Powering up red team operations
Cadets at the U.S. Air Force Academy research cybersecurity. Senior cyber experts gave their take on the importance of cyber operations during an online forum sponsored by the Institute for Future Conflict at the Air Force Academy, Sept. 23, 2021. Retired Lt. Gen. Bradford Shwedo, the IFC’s director, hosted the forum featuring Lt. Gen. Charles Moore, U.S. Cyber Command deputy, and other career DOD cyber security professionals. U.S. Air Force Academy photo
Because it takes a red team so much time and subject matter expertise to build a test infrastructure that emulates sophisticated threats and evades detection, the Defense Advanced Research Project Agency wants to automate some of that work.
The use of red teams -- ethical hackers who identify system vulnerabilities -- can be an effective way for organizations to find and fix problems before malicious cyber actors exploit. The demand for such red team security assessments, however, far outstrips the supply of those who can do them -- and the time and expertise it takes for a red team to create required infrastructure is a critical limiting factor. The Defense Advanced Research Project Agency wants to address that problem through automation.
To evade detection as they move laterally through networks evaluating protections, red team behaviors inevitably create “signatures” or the tactics, techniques and procedures they use that can indicate their presence. If blue teams spot those signatures early on in an exercise, the assessment shuts down. If blue teams can see those signatures in networks outside the one being assessed, then the red team stands to lose the time and resources it has invested in building an operational infrastructure that emulates sophisticated threats. This failure damages the long-term effectiveness of the red team.
Because it takes a red team so much time and subject matter expertise to build a test infrastructure – including domain names, IP addresses, virtual servers and other components -- that mimics sophisticated threats, evades detection and reduces signatures, the Defense Advanced Research Project Agency wants to automate some of that work.
The Signature Management using Operational Knowledge and Environments (SMOKE) program aims to develop tools to automate the planning and deployment of threat-emulated, attribution-aware cyber infrastructure.
A Dec. 6 broad agency announcement describes two task areas that will “enable red teams to plan, build, and deploy cyber infrastructure that is informed by machine-readable signatures of sophisticated cyber threats.”
The first task involves the development and deployment of the cyber infrastructure required for network security assessments. DARPA wants tools that will automate the acquisition, management and disposal of both infrastructure resources and cyber personas used for infrastructure interactions. It also wants tools that can recommend and execute various contingency plans based information provided by signature sensors, which are the basis of the second task – developing tools that will help automate the discovery of adversaries’ signatures.
With these tools, red teams will be able “to increase the scale, efficiency, duration, and effectiveness of cyber security assessments,” DARPA said. “Moreover, red teams will be able to provide longer cyber security assessments for a larger number of concurrent networks because of their ability to remain hidden for longer.”
Proposals are due Jan. 31.