Ethics of red team security testing questioned in new report

Research finds employees are far more likely to put up with red team testing if it's not conducted on themselves

Workers in areas like HR and finance are more likely than IT or security professionals to object to internal security testing, a report has found, raising serious ethical questions around how far security teams should go in their work.

The process of red team security testing on colleagues and fellow workers may lead an organisation to identify gaps or lapses in its cyber security hygiene, but such actions could have an adverse effect on staff morale, research has suggested.

There are wide differences in the moral interpretation of social engineering attacks between IT and non-IT employees, according to findings by researchers Tarah Wheeler and Roy Iverson. For example, non-tech workers, in areas such as HR and legal, are nine times more likely to object to receiving a phishing email than staff in security-related jobs.

These employees are also three times more likely to object to security workers impersonating VIPs, and four times more likely to object to the red team targeting receptionists to gain entry into an organisation.

The team surveyed more than 500 workers about their stance on the moral acceptability of conducting internal security tests and presented their findings at the Washington-based tech conference ShmooCon 2020.

The type of testing that respondents were questioned on ranged from sending threatening emails to inciting bribery, and even planting files on employees’ devices.

These measures may or may not comprise offensive red team testing routinely conducted by teams within or external to organisations. One prominent case of penetration testing, for example, arose last September when two individuals hired by a US-based courthouse were caught trying to physically break into its premises.

Despite many workers holding moral objections to elements of red team testing, the research also found that employees were generally more comfortable being on the orchestration side than on the receiving end.

In some cases, those on the receiving side of red team testing are approximately four-and-a-half times more likely to morally object to certain tests being conducted than if they were organising these tests.

“What we found was surprising and counterintuitive,” Wheeler and Iverson said in their research paper.

“Respondents (even professional security experts) were reportedly 450% more likely to be morally fine with conducting certain often-used tests on other people than they are with having tests run against themselves.”

Related Resource

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

The researchers added that the data collected allows them to start a discussion about the best practices with engaging in internal penetration testing within an organisation, and the impact of deceptive social engineering attacks on company morale.

Moreover, company boards should adopt a measured approach to overseeing cyber security policy in order to raise the overall level of hygiene among senior employees as well as across the wider workforce.

These measures include hearing a presentation about information security at least twice a year, demanding high-value targets like executives are within scope of testing and understanding the incentives for succeeding in compromising targets inside the company.

“Anecdotally, we have heard internal red teamers describing scoping for engagements that disinclude [sic] the most likely targets - executives,” Wheeler and Iverson added. “Because those same executives did not wish to have the potential interruption to their services that the discovery of poor security awareness would entail.

“This is unfortunate, as rapid, constant testing that perpetually integrates small changes leads to the strongest defence of any company.”

Featured Resources

Digital document processes in 2020: A spotlight on Western Europe

The shift from best practice to business necessity

Download now

Four security considerations for cloud migration

The good, the bad, and the ugly of cloud computing

Download now

VR leads the way in manufacturing

How VR is digitally transforming our world

Download now

Deeper than digital

Top-performing modern enterprises show why more perfect software is fundamental to success

Download now

Most Popular

The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

5 Oct 2020
iPhone 12 lineup official with A14 Bionic chip and 5G support
Mobile Phones

iPhone 12 lineup official with A14 Bionic chip and 5G support

13 Oct 2020
Google blocked record-breaking 2.5Tbps DDoS attack in 2017
Security

Google blocked record-breaking 2.5Tbps DDoS attack in 2017

19 Oct 2020