Keynote: Red Notice - Pros And Cons - Alethe Denis

### Overview In this keynote address at Security Fest, Alethe Denis, a security consultant on the red team at Bishop Fox and DEF CON Black Badge recipient, discusses the nuances, benefits, and common pitfalls of red teaming and physical social engineering. Denis illustrates how red team operations differ fundamentally from vulnerability assessments and penetration tests, focusing on realistic, goal-oriented adversary emulation. Through candid real-world engagement stories—ranging from physical security infiltration to email phishing and phone vishing campaigns—she highlights why human manipulation succeeds, why defensive controls must support human nature, and how security program maturity dictates the appropriate style of testing.

### Key Topics - **Distinguishing Security Testing Tiers**: Vulnerability assessments use automated scanners and human analysts to identify flaws in hours or days; penetration testing involves hands-on, often noisy evaluations across 1–3 weeks; red teaming is an objective-based, stealthy adversary simulation lasting weeks to months targeting people, processes, and technology. - **Security Maturity Alignment**: Organizations with low or medium security maturity should invest in defensive blue teams, automated scanning, and standard penetration tests before commissioning red teams. Red teaming provides maximum value only when a company's baseline defenses and detection capabilities are already robust. - **Human Factors and Social Engineering**: Humans are hardwired to be cooperative and empathetic. Beating these social traits out of an organization is impossible, meaning awareness training alone cannot prevent compromise without layered technical controls. - **Flaws in Testing Realism**: Common client mistakes include warning employees about phishing tests, omitting executives, whitelisting/disabling security filters prematurely, or relying entirely on generic compliance-driven phishing templates that produce false confidence.

### Technical Details - **Physical Access Engagement Failures and Successes**: Denis recounts an authorized test simulating a disgruntled employee against armed guards, revolving optical turnstiles, and badge-in/badge-out man traps. Attempting to exploit empathy by feigning a broken badge failed when a vigilant guard and receptionist intercepted her, validating the client's physical security investments. In contrast, during another engagement targeting service vehicles, she easily bypassed perimeter gates via reverse tailgating behind exiting trucks, accessing 10 of 13 vehicles with keys left inside. - **Phishing and Bypassing Mitigations**: In a two-stage phishing test against an organization where initial tests yielded zero clicks due to suspected client tampering (warning staff), a delayed dispatch schedule (targeting employees 15 minutes before notify points-of-contact) achieved credential harvesting. In another scenario, browser reputation rules blocked a freshly registered malicious domain (<14 days old), but Denis adapted by using tech-support pretexting to deliver the file via Google Drive. - **Authentication Vulnerabilities**: Denis highlights how traditional multi-factor authentication (MFA) can be compromised via prompt fatigue or real-time adversary-in-the-middle credential capture (e.g., an attacker triggering an expected push notification during login, leading to a 100+ day network dwell time). She emphasizes hardware-based Universal 2nd Factor (U2F) / token authentication as the most reliable technical countermeasure to stop credential replay in its tracks.

### Takeaways - **Defense in Depth ('Security as an Onion')**: Organizations must combine email filtering, domain aging checks, web filtering, and token-based MFA with tested incident response plans and threat intelligence feeds (such as AlienVault or FBI InfraGard). - **Assumed Breach Value**: When external controls are solid, shifting to an assumed breach scenario (providing initial access or insider placement) reduces costly reconnaissance time and tests internal containment, lateral movement, and response capabilities. - **Engagement Rules**: Red team operators must strictly define scope, Rules of Engagement (RoE), and explicit trophies in advance, while always carrying a signed, wet-ink 'get out of jail free' letter from an authorized stakeholder.