In recent years, breach and attack simulation (BAS) has gained significant traction among enterprises, emerging as a crucial component in fortifying proactive security by automating the ongoing testing of threat vectors. It empowers organizations to verify potential threats, enhance security controls, identify vulnerabilities in critical assets, and prioritize remediation efforts to bolster cyber resilience. However, to achieve optimal outcomes, it’s imperative to recognize that BAS is more than just a tool. Enterprises who gain the most value out of BAS approach it as a comprehensive program. At SafeBreach’s 2023 Validate East Summit, security experts discussed their approaches to developing a successful BAS program. 

Panelists included:

• Garet Stroup, Associate VP Threat Incident and Response; Humana
• Vladlen Rotshteyn, CISSP, Associate Manager, Information Security; Regeneron
• Nathan Collis Coelh, Senior Security Engineer; Experian
• Senior Manager of IT Security; Fortune 500 Pharmaceutical Company
• Moderator: Raman Kumar, Chief Customer Officer; SafeBreach

Choosing to implement breach and attack simulation (BAS)

Across the board, the panelists agreed that the goal of implementing a BAS program was to derive efficiency gains and reduce manual processes. As Garet Stroup, Associate VP of Threat Incident and Response at Humana, pointed out, implementing a BAS solution was never meant to replace red teaming, purple teaming, or penetration testing within their security organization; instead, the goal was to allow them to significantly increase the scalability of all of those activities—not just in their corporate environment, but in the subsidiaries as well. As a result, they had the ability to evaluate their posture across all companies under the Humana umbrella. 

Nathan Collis Coelh, Senior Security Engineer at Experian, agreed that the ability of BAS to validate security controls in a continuous way allowed their security team to work more quickly, accurately, and efficiently, beyond the capabilities of traditional security testing. He noted that with BAS, “You don’t need to run a pen test every time you have a change in the firewall or any secure control.” 

Conveying the value of BAS to the organization

According to Vladlen Rotshteyn, Associate Manager of Information Security at Regeneron, the BAS rollout at Regeneron went beyond traditional IT. “Initially, we went with just the IT side of the house,” he explained. “We later expanded it to the OT [Operational Technology] side. It’s all the manufacturing equipment—and it’s a much more isolated environment.” He noted that SafeBreach allowed the team to identify gaps in their OT environment, where security was even more critical.

Putting together the right team

Because of the potential impact of implementing a BAS program, it wasn’t difficult for Humana to justify allocating a dedicated staff position to focus on BAS. They chose an individual who had development experience, as well as experience in operations security (OpSec) and “all things blue,” said Stroup.

The Experian team took a different approach. They were able to leverage the robust functionality of SafeBreach to expand the capabilities of existing team members. “We were able to take the technical leads for the blue team,” who had interest in red-team activities, said Nathan, and “turn them into a purple team through SafeBreach.” 

Since Regeneron had both IT and OT security folks using the platform, their team also looked different. Because their team is relatively small, Regeneron did not select a dedicated team member to manage their BAS program—instead, each team member plays multiple roles, many of which involve using the SafeBreach platform for a number of functions, including cloud security, reporting and metrics, and configuration drift. They were able to leverage SafeBreach-as-a-Service, a program that provides on-going strategy and support from SafeBreach experts, to get both their IT and OT team up and running with BAS. 

Keeping up with the changing threat landscape

For Garet at Humana, there has been plenty of access to strategic and operational threat intelligence that pertains to the organization, “but making that actionable has always been a challenge.” One of his team’s first big milestones after launching a BAS program was being able to create and test complex ransomware within their environment safely through SafeBreach.

Nathan at Experian noted that collaboration and communication with different teams is what allows their BAS program to be successful on this front. “It’s all about connection, right? It’s about communication with the different teams, what data you have, and how you can better access the environment using that data. So if you can interact with the stakeholders from the different teams, you can have the empowerment for that, which actually plays a key in this process.”

Experian takes it even further, leveraging SafeBreach’s API’s to develop our custom simulations from those CERT alerts and reporting back to their deputy CISO.

Tracking security posture and measuring success 

Like their colleagues at Regeneron, the team at Experian pays close attention to configuration drift when it comes to monitoring their security posture and the efficacy of their security programs. “We would like to identify if we are changing for the better, or if it’s worse after every change. And the changes are not just in our environment, the changes can come from the vendors, or the cloud…” 

Looking to the Future: BAS as the basis for a proactive cybersecurity or CTEM program

One key take away from this discussion is that BAS implementation can and should be as diverse and unique as the individual environment of the organization. What’s important is to understand the organization’s specific needs and goals, draw from the experience of others in this cutting edge space, and have the means to validate and clearly communicate the organization’s posture and risk to security and business leaders. 

Support from colleagues and leaders in the cybersecurity community continues to be one of the best ways to discover and enhance an organization’s approach to a BAS program. With proactive security becoming the industry standard, organizations need a solution that is flexible and robust, offers a support team that acts as a true partner, and has a robust community that can share insights to support growth and education. 

That’s the vision behind the SafeBreach Validate Summit—to create an event that regularly brings together experts in the security community to discuss challenges, best practices, and key considerations for building a proactive security program. SafeBreach’s next Validate Summit will be held on May 22, 2024, at The Star in Dallas—request your invitation to the event today.