CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing
CISA conducted simultaneous red team assessments against two critical infrastructure organizations using identical tradecraft, revealing dramatically different defensive outcomes despite similar vulnerabilities. Organization A (Government Services) was fully compromised with zero detections due to alert fatigue, siloed SOCs, and poor operational processes. Organization B (Water/Wastewater) detected and contained initial access within 2-20 minutes, demonstrating that people and processes matter m
Analysis
TL;DR
- CISA conducted simultaneous red team assessments against two critical infrastructure organizations using identical tradecraft, revealing dramatically different defensive outcomes despite similar vulnerabilities.
- Organization A (Government Services) was fully compromised with zero detections due to alert fatigue, siloed SOCs, and poor operational processes.
- Organization B (Water/Wastewater) detected and contained initial access within 2-20 minutes, demonstrating that people and processes matter more than tools.
- Both organizations shared critical misconfigurations: default Machine Account Quota, misconfigured AD CS templates (ESC1), cleartext credentials, static cloud keys, and over-permissioned Entra ID applications.
- CISA's advisory AA26-237A "A Tale of Two SOCs" emphasizes that detection effectiveness depends on the operational framework supporting security tools.
Why It Matters
This case study provides a stark, real-world demonstration that security tooling alone cannot protect critical infrastructure—organizational processes, analyst training, and incident response procedures are equally critical. For AI and security practitioners, it underscores the importance of tuning detection systems to reduce false positives and ensuring SOC analysts have clear escalation paths and authority to act. The findings are directly applicable to any organization managing Active Directory, cloud identities, or operational technology environments.
Technical Details
- Initial Access Vector: Both organizations were targeted with phishing emails sent from internal addresses via a web application using default credentials for built-in accounts.
- Privilege Escalation: The red team exploited a default Machine Account Quota combined with a misconfigured AD CS certificate template (ESC1), enabling certificate requests for any user—a technique related to the Certighost domain-takeover exploit.
- Credential Access: Cleartext credentials were found in decrypted database configuration files and static AWS access keys configured to never expire, with no token revocation mechanism in place.
- Cloud Compromise: In Organization A, the team stole a Primary Refresh Token and abused over-permissioned Entra ID applications to read security team emails and assess detection awareness.
- Organization B Response: After initial phishing payloads were detected and workstations isolated within 2-20 minutes, CISA shifted to an assume-breach model, replicating access on a designated non-privileged host and confirming the same underlying vulnerabilities existed.
Industry Insight
- Alert Fatigue Is a Critical Vulnerability: Organization A's thousands of false-positive alerts from normal business operations drowned out genuine threats. Security teams must prioritize alert triage, implement noise-reduction strategies, and ensure high-severity ratings are reserved for truly critical events.
- Siloed Security Operations Undermine Defense: Multiple SOCs and endpoint tools with no shared visibility allowed the red team to operate undetected. Organizations should invest in unified security platforms and cross-SOC coordination to eliminate blind spots.
- People and Processes Outweigh Tooling: CISA's core finding—that the same tools produced different outcomes based on operational maturity—should drive investment in analyst training, clear escalation procedures, and defined authority for SOC teams to respond without bureaucratic delay.
Disclaimer: The above content is generated by AI and is for reference only.