Walter “Pete” Lee - VP Operations PRIVATE and PUBLIC SECTOR “RED TEAM” PRACTICES Presenter Walter “Pete” Lee - VP Operations www.advantagesci.com

Objectives Provide an understanding of a Red Team exercise’s purpose and benefits Differentiate public and private sector Red Team practices Provide information on how to select a Red Team for evaluating physical security Provide best practices and lessons learned from both public and private sector Red Team Exercises

What is a Red Team The term “Red Team” is used to define different processes across many industries. Independent Review Boards Internal Review Processes Adversary Evaluations Challengers of Operational Concepts Ultimately an organized skilled group of individuals tasked to challenge assumptions and results or an opposing team of skilled individuals that model the tactics of an adversary.

Red Team Exercises A management tool used to reduce risk, identify vulnerabilities and opportunities for change. Provides participants an understanding of their adversary's tactics capabilities and vulnerabilities. Purpose: To validate or identify perceived vulnerabilities or weaknesses of facilities, security plans, policies, procedures, and technology. Performed by: Internal or external teams of specialists selected to meet objectives, with expertise in: physical security electronic security surveillance computer security social engineering covert and overt entry criminal and terrorist methodologies

Exercise Benefits (in general) Provides a means to exercise security technology, plans, and procedures against an adversary Identifies gaps in security systems, policies and procedures Identifies shortfalls in equipment and training Improves security posture and awareness Challenges established thinking within an organization – “Challenges the norms” Can provide additional support for needed improvements

Public vs. Private Sector Public Sector Red Team Practices Private Sector Red Team Practices

Exercise Development Steps Obtain management “buy-in” Forecast and obtain budget Develop goals and objectives Establish rules of engagement Identify and brief Red Team Identify and brief a “Trusted Agent” Conduct Exercise After Action Review with recommendations Mitigate gaps and risks

Red Team Tactics (Simulating the Tactics of the “Threat”) Open Source Information Data Mining Social Engineering Reconnaissance and Surveillance Impersonations/False Credentials Planning Rehearsals

Open Source Information Types of information gathered Routes to use for reconnaissance Facility photos Aerial photos Community attitude Law enforcement capabilities Demographics Crime rate Hate groups

Open Source Information Key management personnel and employees Phone numbers Email addresses Maps and Pictures Existing contracts Requests for Proposals Security personnel and procedures

Red Team Tactics Social Engineering Telephone calls Emails Personal Meetings

Comments from people that social engineering was effectively used against “He seemed like such a nice person” “I did not know that information I gave them was sensitive” “She knew the internal terms and department slang names we use around here” “He mentioned some of the people I know and work with around here” “She said it was for the Director” “How could I have given away any trade secrets, I don’t know any”

Reconnaissance and Surveillance Red Team Tactics Reconnaissance and Surveillance Types Purposes Equipment Methods Duration

Internal Team vs. Contract Team Internal Pros: More control Reduced labor cost Impromptu availability Flexibility Internal Cons: Evaluation objectivity Internal influence Organizational conflict Conflict of interest Training required Equipment cost

Internal Team vs. Contract Team Contract Pros: Objective view of true vulnerabilities Skilled professionals No training or equipment required Contract Cons: Third party knowledge Cost Liabilities

Selecting a Contractor Identify Your Objectives Select contractor based on Requirements Qualifications Past Performance Role Player Skill Sets Insurance / Litigations Specialty Requirements Confidentiality

Red Team Member’s Attributes Well-versed with the tactics and techniques of various adversaries and able to learn and live the Modus Operandi of the threat being portrayed Must be mature and even tempered Safety conscious Practices “Confidentiality” Must be proficient in surveillance and countersurveillance Must be able to blend in the environment Must be outgoing and able to live the lie Able to think quickly on their feet (situational awareness) Knowledge of security policy and procedures regulatory requirements and best practices

Obstacles to Red Team Success Lack of organizational support Objectives not clearly defined Management views objectives as pass or fail Lack of exercise realism Organization refuses to accept findings Inexperienced Red Team Lack of coordination or exercise conflicts with other events Failure to take action on findings

Security Trends Identified During Exercises Organizational procedures not being followed Security personnel not adequately trained in “use of force”, search, or detention procedures Over-reliance on passive security measures Lack of employee security awareness Security technology and barriers not properly deployed or utilized

Lessons Confirmed or Realized after Exercises Open source information is a vulnerability – review information being released to the public Security is undermanned – security should not be the first budget cut, positions must be manned smartly Security badges can be easily duplicated – passive security is not reliable, active security and authentication should be used Lack of ability to conduct security trend analysis - logging and analysis of security and suspicious incidents Lack of effective employee communications and information sharing - reinforcement of security training for employees is crucial – untrained staff create a weak link

Exercise Best Practices Red Team Exercises should not be relied on as the only tool for risk mitigation Performed in conjunction with a vulnerability assessment Exercises are performed on a regular basis Objectives are well-defined Ensure management support and “buy-in” Use a qualified team Results are actionable Benchmarking

8(a) SDVOSB, MBE, WBE,SDB, GSA Walter “Pete” Lee - VP Operations QUESTIONS ? Walter “Pete” Lee - VP Operations plee@advantagesci.com (310) 536-9876