The Cybersecurity and Infrastructure Security Agency (CISA) recently conducted simulated cyberattacks against two unnamed organizations, one in the government sector and one in the water sector, revealing significant differences in their defensive capabilities. While CISA's red team successfully gained initial access to both targets, the water sector organization quickly detected and mitigated the simulated intrusion, whereas the government organization failed to identify or respond to the activity.
CISA's red team initiated the attack on the government organization (referred to as Organization A) by sending phishing emails to an internal address, which led to initial access on multiple workstations. The attackers then escalated privileges to gain control over the domain and moved laterally to sensitive business systems and cloud resources, all without detection. Analysis of the organization's security operations center (SOC) revealed that personnel received numerous low- and medium-severity endpoint detection and response (EDR) alerts, including those triggered by the red team's activities, but did not act on them. The CISA report attributed this oversight to thousands of false positives, some of high severity, which obscured legitimate alerts, as well as organizational silos.
In contrast, the water sector organization (Organization B) demonstrated a more robust defense. The red team's initial access was achieved through a spearphishing campaign that convinced three users to click a malicious link, compromising their workstations. However, the organization's SOC quickly triaged the alerts and quarantined the affected systems within 2, 10, and 20 minutes, respectively.
Despite the initial detection, CISA's red team continued the simulation against Organization B using an "assume breach" model, where the organization's IT contacts, aware of the exercise, provided access to a host replicating the level of compromise the red team would have achieved if not detected. From this point, the red team escalated privileges and moved laterally to sensitive business systems, cloud resources, and a bastion host within the operational technology (OT) demilitarized zone (DMZ). Here again, defenders detected the activity and isolated the system, preventing further compromise.
Despite the differing outcomes, CISA identified common vulnerabilities in both organizations. Both underestimated cloud risks, lacked Conditional Access—a Microsoft security tool for workload identities—and did not have established processes for revoking compromised access or refreshing tokens.
CISA's public report on these red-team activities is a rare occurrence, following an advisory first published in 2023. The timing of this report is particularly relevant given recent heightened concerns about cyberattacks targeting water facilities across the United States and numerous government warnings regarding such threats. The agency did not disclose the names of the organizations involved in these voluntary, by-request assessments.
