Thoughts on Preparing for Adversary Exercises

Translation Notice
This article was originally written in Chinese and translated into English with the assistance of AI. The translation has been reviewed and edited for clarity, accuracy, and readability. Please refer to the original source where necessary, especially for technical terms, commands, configuration details, and proper nouns.

In recent years, cybersecurity adversary exercises in China have become routine, institutionalized, and larger in scale. Their frequency and scope continue to expand, driven by stronger national attention to cybersecurity and data-security governance and by faster legal development. Laws such as the Cybersecurity Law and Data Security Law have raised practical protection requirements and compliance responsibilities to an unprecedented level.
Against this backdrop, thorough preparation is no longer an optional enhancement. It is a legal responsibility for organizations and enterprises, as well as a foundation for stable business continuity. This article offers an initial discussion of how to prepare more effectively.

Security-Device Selection and Deployment#

Under the practical requirements of adversary exercises, selecting and deploying security devices is foundational to building an effective defensive environment. Configuration should reflect the organization’s scale, risk tolerance, compliance requirements, and budget. The following are typical configurations for different protection needs:

Protection level	Core equipment	Budget	Use case
Minimum	Next-generation firewall (NGFW)	💰	Small or medium organizations with few systems and low risk. NGFW provides basic access control, stateful inspection, application identification, and simple web protection.
Standard	NGFW + network-traffic analysis probe	💰💰	Recommended baseline. The NGFW protects the perimeter; the probe mirrors traffic for visibility and deep analysis, while the situational-awareness platform centralizes monitoring, correlation, and alerting.
Advanced	NGFW + traffic probe + intrusion prevention system (IPS)	💰💰💰	Focused protection for critical business areas or high-value assets. IPS provides deep inspection and real-time blocking for known vulnerabilities and techniques, creating defense in depth with the NGFW.
Comprehensive	NGFW + traffic probe + IPS + web-behavior management + endpoint detection and response (EDR)	💰💰💰💰💰	Large organizations or high-risk industries. Integrates perimeter protection, internal monitoring, application defense, endpoint security, and user auditing across cloud, network, edge, and endpoints.

Focus on Core Protection#

1. A Practical Choice for Small Environments#

For small organizations with limited systems and resources, effective protection during an exercise does not require piling up devices. The core recommendation is to deploy one NGFW with comprehensive capabilities. Modern NGFWs integrate many functions formerly provided by standalone devices, such as:

User web-behavior management: audit and control internal network activity.
Web-application protection: defend against SQL injection, XSS, command execution, and other common threats.
Encrypted-tunnel identification and control: detect and control encrypted or concealed channels such as VPNs and proxies.

2. The Value of Standard Configuration: Traffic Probe + Situational-Awareness Platform#

For standard protection, we strongly recommend deploying a traffic probe at a key network location, usually the core switching area, and connecting it to a centralized situational-awareness platform. Its value includes:

Network-wide visibility beyond the perimeter: the probe captures traffic through mirroring or optical splitting, providing a “god’s-eye view” of anomalous activity that perimeter NGFW logs alone cannot provide.

Defense-in-depth reinforcement: although NGFWs include some IPS functions, their main focus is the perimeter. IPS devices are usually deployed before critical business areas to inspect and block known attacks, forming a second internal line of defense. Traffic probes cover a broader area and are not tied to one location.

Objective endpoint-protection assessment: free endpoint-security software can provide basic malware protection, but often lacks centralized management, advanced threat detection such as EDR, and automated response. Professional EDR provides deep endpoint monitoring, threat hunting, automated containment and remediation, and unified policy management, significantly improving defense against APT and zero-day attacks. A traffic probe independently captures lateral movement, C&C communication, and data theft at the network layer even when endpoint defenses are bypassed, providing key attack-chain evidence.

The power of situational awareness: full-traffic metadata and deep-packet analysis from probes, combined with NGFW and IPS logs, are aggregated into one platform. Through big-data correlation, attack-chain modeling, and threat-intelligence integration, it provides:

Real-time awareness and visualization of network-wide threats.
Accurate identification of complex, multi-stage attacks.
Alerts with context including source, target, path, and technique.
Drive efficient response: security operators can quickly investigate and handle incidents using platform alerts and context. In an architecture with API integration, the platform can trigger automated actions such as immediately blocking an attacker’s IP on the NGFW.

Routine Security Strategy: Put Defense on “Automatic”#

As adversary exercises become routine and larger in scale, attackers’ old methods have changed little: credential stuffing with weak passwords and exploitation of unpatched legacy vulnerabilities (N-Day) remain their entry points. Script kiddies also use scanners and automation to bombard targets with PoCs. If security devices are still in “spectator mode” because policies are disabled or misconfigured, attackers may get lucky.

Honestly, I have seen many security devices configured with grand policies such as “any to any permit” (allow all traffic). That is not protection; it is a VIP lane for attackers. Compliance is the baseline, but vendors should at least configure and enable high-risk blocking rules before delivery. At minimum, traffic from the untrust zone to the trust zone must be denied.

🛡️ Strategy 1: Turn On the NGFW IPS Switch#

As noted earlier, modern NGFWs integrate functions once provided by standalone devices, including IPS. The problem is that IPS policies on many devices are either disabled or effectively meaningless.

Enable IPS protection on every traffic policy passing through the firewall. It is the first effective layer of automated defense using existing equipment and can block many known exploits and malicious scans. Make the device work instead of leaving it idle.

🚫 Strategy 2: Block High-Risk Ports Without Hesitation#

In theory, opening any port increases risk—it gives attackers another opportunity. But services need ports to be reachable, which creates a genuine “security paradox.”

Minimize exposure: for externally accessible services, the best approach is to open ports only when needed. Use an allowlist (permitting only specific trusted source IPs) instead of a blacklist whenever possible, and restrict the source range instead of using 0.0.0.0/0 (open to the entire world). This is precise access control.

High-risk port blacklist: some ports have a notorious reputation and are natural favorites among attackers. Unless they are required by the business and thoroughly hardened, it is strongly recommended to configure perimeter-firewall policies that reject inbound connections to them. Below are some typical “high-risk offenders” (this is not a complete list; adjust it for your own environment):

Port	Service
20-21	FTP
22	SSH
23	Telnet
25	SMTP
69	TFTP
135-139	RPC
161-162	SNMP
445	SMB
3389	RDP
5900-5904	VNC
6379	Redis
7001	WebLogic
8848	Nacos

PS: Apply blocking policies on the perimeter firewall to keep threats outside. Internal access-control ACLs provide another layer of protection.

🚫 Strategy 3: Put Roadblocks in the Way of DNSLog Probing#

When probing targets and validating vulnerabilities—especially those requiring out-of-band communication—attackers often use public DNSLog services. Their tools typically cast a wide net: if even one target calls back to the DNSLog server, the attempt is considered successful.

What can we do? On perimeter devices, configure domain-filtering rules to prevent internal hosts from querying public, commonly used DNSLog service domains and their subdomains. In simple terms, add the domain suffixes of these “well-known” DNSLog services (such as *.dnslog.cn and *.burpcollaborator.net) to a blacklist and block resolution.

Why emphasize perimeter devices? This prevents internal users—or compromised hosts—from bypassing internal DNS blocking policies by changing their local DNS settings, such as switching to 8.8.8.8.

This can significantly reduce the risk of being picked up by public automated tools and serves as a practical noise-reduction measure. BUT attackers can build their own DNSLog servers with constantly changing domains, which this approach cannot stop. It is therefore only a mitigation, not a final solution. The core defenses remain IPS, port controls, and timely vulnerability remediation.

Music