cyber.hendryadrian.com
Security Report · cyberscoop.com

CISA Red-Team Tests Find Uneven Detection and Response at Government and Water Organizations

· Original article ↗

Summary

CISA’s simulated tests found that a government organization failed to detect and respond effectively, while a water organization detected intrusions and quarantined systems. Both had cloud-security and token-management weaknesses.

Key points

  • CISA tested two unnamed organizations through a voluntary, by-request red-team process.
  • At the government organization, phishing enabled access to workstations, privilege escalation, and lateral movement; defenders did not respond effectively to alerts.
  • Thousands of false positives obscured red-team alerts at the government organization.
  • At the water organization, spearphishing led three users to click a malicious link; defenders quarantined affected workstations in 2, 10, and 20 minutes.
  • In a later assume-breach exercise, red teamers reached cloud resources and an OT demilitarized zone host before defenders detected the activity and isolated the system.
  • CISA identified shared gaps: underestimated cloud risks, no Conditional Access for workload identities, and weak processes for revoking compromised access and refresh tokens.

Article Details

Publisher
CISA
Scope
Red-team testing of one government organization and one water-sector organization.
Sample Size
Two organizations
Key Statistics
  • At the water-sector organization, defenders quarantined affected workstations in 2, 10, and 20 minutes, respectively.
  • Three users at the water-sector organization clicked a malicious link.
  • CISA reported thousands of false positives at the government organization, including some higher-severity alerts.
Recommendations
  • Implement Conditional Access for workload identities.
  • Establish processes to revoke compromised access and refresh tokens.

MITRE ATT&CK

T1566.002 · Spearphishing LinkThe red team used a spearphishing campaign with a malicious link that three users clicked to gain workstation access.

Vendors

Microsofthad flaws in their defenses: They underestimated cloud risks; they lacked Conditional Access — a Microsoft security tool — for workload identities; and they didn’t have processes in place to revoke compromised

Products

Conditional AccessBoth organizations still had security gaps, including cloud-risk underestimation, missing Conditional Access for workload identities, and weak token revocation processes.

Industries

GovernmentCISA’s red-team tests found that a government organization was compromised and failed to respond effectively, while a water-sector organization detected the intrusion and quickly quarantined affected systems.waterCISA’s red-team tests found that a government organization was compromised and failed to respond effectively, while a water-sector organization detected the intrusion and quickly quarantined affected systems.

Related Articles