Releasing Your Inner TIBER in Regulated Adversary Simulations

The talk introduces TIBER, short for threat intelligence-based ethical red teaming, a framework used across the European financial sector, and explains why it exists. It traces the roots to the advanced persistent threat breaches that pushed companies toward zero trust architecture and more formal red teaming. European national central banks then drafted the framework as voluntary best practice, and the DORA regulation later made threat-led penetration tests mandatory for the largest entities, with national authorities selecting which firms must test.

A project has three phases: preparation, testing and closure, with testing split into threat intelligence work of about four to six weeks and a red team phase of roughly three months. Scope is built around critical business functions and their supporting IT assets, and analysts match those assets against threat actor groups to write at least three attack narratives. A worked example of a financially motivated group targeting bank ATM networks shows the sophistication expected. During execution, testers use leg-ups to bypass noisy initial access, reuse access when a scenario is burned, and switch to purple teaming when detection occurs.

The speaker closes with lessons for testers and control teams: focus on coverage over personal pride, tailor off-the-shelf tooling to strong controls, and communicate plainly with non-technical stakeholders. For newcomers, gaining enterprise IT experience before becoming a tester is recommended, since testers need to understand how these technologies run before they can test them.