Cyber Operational Resilience Intelligence-led Exercises (CORIE)^® Framework

Appendix B: Provider Guide for threat intelligence and red teaming service providers

Download the complete Report [273KB]

Glossary

1. Introduction

The Cyber Operational Resilience Intelligence-led Exercises (CORIE) scheme has been developed by the CFR to aid in preparation and execution of industry-wide cyber resilience exercises[²]. CORIE's ‘red team’ exercises mimic the tactics, techniques and procedures (TTP's) of real-life adversaries, employing creativity and utilising tools and techniques that may not have been anticipated and planned for. These exercises measure the ability of an organisation to detect, respond, withstand, repel and recover from the operations of a real adversary based on such TTPs, so as to maintain critical business processes and protect sensitive data.

Real-life adversaries such as state-sponsored attackers are neither constrained by scope nor time. CORIE mimics adversaries through fewer traditional testing restrictions and longer time duration to fully exploit opportunities. As a result, CORIE complements traditional security testing programs, such as vulnerability assessments, penetration testing and continuous red teaming – financial institutions should continue to maintain their existing security testing regimes.

Consistent with the objective of testing the cyber resilience of all sizes of institutions and levels of maturity across the Australian financial industry, CORIE has been designed to be scalable based on a tiering assessment that considers the cyber maturity of a financial institution (FI), organisational size, and market share amongst other factors. The frequency of exercises depends on the FI's Cyber Risk Assessment (CRA) tier.

Exercise types include:

• Adversary Attack Simulation – Red Team exercise
• Replay Adversary Attack Simulation – Purple exercise
• Table Top Crisis Simulation – Gold Team exercise

Exercises are intended to be conducted by independent providers, bringing a fresh perspective and as close to an unbiased view as possible coupled with advanced adversary simulation capabilities. Australian based providers are preferred due to accessibility when co-ordinating effort. However, providers may use resources, including people and technology, which are based outside Australia. Multiple providers can be used across the exercises for gathering threat intelligence on participating financial institutions and conducting the red-team attacks for the simulated cyber scenario.

This guide details the standards required to execute exercises detailed in the CORIE framework.

This guide is useful for FIs to ensure Providers meet the necessary experience and certifications.

Providers should use the information to ensure they have the necessary experience and certifications to meet the standard. Consider the training courses listed here to help achieve the skill required to deliver CORIE.

These certification and experience requirements can be used as a guide for financial institutions to further develop their own cyber security staff to grow internal red team capabilities.

As industry certifications and recommended training evolves, so too will this guide.

2. Providers

Providers that wish to participate in the program should meet specified minimum standards.

Providers with a significant presence in Australia are preferred due to ease of use when co-ordinating effort.

A Provider may participate in the program as a Threat Intelligence Provider and/or a Red Team Provider.

2.1 Threat Intelligence Provider

A Threat Intelligence Provider gathers threat Intelligence on adversaries targeting FIs in Australia.

Other sources of intelligence used in the program may include:

• Government
• Internal FI sources
• Proprietary feeds
• Intelligence sharing platforms
• Generic public threat intelligence.

A Threat Intelligence Provider engaged by an FI must satisfy the FI that it has a mechanism to gather information and develop threat intelligence from the dark web and that all threat intelligence will be gathered in a legal and ethical manner.

FIs should satisfy themselves that the Threat Intelligence Provider they engage has certified resources to threat model and perform analysis on real-world threats that appear, or are known, to be targeting the FI.

FIs should satisfy themselves that the Threat Intelligence Provider they engage has appropriately certified resources and demonstrable experience to provide both a Threat Intelligence Report and Targeting Report to both the FI and CFR.

2.1.1 Threat Intelligence Team Member Requirements

FIs should satisfy themselves that the personnel of the Threat Intelligence Provider they engage meet the requirements set out in section 2.1.1.3.

A Threat Intelligence team should have qualified and experienced consultants capable of performing analysis, threat modelling and reporting at the time of the engagement.

The team should consist of at least one Threat Intelligence Lead and one Threat Intelligence Analyst.

2.1.1.1 Threat Intelligence Lead

A Threat Intelligence Lead is expected to have knowledge and expertise in leading a team specialising in producing threat intelligence. They should have the ability to gather threat intelligence in a realistic, legal and safe manner with the ability to document appropriate supporting evidence.

2.1.1.2 Threat Intelligence Analyst

Threat Intelligence Analysts are expected to have knowledge and expertise to gather threat intelligence in a realistic, legal and safe manner, collecting appropriate supporting evidence.

2.1.1.3 Threat Intelligence Skills Matrix

Certifications indicating the necessary experience and skills include[³]:

2.2 Red Team Exercise Provider (Adversary Attack Simulation)

FIs should satisfy themselves that the personnel of the Red Team Provider they engage meet the requirements set out in section 2.2.1.5.

Red Team Providers should have qualified and experienced team members capable of performing management, OSINT, reconnaissance, surveillance, cyber-attack simulation, social engineering, physical breach, and reporting at the time of the engagement.

A Red Team should consist of at least a Red Team Lead, a Red Team Specialist, and an Exploit Development Specialist.

2.2.1 Red Team Member Requirements

2.2.1.1 Red Team Lead

Red Team Leads are expected to have strong practical and theoretical knowledge and expertise in simulating sophisticated adversaries targeting organisations within the financial industry, along with expertise in leading a Red Team. The Red Team Lead should have skills to create schedules, test plans, action summaries, and run meetings and workshops with the FI. Red Team Leads should be proficient in identifying, managing and communicating exercise risks to the FI's Control Group. They should also provide practical advice and solutions to resolve challenges that typically arise during engagements.

2.2.1.2 Red Team Specialist

Red Team Specialists are expected to have practical knowledge and expertise in simulating sophisticated adversaries targeting organisations within the financial industry. They should have skills encompassing exploitation of vulnerabilities, social engineering phishing campaigns, implant development, evasion skills and lateral movement within a compromised network.

2.2.1.3 Exploit Development Specialist

Exploit Development Specialists are expected to have experience developing software exploits and improving public exploits for use in production environments. The Exploit Development Specialist should have skills around exploit development, reverse engineering, assembly and disassembly, along with a comprehensive knowledge of different operating systems and their defences.

Exploit Development Specialists are not expected to be engaged in the exercise on a full time basis, but should be available to create, modify, and improve exploits for the exercise when required.

2.2.1.4 Red Team Member

Red Team Members are expected to have knowledge and expertise in simulating adversaries targeting organisations in the financial sector. They should have skills to support the Red Team Specialist and execute specific tasks assigned to them. Due to the increased scope of larger exercises, Red Team Members provide support for tasks requiring less complexity. Red Team Members should not work on the exercise without a Red Team Specialist. Actions on targets are the responsibility of the Red Team Lead and Red Team Specialist, including those of the Red Team Member.

2.2.1.5 Red Team Skills Matrix

Certifications indicating the necessary experience and skills include[⁴]:

2.3 Provider for Replay Adversary Attack Simulation – Purple Exercise

A Purple Exercise should be completed by Tier 1, 2 and 3 FIs annually.

Purple Exercises originate from the concept of the Red Team and Blue Team intermixing. The Red Team, who simulate attacks, collaborates with the Blue Team, which is the team responsible for detecting and responding to cyber-attacks in an organisation.

Where an FI has an internal testing capability that meets the requirements of this section, the internal team can be used to conduct this exercise rather than using an external Red Team Provider. The internal team then becomes known as the Provider for all intents and purposes.

Providers must have qualified team members to mimic the tactics, techniques, and procedures of known advanced persistent threats.

The Provider's Red Team will work closely with the FI's Blue Team.

2.3.1 Purple Exercise Member Requirements

Purple Exercises can be conducted by the following Red Team Provider members:

• Red Team Specialist
• Red Team Member

2.4 Provider for Crisis Simulation Table Top – Gold Team Exercise

A Gold Team Exercise should be completed by Tier 1, 2 and 3 FIs annually.

Providers must have qualified team members that can clearly communicate, and have knowledge concerning details of scenarios involved adversary attack simulation. Team members must have knowledge of the appropriate defensive counter measures and risk management used within FIs.

As the skills required match many of those required by the Red Team Provider to lead an adversary attack simulation, a Red Team Provider can be used for a Gold Team Exercise.

Consistent with approach to Purple Exercises, where an FI has an internal testing capability that meets the requirements of this section, the internal team can be used to conduct this exercise rather than using an external Red Team Provider.

That team then becomes known as the Provider for all intents and purposes.

2.4.1 Gold Team Member Requirements

2.4.1.1 Gold Team Lead

Executives may have little prior awareness or exposure to the concepts, terms or details of adversary attack simulation, therefore Gold Team Leads should have strong communication and facilitation skills to lead in role playing activities simulating diverse crisis events.

Gold Team Leads should understand risk management, along with possessing strong practical and theoretical knowledge in simulating sophisticated adversaries, and defensive capabilities used to prevent, detect and respond accordingly. Further, Gold Team Leads must be able to convey risks in terms of business impact and likelihood, so that executive management understand appropriate actions to undertake.

Provider staff with skills necessary to lead a Gold Team can be assigned the role of Gold Team Lead. However, either a Red Team Lead or Red Team Specialist should also be a member of the Provider's team.

3. Annex A: CTC Contact Details

The CTC can be contacted by emailing: corie@rba.gov.au

Footnotes