Latest news
The Value of Red Teams – Delivering Impact through Analogies
In this blog post, we will explore how red teaming helps identify and then translate intricate technical risks into comprehensible business language, ensuring that stakeholders understand the implications and can take appropriate actions to safeguard their organisations.
Understanding Red Teaming
Red teaming is a structured process where cybersecurity professionals simulate real world threats to help an organisation exercise their defence technologies, training, and processes. Originally derived from military practices, red teaming has been widely adopted in cybersecurity to simulate real-world attack scenarios, identify vulnerabilities, and evaluate the effectiveness of security measures.
The primary objectives of red teaming include:
- Identifying weaknesses in systems and processes before malicious actors can exploit them.
- Testing response capabilities and preparedness for potential security incidents.
- Providing actionable insights to strengthen defences and mitigate risks.
While the technical findings from red team exercises are invaluable, their true effectiveness lies in how well these insights are communicated to and understood by business stakeholders.
The Challenge of Communicating Technical Risks
Technical professionals often face challenges when conveying complex security issues to non-technical audiences.
These challenges include:
- Technical Jargon: Excessive use of specialized terminology can alienate and confuse stakeholders.
- Abstract Concepts: Some technical risks are abstract and lack tangible context, making them difficult to grasp.
- Underestimating Impact: Without clear communication, business leaders may underestimate the severity or relevance of certain risks.
Effective communication requires translating technical findings into clear, concise, and relevant information that highlights the business implications of identified risks.
Implementing Effective Communication Strategies
Running red team exercises can help identify issues but translating them into effective information is a massive challenge, and can undermine the value of the test if done poorly.
Cybersecurity professionals are experts at identifying and remediating vulnerabilities, but many do not understand business, or struggle with translating their language into one that business can use effectively.
My advice for cybersecurity professionals, from testers to CISOs is to consider the following when you want to help your non-technical peers understand your concerns:
1. Know Your Audience: Understand the knowledge level and concerns of your stakeholders to tailor the communication accordingly.
2. Use Clear and Concise Language: Avoid unnecessary technical jargon and present information straightforwardly.
3. Leverage Storytelling: Incorporate narratives and analogies to make the information relatable and memorable.
4. Highlight Business Implications: Clearly connect technical findings to potential business outcomes, including financial, operational, and reputational impacts.
5. Provide Actionable Recommendations: Offer clear steps and solutions to address identified risks, facilitating informed decision-making.
In my many years of experience in security testing systems, I have found that the most effective manner to communicate with c-suite executives, regulators, and non-technical audiences is the art of storytelling.
I look at what my red team achieved and break it down into its most simplified format to turn it into a story which can be appreciated by all, by using analogies.
Analogies can help then make that story real to the audience by making it personal to them using common shared experiences. We can then focus our message by explicitly explaining the threats that exist from the inherent risks related to the issue.
The Power of Analogies in Risk Communication
Analogies serve as powerful tools to bridge the understanding gap between technical experts and business leaders. By relating unfamiliar technical concepts to familiar experiences, analogies make complex information more relatable and easier to comprehend.
Benefits of Using Analogies
- Simplification: Analogies distil complex ideas into simple, understandable terms.
- Engagement: They capture attention and make the information more engaging.
- Retention: People are more likely to remember concepts presented through relatable stories or comparisons.
- Decision Making: Clear understanding facilitates better and faster decision-making processes.
Translating Technical Risks through Effective Analogies
When crafting an analogy from technical risks we need to think carefully about what message we want our audience to take away from it. Analogies do not need to be long to have impact – one of the most effective analogies I have seen used to explain how poor the security of a system was from a security test was summed up as:
“This test was like big game hunting in a zoo.”
While blunt, it did server as a useful strapline to set the tone that the test identified numerous big issues which required little to no skill to uncover or abuse.
Building on such a strapline though is necessary, as this alone does not help the business understand the impact of the test or understand the underlying issues. Therefore we need to get a little bit more creative. Here are some examples of what we could do to build on this concept.
Example 1: Vulnerability Exploitation
Technical Description: The red team discovered a critical vulnerability in a company’s web application that allows unauthorised access to sensitive customer data.
Analogy: “Think of our web application as a shop in the town that is your company. This shop has a hidden backdoor that is not locked. Right now, anyone who knows about this door can walk right in and access the till, help themselves to stock, and look at the customer list. We need to secure this backdoor immediately to protect our customers and maintain their trust.”
Business Impact Translation:
- Financial Risk: Potential fines from regulatory bodies due to data breaches.
- Reputation Risk: Loss of customer trust leading to decreased sales and market share.
- Operational Risk: Disruption of services and increased costs associated with incident response and remediation.
Example 2: Insufficient Incident Response Plan
Technical Description: The organisation’s incident response plan lacks clear procedures and is not regularly tested, leading to potential delays in addressing security breaches.
Analogy: “Imagine our company’s security like a fire drill that no one has practiced. If a fire breaks out, chaos ensues because people are not sure where to go or what to do, leading to greater damage and panic. Regularly practicing and updating our incident response plan ensures that we can act swiftly and effectively when a security ‘fire’ occurs.”
Business Impact Translation:
- Extended Downtime: Slow response increases recovery time, affecting productivity and revenue.
- Increased Damage: Delays allow threats to cause more extensive harm to systems and data.
- Regulatory Consequences: Inefficient response may not meet compliance requirements, resulting in penalties.
Example 3: Lack of Employee Security Awareness
Technical Description: Employees are not adequately trained in security best practices, making them susceptible to phishing attacks and social engineering.
Analogy: “Our employees are like the guards of our castle, but without proper training, they might unknowingly open the gates to enemies disguised as friends. Providing comprehensive security training, and sufficient tools equip them with the knowledge and capabilities to recognise and block these disguised threats, keeping our ‘castle’ safe.”
Business Impact Translation:
- Data Breaches: Increased likelihood of sensitive information being compromised.
- Financial Losses: Costs associated with breach mitigation and potential fraud.
- Brand Damage: Publicised security incidents can harm the company’s reputation and customer confidence.
Example 4: Misconfigured Identity and Access Management Systems
Technical Description: The red team identified that a server which had been delegated authority to access and change records in an Active Directory making them susceptible to take over by threat actors.
Analogy: “Think of this server like a shop in the town that is your company. At the back of the shop is an unlocked door which opens our into the town hall records department. The shopkeeper or any threat actor who breaks into the shop can use the backdoor to not only look at the town hall records of every citizen of the town, but also the records of every shop and house within the town and can change those records to make it look like they live or own that instead. We need to demolish this backdoor, review the town hall, and audit the town records to check no one has abused this and that other backdoors do not exist.”
Business Impact Translation:
- Financial Risk: Potential fines from regulatory bodies due to data breaches.
- Brand Damage: Publicised security incidents can harm the company’s reputation and customer confidence.
- Operational Risk: Disruption of services and increased costs associated with incident response and remediation.
- Data Breaches: Increased likelihood of sensitive information being compromised.
Conclusion
Red teaming is an essential practice for proactively identifying and mitigating technical risks within an organisation.
However, the true value of these exercises is realised only when the findings are effectively communicated to business leaders in a language they understand.
Utilising analogies and clear, impactful messaging bridges the gap between technical complexity and business comprehension, enabling organizations to make informed decisions that strengthen their security posture and resilience. By investing in effective communication strategies, organisations not only enhance their ability to respond to current threats but also foster a culture of security awareness and proactive risk management that is critical in today’s digital age.
Email Prism Infosec, complete our Contact Us form or call us on 01242 652100 and ask for Sales to setup an initial discussion.