just too good. Uh, so we're actually splitting this into two episodes. So what you're going to hear here is, uh, first will be part one, uh, and then of course we'll follow up with part two. 2 weeks from now. So I just wanted to let you know going in, this is one of two. Thanks for being here. I think you're really going to enjoy the guest today. It's a great show. Looking forward to getting all your feedback and comments. Please make sure you're following and liking and all that stuff, and then you'll have to tune in in a couple of weeks to catch the second episode. So without further ado, let's go into the show. Hello and welcome to another episode of Unspoken Security brought to you by ZeroFox, the only unified external cybersecurity platform. I'm your host, AJ Nash. For those who don't know me personally or are first-time listeners, I'm a traditional intelligence guy. I spent nearly 20 years in the intelligence community, both within the US Air Force and then as a defense contractor. Most of that time was spent at NSA. I've been in the private sector for, uh, I don't know, 8, 8 and a half years now, primarily building or helping other people build effective intelligence-driven security practices. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I'm also deeply committed to servant leadership, which is why I completed my master's degree in organizational leadership at Gonzaga University. Go Zags! The goal of this podcast is to bring all of those elements together with some incredible guests and have authentic, unfiltered conversations, even debates, about a wide range of challenging topics. This is not gonna be your typical polished podcast. You might hear or see my dog, although to be honest, she's actually not in here today. Surprisingly. People might swear here. I can't speak for the guests today. I think they seem pretty clean cut, but we'll see what we can get 'em to do. We may argue or debate. That's all okay. Listen, think of this podcast as the conversation you might overhear at a bar after a long day at one of the larger cybersecurity conferences, like all the ones we're about to get ready to go to this year. These are the conversations we usually have when nobody's listening. Today we have a special new twist on the show as we don't just have one guest, we have two. They're a dynamic duo of Anna Aslanishvili and Sean Abelson from Pine Risk Management. They're experts in security risk management, physical pen testing, social engineering, and a whole lot more, with about 30 years of combined experience. They're also both graduates of the University of Minnesota, which is the flagship university of my home state, and I wasn't good enough to go there. So Anna and Sean, is there anything I left out in terms of your bio that you want to add before we start jumping into the conversation?

I think you nailed it.

Anna, like, did I pronounce your name correctly the first time?

Actually, shockingly, yes.

What? I'm not going to do it again. I'm sure it's the one and only time, so I'm glad it was recorded. Sean, yours is a hell of a lot easier. So listen, the title of today's episode is Challenging Assumptions at the Intersection of Cyber and Physical Security. One of my longer titles, I guess, but I thought it was really important. I know we talked about this a little bit in the prep. I think it's a really interesting topic, you know, the challenging these assumptions and specifically that intersection of cyber and physical security, because a lot of organizations I've worked with or visited or talked to, consulted with, dealt with in any way, they seem to have these areas segregated, right? Physical's over here, cyber's over here, never the two shall meet. They're, they're different people from different cultures and backgrounds. So the idea of, you know, how they intersect and, and talk about those assumptions, I think is really, really interesting. So, you know, with the two of you guys, I know you got a great background in this space and we talk a lot about in the physical security case, you know, we talk about pen testing, right? But physical pen testing, not that technical piece and red teaming. But I'm curious, what are the foundations of effective red teaming? And for that matter, what's the difference between penetration testing, pen testing and red teaming in your minds?

I can take this one. First of all, thanks for having us. I'm excited to be the first duet on the podcast, just to have a chance to talk to you. Okay. As far as the foundations of red teaming go, you know, um, one of the things that are frequently forgotten is that red team really is a blue team with a twist. And what I mean by that is that we all have the same mission. The blue team is there to defend the company, set it up the best they can to protect everything that matters. And Red Team has the exact same mission. We just go about it a little bit differently, and people tend to get a little nervous about it, but that's pretty normal. You know, we, we come in with an adversarial hat, and that's what sets us apart. And so what I mean by that really is that instead of focusing on one particular aspect of testing a particular control or focusing on access controls or, you know, surveillance systems or something else, We are standing in the shoes of an adversary and trying to picture from their perspective, why are they targeting this place? How would they go about it? And then from, you know, our realistic perspective, then we try to apply what we know about this adversary and see if the organization's defenses hold up against that. So, whereas our tactics are different, our mission is very much the same, and that's to protect the company. And so, You know, as, as we're increasingly facing off with more creative and more capable adversary, I'm obviously biased, but a red team tends to be the best security team that helps stay ahead of that adversarial tactic. What I'm saying.

That's really interesting. Sean, what do you want to add, man?

No, I think you hit the nail on the head with each of those points, especially the difference between red teaming and pen testing. In my mind, there's, you're going to ask 100 red teamers and get 150 different opinions on it. But on the physical side, especially pen testing is when you try to break into a building and red teaming is when you do it with an adversarial perspective, adopting an adversary's motivations, capabilities, and tactics. A good red team. Before they say, I'm going to break into this building, they zoom out and say, who are the adversaries? They use threat intel for that. Who are the adversaries? What are their tactics? What's the threat surface? And then they determine, is the best way to get access to your most valuable critical information, trade secrets, intellectual property, is it breaking into the building? Is it, uh, one of dozen social engineering or other ways? To get access to that. And so in my mind, pen testing is more control-focused. You're testing your access control, your security guards, controls against tailgating, things like that. And red teaming, you zoom out and those are part of the tactics if an adversary would do it that a red team does.

So it's interesting. And I must say, for both of you, I really appreciate you answering it this way, right? Because, because these terms are often used interchangeably and from what you're saying, they really shouldn't be. It sounds like, and, and I don't wanna put words in your mouth, so you tell me, pen testing, I mean, pen testing can be on its own, right? Can anybody can pen test, just check, see does the door lock work? Does the mechanism work right? Whereas from what you're saying, red, uh, red teaming requires staying within a boundary of, you know, what do we know of the adversary and following their rules of engagement, right? So we're, we're emulating a specific adversary or specific group, but is pen testing, do you think pen testing is still sort of a subset of that? Like if you're gonna emulate a specific, organization, hey, we know they act in this way and this is how they tend to like to break into, you know, buildings. And so we're going to follow that tactic, but then we're still going to test. Obviously we're doing the penetration testing in the way in which that adversary would be. So are you saying that pen testing could be a subset of red teaming, essentially?

I would be hard pressed to say that necessarily. I think it is very related. I think most red teams do pen testing as part of it, but pen testing can also stand on its own. If you look at your average red team engagement, you are running pen tests against different controls. It's just a lot more holistic. So from a scoping perspective, pen tests are very narrow, not very narrowly scoped, but pretty scoped in. And a red team, your scope is what would an adversary do? And how can we emulate that fairly, realistically, and ethically against an organization? And so, yes, I guess I will agree that pen testing is a subset, but it also has the ability to, to absolutely stand on its own. There's pen testing teams, there's red teams, and, and they tend to be kind of separate approaches to doing the same thing, which is testing whether the security controls actually work the way people think they do, challenging assumptions, and then helping the blue team fix any gaps they find, or equally as important, helping validate the controls that are in place to confirm that they are in fact working. It's not only about covering weaknesses, it's also about assuring that things work as expected.

Okay.

So it sounds like you could— oh, go ahead, Ana. I'm sorry. Go ahead.

The biggest thing in my mind is that there's a time and a place for each. And so, whereas they're not, you know, mutually interchangeable, they're both very effective tactics. It just depends on what you're trying to get out of the assessment. If it's specific information and performance data on one control or a subset of controls, then, you know, one of these solutions might be better for you than just doing a holistic assessment because it really depends on the readiness of your organization too.

Got it. Okay. That makes sense. Right? I mean, it sounds like within red teaming, pen testing may or almost always will exist. It sounds like at some point you can do pen testing without red teaming though. You can simply just be doing penetration testing, which makes sense. Right? And they're, so they're cousins, they're related. They're not always inter— together. They're certainly not interchangeable from what you're saying. And that red teaming seems to require a different, I won't say more cause I don't wanna insult pen testers, but a different kind of research at least because You're saying it's framed in trying to emulate an adversary. And Sean, I think you mentioned, you know, that there's a connection here to threat intel, and obviously that's gonna get my attention 'cause that's my background, right, is intel. So let's talk a little bit about how that fits together, right? So how do you guys use intel when you're building up your plans, your intentions for red teaming, you know, for working on your whole, background and your whole research for, for doing a red team exercise against a client's facilities or, or people or however you want to set that up?

Yeah, excellent question. So for pen testing, like you just said, I would pen test before I red team in terms of you are testing the controls and then when you get to red teaming, it's more involved. It takes more time, it takes more money, it takes more effort. And a lot of that is because of the adversarial component. And in order to be effective at that, it starts, involves, and ends with useful threat intelligence. And so a red team, when they're prioritizing what they're going to do, what the attack looks like, the attack vector, the attack surface, the threat actor, all of those should come from threat intel for the organization. I use, during the course of an assessment, threat intel 4 times at least. So prioritizing who the adversary is, if you're trying to determine the, the most likely and impactful adversary. The second is using threat intel to determine what are the tactics, what are the likely tactics, what capabilities have they shown in the past, and what do you suspect them capable of? And that is what you're emulating. You're not going into a free-for-all where you have to get in at any costs. You want to know, will this person who I know is targeting my organization, will they be able to get in based on what we know about them and what they're good at? Determining, for number 3, determining what the target is. Their motivation helps to determine if they're trying to embarrass your company, recruit your employees to be insider threats, or steal intellectual property to give it to a company in the local country if it's a nation-state actor. And so, Figuring out what their motivation is and what they might actually target is the third. And the fourth is really just tactics. It's the tactics of threat intel, but it's turned against your own company. And that's where you get some fun perspectives. You take all the, the intel gathering, reconnaissance, surveillance, scans, whatever goes into really good threat intel. And you, you did a good episode on, on intel requirements and All of that, and you turn it against the company that you are trying to protect because you want to see that company through the eyes of your adversary. You want to see where the strengths appear to be, the deterrence. You want to see where the weaknesses might be, where they might target. Uh, and then you use threat intel to actually go out and do the, the assessment and see if an adversary can, can do string a chain of vulnerabilities together in order to actually get into your organization, whether it's cyber or whether it's multiple, getting through multiple layers of physical security. So any good full-scale realistic red team engagement, like threat intel is the crux of that.

Well, I love hearing that, obviously. Ana, do you have more great things to say about threat intel?

Well, you know, when I tell people what my job is, you know, if I had a penny for every time someone's asked me if I'm the person dropping off from a helicopter, And unfortunately, in the years that I've done this, I have yet to find a threat actor whose tactics are drop on top of the target building from a helicopter and then infiltrate. You know, that, that's saved for movies and it doesn't actually work that way. What works very well, however, is intelligence and there's threat intel for the adversary and then there's target intel in terms of what life looks like. At what you're trying to protect, right? And so more, more often than not, it's not sexy uniforms and jumping out of helicopters. It's sitting in a surveillance van for hours and hours and hours and regretting your career choice. And, and you, you know, you get a couple hours of action and then you're sitting in that car again taking notes. But that is ultimately what makes you successful in the long term. But without intelligence, I don't think red teams are anything.

Yeah, definitely not a recruiting case for red teaming, right? I mean, I'm not gonna lie, I thought we were gonna do like a Mission: Impossible discussion here and helicopters, and then you're saying no, there's none of that. No leather outfits and lasers, mazes. What's that?

I have outfits.

Well, I know you have a bunch of wigs. I know we talked about that before the show, so I'm sure you have a lot of disguises, which maybe we'll get a chance to get into. But it doesn't sound like there's a lot of like, you know, the whole laser beams you have to duck around and get through and try to steal the big diamond. It didn't sound like there's any of that, you know, with impossible music playing in the background. It's, it's mostly just sitting in vans observing and taking a lot of notes. It sounds like.

Yeah. And, and guns.

Yeah.

Oh, guns. Well, now you got my attention.

Trying to, trying to avoid, trying to avoid guns.

Yes. I think that's a good, that's a good choice.

Yeah. It's, it's hard. I mean, there's a lot of, we've done a lot of assessments at financial institutions with, with armed guards or off-duty law enforcement directly targeting police stations being hired by cities or police stations. And obviously those are interesting targets and you just function differently. I've been lucky or unlucky enough to have a police helicopter called on me once, though it was canceled before it arrived.

But see, at least someone gets helicopter.

Yeah, there's a helicopter. You just got to figure out a way to make it happen. Anna, that's all. You just got to really piss some people off apparently. So yeah. Now out of curiosity, I know this is off the topic from where we are and we'll get back on the right questions, but Do you carry like documentation in the event things go really badly? Do you have like a, a note from who hired you to say, hey, please don't shoot me. I'm, I'm not actually a bad guy trying to break into the police station. Your chief hired me or whoever the hell, you know, hired me. Do you have documentation or? Yes. And Ana's nodding.

Ana's nodding. Yes.

I would argue based on what I've seen that we're some of the most risk-averse red team. We'll still go out and, and do the full assessment, but, uh, we'll do safety briefings with the team and with the client beforehand. We need to have, I think everyone will have a version of a letter of authorization, get out of jail free card, which, which is signed by the client who you've confirmed, um, owns the property, has control over whether you're allowed in there, et cetera. Um, and there's, there's multiple other methods depending on the, the target, depending on the type of engagement, sometimes law enforcement, like if you're actually climbing fences and doing things the public might see, and you have a good relationship with the cops locally, we've given them a heads up that if they get a call, they might want to check with us or, or at least be aware that people might have a letter that says to, to call the owner of the property. And so there's lots of safety measures that, that we put in place, almost all of which are proactive, but a few of which are, are based on lessons learned over the years to keep ourselves and the team safe. So.

Nice. So, so you do validate that whoever hired you actually owns the property and is all like, I can't, I can't hire you to red team a bank and then go rob the place. I'm guessing like, you know, you're not going to— can't kind of contract you for that, right? I mean, it's, it's good. I don't plan on it for anybody who's listening, but I was just curious, just making sure.

Just going back to that intelligence.

We're going to be— yeah. Yes.

Yeah.

I don't own a large bank, so we're not going to go there.

And competitive intel, like we— there's none of the, like, if you're red teaming, like you're good at identifying, gathering information, getting into places, but there's a very straight line of like red teaming is just of your own. You have to have permission and you're testing to improve your own security. Uh, anything besides that is, is like the competitive intel side quickly becomes a crime if you don't have permission to actually break into a property. So, uh, making sure there's all the due diligence needed ahead of time is is incredibly important.

So I know I didn't make a, you know, a case for selling my profession earlier very well, but keeping the competition down.

I got it on it.

Smart, smart business. Yeah. But one of the ways that you can keep the fun in the job is by having all these stops ahead of time. So you're not finding out the hard way and not only putting yourself and your team that's on the ground in danger, but also putting your client in, in front of reputational risk, financial loss, right? Anything that would get them the opposite of what they're looking for. And so just doing that mandatory, you know, due diligence, if you will, ahead of time. And both of us have done it both ways and clearly have landed on a preferred way. To run these things, it's, it's what makes the exercise fun and also effective and leads to the outcomes that we're hoping for. Not that we have preconceived notions about how these things will go, but no one getting shot is kind of a baseline that we start from.

That's, that's, it seems neither of you have been shot, I'm gonna guess, right? No. Or shot at even for that matter.

No.

Good. I've, good.

I've had firearm, firearms, firearms. Pulled on me very early in my career. And there's lessons that you learn once, and that's one of them. It was safe and controlled and very quickly deescalated. But there's, there's multiple changes I've made since to make sure myself or anyone on my teams have never faced anything like that. Because it's not a fun feeling. It's not fun when something that you've spent a lot of time controlling the boundaries of to make sure it goes for, it doesn't go from 0 to 100. That someone doesn't see you breaking into a building and immediately go to, um, kind of a full breach scenario where they need to pull weapons. And so, um, yeah, that's no, definitely have not been shot or shot at, but, uh, I've been not too far from that. And I think most red teamers will agree, uh, that that is way too far. So, uh, making sure there's a lot of, uh, scenario control, uh, and that Anyone that detects you is your best friend right off the bat. And that's part of social engineering. You, you want to turn that potential escalation into someone that actually takes you on a tour through the building, shows you the server room. We've done that. I've done that 50 times compared to the one time where there was no opportunity to de-escalate until we were confronted. So it really is. Important to focus on that, and I have, and, and I definitely try to make sure other red teams that we work with have opportunities to learn those lessons by like publishing stuff and getting it out there. You don't want anyone else to learn that the hard way.

That's, that's, yeah, good advice. Obviously I don't wanna see anybody getting shot, so it's good to know that you, you have a lot of controls. Like you said, you've learned, you've been doing this a long time, so I'm sure you've, you mentioned de-escalating, you mentioned making them your friend. I mean, those are really interesting strategies that may, you gotta have ice water in your veins, I'm sure, when somebody blows up your original plan to be able to pivot very quickly to, oh, I'm glad you're here. Hey, I need your help. And, you know, and turn it into a positive. I'm sure that's a, you know, that's, that's an art as much as a, as a, as a science, I imagine. You know, I'm curious, a couple of things that came up as you guys were talking, you know, one, you had mentioned earlier that, you know, red team is really kind of just the flip side of blue team. How does blue team feel about that, do you think? Like, is that a, is that an accepted norm? Do you have blue teams that are hostile towards red teams that think poorly about red teams? Are they happy to hear that there's a red team exercise going on? Do they even find out in advance that there's red team exercises going on? You know, do they see you as the flip side of the coin and as teammates in this, or are there situations where that's not how it's perceived or how it goes?

I don't know that a universal answer exists to that. In ideal states, you have a relationship that you've built where that iteration that we have the same mission, we're on the same team, is something that isn't just lip service and it's something that people actually know and trust and believe because you've done it, you know, over a certain amount of time and you've built something better together. Doesn't always work that way. And it's, you know, easy for, for things like this to kind of start moving in different directions pretty quickly. But, you know, from, from the shoes of the blue team, they are always on the defensive and there's so many things, right? There's so many fixes there. Their physical and plus like cyber, like all of these different requirements. They have bug fixes and vulnerabilities that they know about, pen tests happening all the time, right? And so, to prioritize this work really has to take that one team mentality. But at the same time, an effective red team shows what matters, right? So if you're looking at a queue of 1,000 tasks, We are, if deployed correctly, a tool to prioritize those 1,000 tasks and maybe look at, you know, higher criticality vulnerabilities or look at some of the systemic things that if we fix this approach or if we fix this overall kind of umbrella situation, vulnerability finding, whatever it is, then some of these will go away or, you know, reduce risk or become less risky just because now the bigger issue is fixed. And so ideally we work together and that's when both of our teams can be most effective. I think at the same time, it's pretty easy to become defensive and that really will 100% depend on the culture of the company and how failure is treated. Because in our world, you know, We fail, we try again, we fail, we try again. The principle there and the moral is you don't fail the same way twice and you learn from it, right? And so we are huge on lessons learned and that's what we do. That's what we've done with the teams that we've built and the programs that we've built. That's what we do in the company that we have started because without those lessons learned, you're just doing the same scenario over and over again and kind of finding out, oh, well, here it's different and here it's like this, but if you do a lessons learned that applies, then you can, you can apply to greater kind of scope of problems and learn in different ways. And we want to share that knowledge. Um, that being said, you know, we are a very practical, hands-on, operationalized way to laser focus some of the work that the blue team does. Um, yeah, we'd like to work together.

Yeah. It's, I like an ideal scenario is a red team is conducted and then there's kind of a purple team engagement after where both the blue team, which I don't know if we've defined it, I think it's generally well known, but the blue team is everyone on the security team that's not the red team. So all the defenders, all the people trying to protect. And so ideally there, there's kind of a purple team engagement that that you have after where you focus more on learning, less on reporting. There's an opportunity instead of just dropping a lengthy report, you actually walk through each of the things you did and they suddenly become a lot more clear and compelling. You can do what we've done. So the blue, there's the blue team and then the blue team is always struggling for budget. And so one thing we've done is bring people from the financial office, from the CFO's office, the people that actually give the security team the budget, bring them out on some parts of a red team assessment and say, hey, we know that the security team's asking for more money for this. We're going to test it in real life. This is all real. This is not controlled. And you are going to see, and maybe if we're feeling kind of crazy, we'll actually have them join the red team, be, be guest red teamers and try to break into a building. And if they suddenly see firsthand the gaps that exist, that changes multiple perspectives, whether it's a blue teamer, guest red teamer, or someone in the accounting department that does budgeting. Either way, doing the purple team engagement, focusing on education, awareness, empowerment, and telling a compelling story about what the vulnerabilities are, those— instead of the adversarial approach, we like to say like, we're not real adversaries, we just play one. And so making sure that you internalize that and communicate that to the blue team leads to much better relationships with, with those teams. And so it is a constant, like the reason we have a lot of ideas and work here is because there's oftentimes that people are not open to being tested. No one wants to be tested by something that's kind of out of their control. And red teaming is independent, should be independent in how they approach it. And so. It takes some upfront listening, really, really listening, but you can absolutely get to a more collaborative place.

Do you get introduced to them? Like when, when you're brought in on a project, is it something where leadership does this and doesn't tell blue team at all? Do you get an introduction? You know, do they talk about rules of engagement or, or is it just sprung on them or is there a mix? I'm, I'm gonna gamble it's probably the latter, but do you guys ever get a chance to talk to 'em in advance, build that relationship before you go try to break down everything they're doing and make them better?

The ideal scenario for me is kind of, as a consultant, a lengthy, like an ongoing relationship where you test, they have— you show them in person, you have opportunities to fix them, and you go back and test. And so you're talking to them as people try to figure out, hey, how do I fix this specific vulnerability? They might reach out when they're trying to find the right hardware, software, et cetera. And that is an ideal scenario, not just a one-off, but an ongoing relationship. We got an opportunity to build an internal red team, the biggest physical one in Silicon Valley for a while, which was really fun and exciting. And in that case, you're sitting next to the blue team, you're surrounded by them, frankly, you're, you're like 5 against 300, but, and that's perfect. Like, that's great because they can walk over to your desk and say, hey, We were looking at this risk that was reported. It came from your team. Can you show us, like, let's walk over to a door and show us what this is so we can be confident that when we're fixing it globally with standards and things that we know how to fix it. It's like, that is an ideal scenario, either an internal red team or kind of an ongoing relationship where you do the, the assessment and then you support them as they the blue team tries to fix it. So yes, very rarely will we not get to meet them where it's just like a CFO or CFO's office that wants to see how the security money is being spent will bring us in to assess it and then say, awesome, thanks for the report. We'll, we'll take it from here. Almost never happens. It's usually kind of a collaborative. It turns from a red team to a purple, purple team effort after.

I mean, I have a caveat to that. I agree that it's dynamic work and the most fruitful it can be is when everyone's on the same page for what's happening.

Mm-hmm.

That being said, as far as the actual assessment goes for data gathering purposes, there is some healthy level of isolation that needs to happen to keep the performance evaluation realistic.

Sure.

The goal with this is authenticity of the test. Then, you know, we kind of mentioned in, by, in bypass, in passing.

Yeah.

We mentioned in passing the importance of independence for our teams, and that's really where it comes in. We should have the freedom to threat model. We should have the freedom to test to the extent that we think an adversary might pursue something. Obviously with restraints, constraints, ethics in place, everything reasonable, right? But it, it should be done in a way that is realistic in its outcomes. And so if you're doing a test at a, let's say a data center or a, you know, a third party site, for example, and the guards know that there's a test coming tomorrow, you're gonna get a very different staffing, first of all. And you're gonna get a very different treatment as someone who's trying to infiltrate than you would if they. Know that, you know, every quarter they get tested or have no expectation of being tested at all. And just having those different datasets and also having all of those datasets for a mature organization makes a really, really big difference because if you have that relationship on a leadership level, they might have a good idea of what some of these trends are or what some of the kind of boots on the ground are experiencing in terms of you know, bottlenecks or issues, but there's always a little bit of a disconnect. And so we kind of stress that we want to understand the pain points of the people that actually do the work and not just people that make decisions, because I think ultimately to be effective, both of those points are critical to know, but without each other, that's not a complete picture. And the goal for us is to build picture out as much as possible because we do kind of this very narrow niche of work that no one else tends to do or no one else has a full overlap with. So I would just caveat this really long point.

Fully agreed. OPSEC is essential in terms of making sure it's a pure, accurate, realistic engagement.

Sure. No, that may, and that makes sense. Listen, both, both your answers made sense there. I appreciate you jumping in, Ana, with the, the clarification, you know, there's, there is a line there, as you said. You know, there has to be, right? If you, if everybody knew when it was coming, hey, if tomorrow's testing day, yeah, you're gonna get your most senior security people on their highest guard, you know, very vigilant. That's not, that's not legitimate, right? You know, you're not gonna get the rookies, you're not gonna get the people who are taking extra smoke breaks or, you know, just not paying attention or whatever. Not to insult people, right? We're not always 100% highly vigilant, right? They're on their phones, whatever, right? We're not 100% vigilant all the time. But if you told me, tomorrow's the day. Yeah, it's, you know, I'm gonna be at my best, right? It's— I was in the military. If you told me tomorrow was inspection day for my uniform, I'm gonna be ironing my uniform tonight and cleaning everything up and being perfect. I'm gonna get a haircut today. I'm gonna do all the things I'm supposed to do. If you don't tell me, hopefully I'm within regs. I mean, I'm supposed to be. That's my job if I'm in the military, right? But I'm probably not gonna be perfect, right? And that's the goal. So jumping a bit ahead here. So you talked a bit about this. There's a lot of cat-and-mouse game in this. There's, there's hopefully some some teamwork, as you said, but there's points when there's not, you know, by design, because your job is to get a realistic, you know, assessment, right? So where do you draw the line on ethics on this? What's ethical? What's unethical in terms of tactics and strategies? So, you know, I will say, you know, in my world, we talk a lot about some of this stuff for, I don't know, phishing testing. I'll use as an example, you know, what's ethical, what's not. You know, I tend to be, for what it's worth, I know people have all sorts of opinions. I'm curious to get yours. I've pretty much said, listen, adversaries don't follow rules, so I'm probably not going to either. It, it, there's an interesting, what's, what's kind and what's fair are two very different things. Adversaries don't give a damn about fair, so there aren't topics that'll be off limits. So I kind of fall into that same boat with the caveat that I would in training make sure to constantly train people on things that would never come in email. You're never gonna get a pink slip in email. All right. So if, if somebody sends you a phishing campaign that's talking about, you know, layoffs and you're getting fired, you know, it has to be phishing cuz we would never do that as a company cuz that's a horrible way to notify people. You wouldn't do that. Right? So you do it in training, but then I would use layoffs as a phishing campaign. I don't consider that to be cruel because I've trained people. We would never do that. We're not a cruel company. Right. But what are your thoughts like on ethics? What's ethical? What's unethical? Where do you draw that line when you talk, talk about your strategies?

Yeah, this is subject to endless debate from my experience. So I, I don't have the same opinion in terms of how you'd approach the phishing scenario specifically. And that's good, right? I, anytime I disagree with someone, I like to call it out. It's like, that's good because there's more than one perspective and we're not just group thinking each other.

Now we get to fight. That's what I said would happen in the opening. Now we get to duke it out. All right, you tell me why I'm wrong and I'll tell you why you're wrong.

I mean, I don't know. I'm just curious. Thoughts.

We're probably the closest guests to you so far, and so we're actually not far apart. We could have done this in the same room today. They're only like 20 minutes from my house, so if this gets ugly, you know, one of them leaves the screen, you better watch, she might show up. Or I'm assuming she might show up behind me, right? So yeah, we'll see if my house gets red teamed here shortly, or pen tested. But anyway, yeah, go on. So you think I'm wrong, which is cool. Like you said, I agree, it's different opinions. So what are your thoughts here?

Yeah, I think if you want to, ultimately what's the goal? The goal is that people are not clicking on links that you don't want them to. There may be a higher percent, like realistically you can intuit what is going to happen. If you send out a non, what I would describe as cruel or whatever, like phishing attempt where it's just, hey, your performance review is available, click here. People are going to be interested in that. And that is a good fish. And then when they click it, they probably have to do another training. And that training will show them examples of, hey, here are the more likely ones. We're not willing to send it to you because there's emotional things that come along with this, but bonuses, layoffs, some of, some of the more critical ones. The people that are going to click on the, hey, you got laid off email are the same ones that are going to click on your performance. Performance review is available. And so you still get the same point. You still get to train them on that email. And so my thinking, and so I'll back up. I agree, like adversaries do not play by the same rules. They're often like inherently unethical, which is what makes them adversaries. Like they'll use the money, ideology, coercion, ego, whatever it is to get access to what they want to get access. And so My rule is if you're doing something unethical or that makes someone feel horrible, then I am not being creative enough in terms of getting to my goals. But you can always find a different way, right? The brutal way is often the, the easy way from what I've experienced, at least on the physical side. I'm not talking about phishing as much anymore.

Sure, sure.

But the brutal ways is the easy way. And so there's usually ways to reach your goal without causing significant harm or discomfort, things that you have to walk back. So for me, like every rule, I mean, every rule exists for a reason. So over the years, like I've established the don'ts based on seeing other people do things or hearing horror stories. I'll say like from the, the fishing side, especially like our goal is like a good relationship with the workforce. As a security team is essential. And people that get a bonus and then don't get a bonus, think they get a bonus, and then suddenly they have to do extra training. That is the opposite of a bonus, is doing security awareness and compliance training. And I say that as someone that has helped make those trainings. And so having them on your team, listen to you, take you seriously, it feels counterproductive to me to, to isolate them in a way by sending those types of emails out when you could convince them through less emotional, like less visceral type emails. And so on the physical side, my like don't do ever type rules are like don't target specific individuals. Meaning if you're hired, like, and they ask you to like, hey, can you see if this person's vulnerable to this type? That's a no-go. Right? That goes hand in hand with no political hit jobs. That and security. Like, there's always turf and politics, budget, and a lot of things along those lines. And so anything, any wind that you might catch of political hit jobs or targeting a person is a no-go. This is a big one for me is don't get anyone fired. Testing isn't to try to rat someone out and get them fired. It's to find ways where something doesn't work. If you get past a security guard because they weren't paying attention— Yeah. This is every time we do an assessment, you do this. If you can get past a security guard who's texting or even vulnerable to social engineering, it's not that security guard's problem. Like usually it's a system problem. Usually you're paying someone minimum wage to protect a multi-billion dollar company, or you are, have a single point of failure, which is a human point of failure, when in fact it should be multiple layers of security that need to fail for someone to get into your building. And so ultimately, making sure you don't give names of individual employees or security guards unless they did a good job, then you want to give them credit as many places as you can. But, and then obviously on my side, I guess not obviously from my experience, but no bribery or coercion, right? There's, you can always pay someone to get into a building, especially if there's 500 security guards instead of actually potentially committing crimes or entrapping someone, not legally, but just ethically. You can assume if you're getting paid minimum wage, you'll be able to spend a couple grand part of what you got paid to red team. To get into the building very easily. And so to me, that feels lazy. And you're able to call that out and say, hey, this is something you could probably do because there's a single point of failure. But instead of paying them, I social engineered or I tried several additional routes. And so there's always ways around that.

So you just include that like in an after-action report as an assumption, like we didn't do this, but there's all— we just have a general assumption. Listen, for enough money, I could buy my way into any facility. So we just have that as a general assumption because I, I mean, you're saying it's a thing you think would work, but you just don't do it because it's lazy, which I totally admire. Like, just, there's certain things that are just lazy. And, and I gotta rethink my phishing thing just based on what you said. If you're saying that the same profile of a person would answer this one as that, that might be a better way to pivot as opposed to, to running up the stress on them. So that's a really good point. But for a report, do you just have that as an after action where you just say, we made the assumption if we gave a security guard $5,000, there's a good chance one of them would've said yes because you only pay them X number of dollars, whatever. Do you even report that at all or just leave it out altogether?

So yes, but not as straightforward. So we're not going to automatically put that into a report. We are assumption challengers as a job. We're not going to just make an assumption and throw it in a report. But if Anna is able to talk her way in relatively easy, easily to a building, and that person, right, that person doesn't have technical controls where they need to badge someone in in order to get a guest badge, they need to put in certain reasons or get supervisor permission, et cetera. If there's not technical controls and you have a single point of failure, as we describe the fact that you're vulnerable, your security guards are both a strength and a vulnerability, and here's how you can mitigate the vulnerability and exploit the strength. As we talk about the vulnerability, we'll call that out. We'll say, this is not within our typical scope, but it is within, like, depending on the adversary, Some adversaries will do that, some will not, but depending on the threat intel and the adversary, we might say, "This is a tactic we did not use, but the adversary is known to use it. We believe it would likely succeed because you have a single point of failure." And so that's usually how we would communicate it with a client if it's relevant in the situation.

Hmm. Interesting.

Any thoughts on your side?

I mean, From my side as a social engineer who typically goes for that type of tactic first, what I'll say is that adrenaline is a very powerful teacher. And so you want to reserve that for lessons that like you really want to stick. And the fact that your, you know, company fooled you into something is probably less of a desired outcome than approaching it from a learning perspective for that person in a sort of like one-on-one situation. Right. And so I, I kind of always joke about this, but the, I know the name of every receptionist and security guard that I've gotten past over the years because I always feel really, really, really bad. Because inherently what people want to do is help each other out. And I know what buttons to push to make you want to help me, but that doesn't mean you're bad at your job. Maybe it just means you're a good human, which says something about me, but that's separate. What we want to do though is stress the fact that this was a failure point, but a failure point again, that we can learn from. And so, if you do that, if you educate those people and kind of turn that around and be like, hey, I took advantage of you. And this is what we learned about this. These are some of the things that kind of also failed you. That person who now kind of feels a little bit less ashamed, a little less guilt, is now your best asset. They have become from someone who drones on through the annual security awareness training like the rest of us.

No, no, I pay attention to every bit of annual security training.

Yes, they're all listening. Yes.

I am very interested annually in training.

Either way, they now have a little bit of that personal experience that makes things a little spicier than the annual report tends to. And so they can be your best advocate and they can be your best proliferation tool for what the best practice actually is.

Because—

Yeah, that's a good point. So you're saying if somebody's gone through it and learned, like, that's— That's not a negative, right? We shouldn't hold it against them. You don't look at them in less esteem, like they didn't know until they were trained and now they know. So they're actually a good asset because they won't fall for it again.

The critical point being learn.

Yes.

Yeah. So I will, I will stress that. I don't think I can ever stress that enough. Mm-hmm. But as long as you learn from that and you never make that mistake again, that is the best job I can do as a red teamer. It's like, yes, okay, maybe I was able to hit my objective or not either way. It's something that the organization gains from.

If you fire that person and replace them with someone that has not learned that lesson, you're back to square one. But like, we've both gotten reach-outs from people that we've social engineered, and then immediately— so like, before you even leave the building, one, the minute the assessment's over, I— so I have a rule that's like, be honest even when you're being dishonest. The second The operation is over. Go tell the person who you are, what you did. Tell them you're not putting their name in the report except for this one thing that they did, which was really good, which is they challenged you up front. And then I've gotten reachouts after, be like, hey, did you just send someone to try to talk their way into the building? Like, no, but you should call someone because that's a real bad person, not a fake one. And so those people tend to be, end up being your biggest allies, your biggest assets after. They've gone through it. If you take the time to debrief them, talk to them, ask how they felt, like the best quotes and the most compelling stories I've put in reports have been from the security officers or the facilities people or the cleaning people who just had this sense that something wasn't right. They might've still let us in, but as soon as we debriefed afterward and talked to them, they're like, here is why I thought something wasn't right. And here's why. You were able to talk your way past. And that gives, like, instead of just being like, I talked my way in, that gives specific information to the blue team, the security awareness team, whoever it is, on how to train and how to have easier reporting. It's like, I knew something wasn't right, but I didn't know who to call. That is an easy thing for companies to solve. But without talking and debriefing with those people, being honest and joking and making sure they don't go home feeling crappy about their day, um, let alone fired. Yeah, let alone fired, right? So it's— I'll give credit, like, Jason E Street talks a lot about the, the educational component to red teaming. It's gone just— it's gone beyond just uncovering vulnerabilities. It's— that part is equally as important now.

All right, well, that's all for part one. Uh, hope you really enjoyed this so far. I mean, Anna and Sean are really exciting, interesting folks. You can tell why this went ran a bit long for us. Uh, you know, this is just how we operate, right? Uh, it's a good conversation. They're really interesting, lots of great stuff. And again, didn't feel like cutting it down. Uh, there's so much here, we thought it was worth a couple of episodes. So this is the end of part 1. Uh, we'll have them back here in a couple weeks, uh, for part 2, and you get a chance to see how it ends with some of the great stories they have. They have some really cool stories, real life events that happened, and of course, uh, their secret, right? The, the things that have been unspoken. So please tune back in in a couple of weeks, you know, like and tweet and respond and feedback and all the things that go with this episode. But then please come back in a couple of weeks and catch the second half of Anna and Sean's episode as we talk a bit more about some of the work they do in physical pen testing and beyond. So thanks again. Appreciate it for Unspoken Security. Looking forward to seeing you guys next time.

That's a wrap for this episode of Unspoken Security. Brought to you by Zerofox, the only unified external cybersecurity platform. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.

This is how legends are made.