Episode 212: The CIS Red Team — Testing via Collaboration
In episode 212 of Cybersecurity Where You Are, Sean Atkinson speaks with Will Knebel, Sr. Penetration Tester at the Center for Internet Security® (CIS®), and Chris Eufemia, Penetration Tester II at CIS. From pushing vulnerabilities as far as possible to tailoring the language of engagement outcomes, they break down how the CIS Red Team (CRT) relies on collaboration to support its clients in strengthening their cybersecurity posture.
Here are some highlights from our episode:
- 00:30. The unconventional paths that led Will and Chris to red teaming at CIS
- 03:42. Two surprises from supporting the public sector with red team engagements
- 06:33. How diversity in the U.S. public sector leads entities to approach cybersecurity differently
- 08:30. CRT's commitment to helping clients understand underlying solutions
- 09:25. Ongoing collaboration with teams who support CIS's security best practices
- 11:38. The most common mishap in engagements and how it creates a false sense of security
- 16:16. Pushing vulnerabilities as far as possible, a real example, and capturing this in reports
- 20:23. A lesson from SANS: Using AI to uncover patterns that unlock more testing vectors
- 22:22. CRT's testing within CIS and why an understanding of consequences is vital
- 22:48. Dedication to education: The importance of teachable moments and skills building
- 29:45. Physical penetration testing: Examining whether someone could get into a facility
- 33:20. Tailoring an engagement's outcomes to technical and non-technical audiences alike
- 35:40. The rise of testing AI elements directly through red teaming
- 36:54. How CRT continues to adapt to keep up with attackers
Resources
- Multi-State Information Sharing and Analysis Center®
- CIS Red Team
- Episode 201: The Evolution and AI Enablement of Pentesting
- CIS Cyber Threat Intelligence Team
- Episode 210: The CIS SOC — Keeping Security Operations Human
- CIS Services®
- CIS Critical Security Controls®
- CIS Benchmarks® List
- Exploited Protocols: Remote Desktop Protocol (RDP)
- Commonly Exploited Protocols: Server Message Block (SMB)
If you have some feedback or an idea for an upcoming episode of Cybersecurity Where You Are, let us know by emailing [email protected].
As of June 23, 2025, the MS-ISAC has introduced a fee-based membership. Any potential reference to no-cost MS-ISAC services no longer applies.
