Water sector passes, government sector fails attempts to spot and halt simulated CISA attack
CISA red teamers compromised both a government and a water organization; water defenders detected and contained the simulated attack, government defenders did not.
CISA's red team gained initial access, elevated domain privileges, and lateral movement into sensitive business systems and cloud resources at an unnamed government organization, whose SOC ignored low- and medium-severity EDR alerts buried under thousands of false positives. A water organization's SOC quarantined phishing-compromised workstations within 2, 10, and 20 minutes, and later detected and isolated intrusions reaching the OT DMZ bastion host. Both organizations underestimated cloud risk, lacked Microsoft Conditional Access for workload identities, and had no process to revoke compromised access and refresh tokens. This is one of CISA's rare public red-team reports since 2023.
- Water organization's SOC quarantined compromised workstations within 2, 10 and 20 minutes
- Government organization ignored EDR alerts buried under thousands of false positives
- Red team reached sensitive business systems, cloud resources and an OT DMZ bastion host
- Both lacked Conditional Access for workload identities and token revocation processes
- Rare public CISA red-team report, series first published in 2023
- Vendors
- Microsoft
- Products
- Conditional Access
- Organizations
- CISA
- Countries
- United States
From the original article
3 min read at cyberscoop.com
Agency red-teamers got initial access to both organizations they tested, but one quickly isolated and shut down the attempts from going further.
By @timstarks · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.