Recommendations for Self-Managed FedRAMP Red Team Exercises

Plan Section

Explanation

Scope

The scope of the exercise dictates what is allowed to be targeted.

An important note: This is not limited to the FedRAMP boundary—your entire organization should be in scope. That being said, hosts, URLs, etc. do not need to be defined, since they’ll be encompassed within the wider scope.

Defined Goal(s)

Without any defined goals, a red team exercise risks becoming a normal pen test or phishing exercise—when you set a red team goal, you designate how the exercise will challenge your current defensive strategies (which you’ll then attempt using several avenues during the actual exercise).

(When Schellman performs a FedRAMP red team exercise, we always set the goal of accessing the FedRAMP production boundary without any initial access to your organization.)

Escalation Process

Outline a process for the testers to escalate issues should they discover something that needs immediate attention. Usually, this means alerting the organization’s CISO (or a backup to the CISO).

Start and End Dates

Document the start and end dates so that your 3PAO can determine if the exercise occurred within a reasonable timeframe for FedRAMP requirements. (The exercise usually takes multiple or several weeks.)

Attack Scenario

Explanation

Open Source Intelligence (OSINT)

Scour the Internet for your sensitive data that may be publicly available, such as:

• Company code repositories
• Employee code repositories
• Previous breaches
• Unrelated database breach compilations

Credential Stuffing

Attackers can readily search for organization e-mail addresses within existing breach compilations and attempt these credentials against targets such as:

• VPNs
• Single sign-on (SSO) providers
• Remote administration services (i.e. SSH, RDP)

Targeted phishing campaigns

Target specific individuals based on “reconnaissance” as real-world attackers would—in other words, create more realistic e-mails aligned to the target’s job role.

External Network Penetration Testing

In addition to identifying outright exploitable vulnerabilities, attackers often gain other valuable details from external reconnaissance:

• Services to attempt authentication against
• Forgotten or old services
• DNS misconfigurations (DMARC, dangling entries, etc.)

(Attacks can wield this intel to then chain to other attacks.)

Web Application

Since web applications often sit within the FedRAMP boundary, you’ll want to target these where possible while still keeping the red team’s goals in mind.

Some example attacks include:

• Using a typical Cross-site Scripting vulnerability on a customer-facing website in a campaign to acquire an employee’s SSO session
• Compromising a web host and then stealing the credentials of administrative users

Internal phishing

Using an employee’s e-mail account that was compromised earlier, send an incredibly convincing phishing e-mail or instant message to another employee and continue with the attack chain until the red team’s goal is met.

Vishing

When attempting vishing—that is, social engineering via phone calls—specific individuals and help desks can make great targets due to their level of access. If you have departments still using fax machines, consider targeting those as well.

Physical penetration tests

Attacks don’t need to be completely limited to the virtual realm—you can simulate and assess material attack vectors like:

• Could an attacker posing as a contractor compromise an on-premises network closet?
• Would an employee plug in a malicious USB stick they found within their building?
• Could a hardware keylogger be placed on a desktop?

Wireless attacks

Because many devices—like printers—emanate their own Wi-Fi signals—consider attempting to compromise these, as they may serve as a pivot into an internal network.

Other wireless attacks to consider imitating include:

• Capturing credentials via rogue access points
• Mousejacking (during which malicious keyboard and mouse actions are inserted to compromise a device)
• Testing whether key presses can be recorded

Section

Explanation

Executive Summary

For individuals who need a quick reference, include a summary that highlights the results of the exercise.

Framework(s)

Specify the red team framework you used within your report.

(The most popular red team framework at the moment is MITRE ATT&CK).

Attack Path Narrative

Discuss the overall thought process during testing, as well as attempted and successful attacks.

Identified Findings

Describe all identified security gaps, including but not limited to:

• The initial access method
• Level of access obtained
• Lateral movement attempts
• A high-level description of any sensitive data accessed or exfiltrated

Remediation Plan(s)

Detail your remediation plan for each identified security gap.