Assume breach: a test from the position of a compromised workstation or account

The test has two possible starting points. Either the tester gets access to one ordinary workstation on the network, as if somebody there had opened an attachment, or you hand over the credentials of an ordinary domain account without special privileges. Which one you start from depends on the scenario you want to check.

From there two things get measured: how far that position reaches and what stops the attacker. The tester tries privilege escalation and lateral movement, meaning progress from one machine to the next, and looks for a path to the data or to Domain Admin. The deliverable is a chain of steps from the starting position to the objective, not a list of open ports.

In English-language proposals the same scenario is often written assumed breach. It is the same brief, only a different form of the word.

Assume breach assumes a compromise as the starting point of a test and examines where an attacker would get from it. Compromise assessment is the opposite task: it establishes forensically whether a breach has already happened in your environment, and looks in it for traces of a real attacker.

The words are similar, the content isn’t. Assume breach is a test looking forward: we act as an attacker and measure what the defense withstands. Compromise assessment looks back and searches for what happened. This entry only draws the line. We don’t offer compromise assessment as a service.

It isn’t. Breach and attack simulation (BAS) is a category of automated tools that replay attack techniques against an environment by themselves and report what got through. Assume breach is a way of briefing a manual test that a person carries out.

The difference is in who performs the test and in what comes out of it. A BAS tool runs repeatedly and measures detection coverage against known techniques. A tester in assume breach also looks for paths no catalog of techniques knows, because they arise only from the specific configuration of your network.

As a penetration test, assume breach runs at full speed and the defense knows about it. The goal is to find as many paths from the handed-over position as possible and to describe what closes them: excessive privileges, shared passwords, badly configured delegation in the domain. This form is run as an internal test from the position of a compromised workstation.

As a red team operation it runs quietly and nobody in the defense knows about it, because what is measured is how long it takes them to notice the attack. That second form is held by a red team operation where the reaction of the defense is measured; we don’t go into the course of the operation here.

In the division of tests, assume breach is a question of the tester’s starting position, not of the subject or the level of knowledge. Where it sits among the other axes is shown by the division of tests by the tester’s starting position.