Penetration Testing vs. Red Teaming

Originally published by Schellman.

Penetration testing and red team assessments are often conflated or confused—though they’re both advantageous cybersecurity solutions, there are distinct differences between them that any organization considering either should know. Just to be clear, a penetration test is not a red team assessment.

In this article, we’re going to briefly overview each kind of assessment, the differences between them, and how to determine which solution is the best move for you.

Once we clarify the particulars of each and where these two options diverge, you can better decide which of them is best for your organization.

What is Penetration Testing? (Pen Testing)

To start, penetration testing involves simulating an attack from a malicious actor—with your organization's full knowledge and cooperation—to evaluate the security of a specific system, application, or network. When you engage a pen test team, their goal will be to identify and exploit as many vulnerabilities as possible within the timeframe of the engagement so that you can fix them before they’re exploited by real attackers.

To understand where these weaknesses are, your technical controls will be lowered for these tests—things like allowing the tester’s traffic through a web application firewall (WAF) just so the test can be completed within the short window of time permitted.

For more details on several different penetration tests, check our articles:

• External Network Penetration Test
• Internal Network Penetration Test
• API Penetration Test
• Web Application Penetration Test

All of these—as well as the other types of pen tests—focus on those technical controls of the particular system or area you decide to have tested. However, they do not assess how your defensive security operations deal with a threat—still, there are plenty of additional benefits to penetration testing.

What is Red Teaming?

On the other hand, red teaming does assess your defensive security operations, as a red team assessment takes a more comprehensive approach to evaluating an organization's overall security posture. Unlike penetration testing, you choose specific goals for a red team engagement to test any aspect of your security—including your physical security and your employees’ resistance to social engineering campaigns—and the red team will do whatever it takes to achieve them.

With this kind of assessment, success isn’t measured in the number of vulnerabilities identified or systems compromised—rather, success is using the red team's practical suggestions to enhance your organization's general security posture.

By incorporating these various techniques into its holistic approach that will challenge your defensive strategies and assumptions before identifying the gaps or flaws in them, a red team assessment will provide you with a thorough understanding of how well your security operations deal with a threat. This then provides an opportunity to improve your organizational security through training.

What’s the Difference between a Penetration Test and Red Team Engagement?

When you boil all that down to differences between these two engagements, there are three key areas where they diverge:

• What They Evaluate:
  • Penetration Tests: The security of a computer system, network, or application by simulating real-world cyberattacks limited to the hosts in scope.
  • Red Teaming: Your organization's overall security posture, which includes technical controls AND human factors—such as user awareness—AND non-technical aspects of security, such as incident response procedures.
• Assessment Goals:
  • Penetration Tests: These aim to identify and exploit vulnerabilities within the in-scope hosts, categorize findings by likelihood and impact, and remediation recommendations are provided—this is typically done within a specified, time-limited window with some disabled technical controls.
  • Red Teaming: Rather than a specific system or network, you’ll give your red team a specific objective (or goal) and they’ll directly challenge your defensive strategies to measure their effectiveness in a more holistic—and realistic—cybersecurity assessment.
• Amount of Collaboration and Awareness Within Your Organization:
  • During a penetration test, you will work closely with your contracted penetration testers, including providing them with the information they’ll need as they try to discover and exploit specific vulnerabilities within your defined scope.
  • During a red team assessment, the red team will instead act as a real attacker would (and malicious actors would certainly not collaborate with you) to accomplish agreed-upon goals—therefore, your security team would have no prior knowledge, and a very limited number of contacts within your organization would be aware this activity was even happening.

Do You Need Penetration Testing or Red Teaming?

Ultimately, your decision to move forward with a penetration test or a red team assessment will depend on your specific objectives and the level of assurance you want regarding your cybersecurity, but here are some criteria to help you along:

Next Steps

Though very different in a few key ways, penetration testing and red team assessments can each help boost your organization’s overall security—each path will help you build a solid knowledge base and thorough preparation, and gain confidence in the proactive measures you’ve taken to protect your business against cyber threats.

Choosing which of these engagements is right for your organization depends on what you need to be evaluated and what you want out of said evaluation, as well as what resources you have available to dedicate to the endeavor.