Red Teams Turn We Think into We Know
Security teams make decisions with incomplete information. Red Teams make that information less incomplete.
Will This Control Actually Stop an Attacker?
"MFA will stop an attacker from accessing this service."
What if an adversary took the service account token?
Consider all angles for a particular attack. Proper authorization may be the only assumed way to access a particular service, but what about the quality-of-life improvements created along the way by engineers? Shadow IT exists mainly because of the need to fill the vacuum that exists due to unclear, inaccessible, or inconvenient policies and procedures.
Expectations at Time of Encounter
Controls should not be evaluated strictly based on deployment. They are evaluated when an attacker encounters them. Just because the canonical case is accounted for, does not mean that every case has been considered.
"The good guys have to be right all the time, but the bad guys only have to be right once."
Gather the Complete Picture
A group of engineers may find the path of least resistance. Ensure your architecture allows the most secure to be the easiest, else there will be weird edgecases that allow entry into the castle. Often times, the most secure way is not the most convenient. Red Teams can help shape the way organizations think about ease and convenience by illuminating where the deviations occur. Red Teams help organizations understand where security and convenience are working against each other.