TIBER - threat intelligence led red teaming for financial institutions

_{Article written by Vito Rallo}

TIBER, intelligence led red teaming that works

Back in 2018, the European Central Bank published the TIBER (Threat Intelligence-based Ethical Red teaming) framework. Inspired by the UK's CBEST and adapted to each European member state, TIBER regulates cybersecurity assessments for improving financial institutions’ resilience by mimicking real-life attacks. To do so, TIBER prescribes a red team exercise strictly led by threat intelligence-inspired scenarios.

If you’re reading this article, you probably already know about TIBER. Good - let’s skip the typical overview of TIBER and red teaming expertise claims, and get straight to the point. For those looking for more details, the official ECB paper is a good place to start.

This article focuses on the viewpoint of the red team provider (RTP) and discusses success factors identified on the basis of experience. It’s important to appreciate that the TIBER framework has evolved across the years, overcoming pitfalls, to finally focus on the essential aspect: reciprocal value creation. If you’re leading an ethical hacking team, there are insights to be had while sparing yourself some unnecessary frustration. If you’re leading the security team of a financial institution, then this is a chance to discover together how to spend money wisely and make the TIBER exercise a success.

When winning isn’t about winning

A service provider should focus primarily on three aspects aligned with the essence of the framework: cyber resilience, quality and value. Quality comes with experience, skills and certifications, but it’s also all about the approach (or in red teaming vocabulary, ‘tactical exploitation’ - the provider must adapt all aspects to the constraints of a regulated test). 

The value aspect is trickier: the goal is a real-life inspired experience, in a challenging game where three players - the regulator, the institution and the provider -  are trying to win. Paradoxically, this makes it easy to end up ‘losing’ and missing the opportunity to create value for everyone involved. 

For ethical hackers, success is often defined in terms of ‘capture the flag hacking’. For the bank, success means making sure that the red team provider doesn't win while avoiding criticism from the regulator. The regulator meanwhile is auditing the cybersecurity controls in place at the financial institution. In brief: a recipe for disaster.

Nothing could be further from the spirit of TIBER. It's a framework designed around feedback and collaboration where ideas, opinions, results and comments are part of a constructive process that starts from the modus operandi of a possible attacker (the threat intelligence), and which provides insight into the many aspects of a bank's security operations (secops).

A key ingredient in the recipe for success is setting the right mindset across the entire exercise, aligning the red team’s understanding and goals, setting proper and realistic expectations, and always highlighting the reciprocal benefits of fruitful and positive cooperation. Call it the W3 if you will, not referring to the web but rather a three-way win-win-win for all parties involved.

Red teaming with a difference

Banks are undoubtedly used to offensive security and related simulations; however TIBER is different from a classic or standard red team exercise. It’s worth taking a moment to compare a standard red team service to a TIBER delivery to highlight some of peculiarities in the RTP’s role.

Phishing still survives

Red team providers are in a constant, breathless race to find new breach vectors and advanced exploitation techniques. Despite increased awareness and predictions that phishing will die soon, this old enemy is still alive and healthy - and has actually been given a new lease on life by the COVID-19 pandemic. 

The in-phase remains the most challenging one: breaching the perimeter and compromising a host. Don't underestimate something that requires a multidisciplinary approach, not just ‘hacking’. The target’s security awareness, outstanding protection technology to be bypassed at many layers of the attack kill chain, the psychological elements behind a good pretext; these are all part of the art of social engineering.

Thibault Van Geluwe De Berlaere, ethical hacker and experienced red teamer, states: “To succeed, real-life attacks require better and personalised pretexting, and time, a lot of time. Spear phishing of ten security-aware targets is bound to fail”. And nothing resonates better than Thibault's message regarding real-life TIBER executions: "Our journey usually starts where most compromises start: phishing. We execute several phishing campaigns, ranging from basic ‘spray-and-prays’ to highly technical, targeted campaigns. Unfortunately, these have little effect; mature clients have very capable email defenses. Other perimeter attacks, targeting publicly exposed infrastructure and attacking wireless networks, are often also ineffective. 

When all these options are exhausted, time constraints force the use of a ‘leg-up’ to gain access to the internal network and keep chasing the test’s objective. Inside the network, we have to fight against several controls such as SSL/TLS encryption, antivirus, or worse - modern EDR software, firewall restrictions while beaconing out, etc. We use several techniques to gather access, such as credential dumping and Active Directory-based attacks. We usually move laterally throughout the organisation, jumping from one host to the next, each time getting one step closer to the critical function or flag. 

At one point or another, during each of the scenarios, we usually keep hitting the same wall: Privilege Access Management (PAM) and strong two-factor authentication. To eventually overcome, the fastest is not to go for a zero-day but rather to go back to social engineering with timing and new fancy atypical attacks.”

In conclusion, the most useful piece of advice may be to go back to basics. In this case, the fact that TIBER is very much a team exercise, and one in which the only way to win is to make sure all the teams win. It’s worth remembering the raison d’être of TIBER: to safeguard our financial institutions against cyber threats. The real intelligence here is to focus on that - all together.