While many organizations are placing high levels of effort into securing their own perimeter, attackers are increasingly finding new ways to bypass perimeter defenses by targeting third parties / vendors and partners. Supply chain and third-party attacks will continue to be among the fastest-growing vectors for breaches, ransomware deployment, and data exfiltration.
red teaming third-party risks can simulate actual attacks using trusted relationships and access to vendors, managed service providers, SaaS environments, contractors and BPOs. This approach allows organizations to understand how a successful attack will likely impact their organization through a seemingly low-risk vendor (using trusted credentials, APIs or integrations).
All organizations, especially small and medium sized businesses (SMEs) and start-ups, must conduct proactive testing of their current website security measures, data privacy policies (GDPR), and overall compliance with regulatory standards and contractual obligations.
Why Third-Party Red Teaming Matters
Conventional vulnerability assessments and questionnaires provide merely a snapshot of security at one moment in time; however, red teaming provides additional insight by:
1. Simulating how attackers chain together compromises through trusted vendor relationships;
2. Testing how a compromise against a partner organization can provide an attacker with a means of lateral movement into your own organization;
3. Identifying previously unknown vulnerabilities associated with shared credentials, OAuth tokens, single sign-on integrations, and other remote access methods; and,
4. Demonstrating the business impact of real-world successful attack scenarios rather than relying solely on hypothetical attack scenarios.
Recent events illustrate how dangerous this can be. Attackers have successfully moved across client organizations by first compromising a managed services provider (MSP) or business process outsourcing (BPO) partner, by stealing credentials from outsourced IT support to impersonate help desk employees, by exploiting Software-as-a-Service (SaaS) integrations, or by taking advantage of third-party integration or plugin ecosystems to move laterally across multiple customer environments after gaining unauthorized access through the successful compromise of a third-party vendor.
Common Attack Paths Red Teams Simulate
Common scenarios red teams use to simulate the real danger associated with third-party risk include the following:
1. Attaining Access to Your Organization Via Bad Vendor Credentials , Using weak or reused credentials associated with a vendor to gain access to a vendor’s system and then conduct lateral movement using legitimate remote access (e.g., VPN, RDP, and remote support software) into a client organization.
2. Exploitation of Federated Identity Trust Relationships , Using trust relationships created through federated identity, single sign-on (SSO) or OAuth between your organization and a partner organization to access sensitive data or escalate privileges.
3. Supply Chain Compromise Targeting software updates, plugins and supporting products from a vendor (e.g., like the SolarWinds or Kaseya-style attacks).
4. Through Social Engineering via a vendor impersonating a trusted vendor rep (e.g., via email, WhatsApp, or phone) to try and convince your staff to approve a modification, share a data item, and disable controls.
5. Hidden or Forgotten Integrations to find and exploit third or fourth party plugins, APIs and shadow IT that your security group may not be fully tracking.
6. Using an MSP or Outsourced IT Pivot to exploit a Managed Service Provider's privileged access to move laterally across multiple client environments.
They tend to work because vendors function outside of your boundaries, yet they maintain trusted access.
How Third-Party Risk Red Teaming Works in Practice
A Red Team engagement will usually contain:
1. A Scoping Process that identifies high risk vendors (e.g., vendors who have privileged access) who either share data or use critical integrations; and
2. A Reconnaissance Process to gather data related to the vendor technologies, services exposed and trusting relationships for the vendor in question.
3. Initial Access Attempts: When attempting to compromise through weaker controls of a vendor (phishing their staff, exploiting their publicly-available applications, or credential-stuffing).
4. Moving Laterally: Once in a Vendor’s environment, test moving into your environment through legitimate means.
5. Impact Demonstration: What an attacker could do (exfiltrate data, deploy ransomware, or maintain presence).
6. Reporting with Actionable Insights: Clear findings along with risk ratings and recommendations , not just vulnerability scans but also real attack paths.
Many organizations begin with scoped exercises against two to three mission-critical vendors and graduate to testing the entire ecosystem.
Practical Benefits for SMEs and Startups
1. Identifies blind-spots between vendors through questionnaires and surveys.
2. Validates the resilience of your controls against trusted individuals as well as compromised partners.
3. Provides evidence for improved vendor negotiations and contract provisions.
4. Demonstrates due diligence for compliance and insurance purposes.
5. Provides your blue team with the muscle memory of collaborative debriefs.
Even small and low-budget teams can start with tabletop exercises or lightweight simulations before moving to full red team exercises.
Key Takeaways
1. Attackers are often exploiting their relationships with your vendors & partners to gain access to your environment.
2. Third-party risk red teamings continue to expose these true attack paths by weaponizing trust relationships.
3. The ways attackers exploit vendor relationships include but are not limited to credential dumping, SSO/OAuth abuse, MSP pivots, & supply chain updates.
4. Comprehensive red team testing not only test technology, but also includes social engineering & business continuity simulations.
5. Continual red teaming combined with sound vendor onboarding & rigorous contract enforcement can significantly reduce third-party risks.
In a connected world, your security is only as good as its weakest vendor/partner connection. Through proactive red teaming through the supply chain, you can fill that gap before an attacker has an opportunity to exploit it.
