Hacking the IR Team | Gerard Johansen | WWHF 2023

### Overview In this presentation at Wild West Hackin' Fest (WWHF) 2023, Gerard Johansen from Red Canary discusses how organizations can break down silos between red teams (offensive testers) and blue teams (incident response/defenders) to drastically improve incident response (IR) capabilities. Johansen argues that traditional security models treat penetration testing as an annual compliance checkbox exercise that leaves immense technical expertise on the table. Instead of jumping directly into complex, expensive annual purple team exercises where teams often fail, he advocates for a structured, year-round continuous training pipeline centered on realistic threat emulation.

### Key Topics - **Silos and Checkbox Compliance:** Many organizations view security testing through a governance, risk, and compliance (GRC) lens, tightly scoping annual penetration tests to minor vulnerability scans or running Responder. This fails to provide actionable value or prepare defenders for real adversary behaviors. - **The IR Training Gap:** Incident response training is frequently limited to annual tabletop exercises or costly multi-day offsite boot camps. Because budgets often get cut first in soft markets and technical skills degrade rapidly over months, defenders lack exposure to live adversary tactics, techniques, and procedures (TTPs). - **The "4 Rs" of Training:** Johansen asserts effective IR training must be Realistic (emulating genuine adversary behavior), Relevant (drawing from real threat intelligence like Red Canary's Threat Detection Report or Mandiant M-Trends), Recent (regularly practiced because training decays quickly), and Repetitive (drilled continuously rather than once a year).

### Technical Details & Framework Johansen outlines a progressive, year-long training framework combining offensive and defensive capabilities: - **IR Plan Review & Premortem Analysis (1-hour drill):** Engage red team personnel to review incident response and disaster recovery plans, conducting premortem analyses to spot assumptions adversaries could break (e.g., discovering online flat-file backup data lakes that an attacker could easily encrypt). - **Monthly Detection & Response Micro-Emulations:** Conduct focused, single-technique emulations rather than entire kill chains using tools like Atomic Red Team or Caldera. Examples include testing `rundll32.exe` execution, DLL search order hijacking, LSASS memory dumping, or testing readiness against frameworks like Impacket, Cobalt Strike, or PowerShell Empire. - **Tabletop Drills & Key Assumptions Checks:** Link discrete micro-emulations into partial kill chains (e.g., executing lateral movement via RDP, SMB, or GoToMyPC, and validating if defenders can locate Event ID 4624 Type 10 logon events and NetFlow artifacts within 10 minutes). Red teams participate in tabletops to challenge flawed managerial assumptions (e.g., proving whether an attacker can eavesdrop on incident response Zoom/WebEx channels). - **Annual Purple Team Validation:** Conduct a full purple team engagement at the end of the year to validate cumulative progress across patched detective controls, playbook adjustments, and triage response speed.

### Takeaways - **Continuous Tempo Outweighs Annual Splurges:** Organizations gain far more defensive resilience from continuous, low-cost weekly or monthly micro-emulations than from an isolated annual penetration test. - **Actionable Metrics for Leadership:** Track technique-level metrics (e.g., mapping results on a MITRE ATT&CK spreadsheet) focusing on detection rate and dwell time/time-to-detect (e.g., flagging tests where activity was undetected after 90 minutes). - **Mutual Benefits:** Red and blue cross-collaboration exposes defenders to the live attacker mindset and tooling while teaching red teams defensive detection boundaries and EDR telemetry evasion.