Training for Cohesion: How Team Dynamics Improve Penetration Testing

Today I want to discuss team dynamics and some trends that I have seen over the last 18 years of running around the world performing engagements, audits and training.

When you imagine a professional team of any trade, where each teammate is experienced and the team itself operates like a well oiled machine, you probably have an idea of all the training and exercises that went into forming that team. The countless hours where each team member was practicing a skill and then the team came together to run through scenarios and practice operating together.

Unfortunately, when it comes to physical penetration testing this is not the norm. Instead what often happens is a single teammate, usually the team lead, has practiced and studied various skills but likely has little experience on real world engagements. The rest of his team usually has an extreme interest in the field but almost zero training or experience.

This often means that several big mistakes are about to take place during a physical pentest:

1. The juniors will get all of their training on a live engagement

2. The team lead will get his leadership training on a live engagement

3. The team itself will get its team dynamics training on a live engagement

All of which allows for a slim margin of error. If you want to be able to do repeated business with your client and have that client tell others about your excellent work, than you have to actually do excellent work. Meaning, covertly compromise a target building and accomplish any goals set out by yourself and the client.

To maximize your chance of success, you need to train and practice all of the above things BEFORE engagements.

For individual training, I highly recommend running a physical pentesting audit on your own office or building. You can read more about this concept and how it helps train your team to prepare for physical engagements here.

Quick disclaimer, I this info is for educational purposes only and to help legal pentesters better their craft.

The Necessity of Comprehensive Team Training

To avoid pitfalls, it is essential to train every member of the black team thoroughly. This training should not only cover the technical aspects of penetration testing but also focus on team dynamics. Here are some key areas to address: