Enter the gateway to complex enterprise attack scenarios with a new Lab: Orion

Entering a simulated enterprise scenario can often be a big leap for first-timers or junior members unfamiliar with pentesting and red team engagements.

This beginner-friendly condensed scenario of a small-sized corporate network is the ideal starting point for members seeking to gain familiarity with the tools and techniques needed to chart their course toward complex simulations. 

What waits in the Orion zone is a curated lab that serves as an indispensable bridge to more advanced Professional Labs, such as Genesis and Dante, providing a seamless transition from standalone labs to fully patched enterprise technologies. 

What is Orion?

Orion Ltd is a small enterprise looking to strengthen its security posture, and has tasked you with the important task of assessing its network perimeter and internal infrastructure by running a full penetration test. The mission of this scenario lab is to gain a foothold, unlock higher levels of control by elevating privileges, and move laterally, to reach the goal of domain admin by conquering all six flags.

As a bridge to mastery of key areas in dealing with real-world security misconfigurations, Orion ensures members have gained basic knowledge in:

• Enumeration

• Public Exploit Research

• Lateral Movement

• Privilege Escalation

• Pivoting

• Active Directory

A stepping stone to advanced upskilling practices

All you need to know to get started is:

• Basic knowledge of penetration testing tools.

• Basic understanding of Windows and Linux operating systems.

• Basic understanding of networking.

Experiencing Orion will offer a dynamic industry-connected simulation that is much more time-efficient than any other scenario, taking members through fundamental exploits and techniques that can be easily found in a company’s infrastructure.

Enterprise Platform members who have had experience with standalone Machines targeting a specific technology and vulnerability will have the opportunity to advance to handling more complex networks incorporating applications, services, and configurations that are used in the real world.

Set your team’s course

The “skills gap” persists as a critical topic within cybersecurity with 92% of cybersecurity professionals reporting skills gaps at their organization (2023 ISC2 Cybersecurity Workforce Study). Orion plays a key role in identifying gaps before engaging with more complex simulated exercises to further upskill and familiarize teams with relevant Techniques, Tools and Procedures (TTPs).

Leveraging Orion empowers cybersecurity teams to uncover and address hidden gaps, enabling a refined and comprehensive approach to members' skill development. 

Integrating theoretical knowledge with guided and hands-on exercises, through Academy for Business and Dedicated Labs, will facilitate bridging essential skills prior to further engagement with simulations. This ensures teams are well-equipped to confidently handle a range of on-premise labs and tackle diverse attack vectors, while having the opportunity to request guidance when needed.

Together with identifying key skills gaps, Orion plays a major role in ensuring streamlined and efficient technical onboarding of team members within Professional Labs. 

Teams can obtain the necessary skills to engage in real-life exercises. Meanwhile, new hires can more efficiently accelerate their familiarity with tools and processes and see a continuous and structured improvement of their capabilities. Here’s an example of how Easi utilised Professional Labs to decrease onboarding times by 40%.

Teams looking to take things a step further can utilize Orion to practice creating collaborative purple-minded exercises based on the completion of the lab, to discuss mitigation measures and strategies, building holistic cyber-readiness of teams.

What we’ve noticed is our red team is a little more advanced than our blue team. I believe that, at the moment, a lot of teams are at this stage—and it is very hard for them to train without having these dedicated environments. So, that is why they have more time to investigate and get a meeting to discuss their discoveries. It gives us time to explain how we (the red team) did something, and then reveal where blue teamers should be looking.

 

Mickey De Beats, Red Team CyberSecurity Consultant, Easi

Following the completion of Orion, team members can proceed to engage with scenarios covering similar penetration testing techniques such as Genesis, an enterprise-exclusive scenario incorporating a larger network and a wide range of OWASP Top 10 vulnerabilities with 31 total flags to conquer. 

Confident members can also engage with Dante and Offshore for more advanced penetration tester simulations.

How do I get my team on board?

Orion is available as part of the Professional Labs scenarios, coming with all business-exclusive features such as official write-ups, Restore Point, and MITRE ATT&CK mapping.

This new release is included in Professional and Ultimate pricing plans, which also offer teams the opportunity to integrate other HTB content and features into a comprehensive workforce development plan.

Ready to chart the network seas?

If your organization does not have access to Orion, contact our team to create a tailored workforce development plan based on the latest vulnerabilities and exploits.