Hi everyone.
I'm Chris.
And welcome back to my course on Enterprise Security fundamentals.
In this lesson we are going to discuss about the concept of red team vs. Blue Team exercises.
So first of all let's get an overview of the topic.
Red team versus Blue Team exercises involve the simulation of an attack against an organization's information
systems.
The red team simulates and in some cases performs.
Proof of Concept steps taken in the attack against the organization's I.T. systems.
The blue team simulates the response to that attack.
The adversarial approach not only allows for the identification of security vulnerabilities in the way
that the organization systems are configured but also allows members of the organizations information
systems staff to learn how to detect and respond to attacks.
The first concept is the red team at a high level.
The red team plays the role of an attacker against an organization.
Red teams can consist of people inside the organization an external penetration testing team or a mix
of both a red team exercise often involves proof of concept demonstration that the vulnerabilities that
they have found are practically rather than theoretically exploitable.
For example proving domain dominance by creating accounts that are members of the domain admin groups
in an active directory environment or showing control of an individual machine by creating an account
with local administrative privileges on a standalone system when defining the objectives of the exercise.
It is important to clearly define as to what accounts as the red team victory rather than allowing ambiguity
about whether vulnerabilities exist when performing the postmortem exercise
the next contest is the Blue Team well the blue team played the role of your existing information security
and I.T. administration staff.
The aim of the red team vs. Blue Team exercises is both to determine if vulnerabilities are present
in the existing security configuration but as well as to train the organizational staff how to detect
and respond to this attacks against the organizational I.T. infrastructure.
You'll learn more about the role of the blue team and how to construct an effective blue team.
In the next section as a part of your ongoing security preparations you should rotate members of the
staff between the red team and the blue team when conducting subsequent exercises.
This basically allows your staff to learn develop and appreciate both the attacker and the defender
mindsets
let's talk about the exercise structure initial exercises should be white boarded as a role playing
exercise.
This allows both the red team and the blue teams to develop good understanding of the parameters of
the exercise without restricting without a strict understanding of the parameters of the exercise.
The red team and the blue team exercises can quickly like spiral out of Scoop later.
Exercises should move beyond white boarding and roleplaying to practical proof of concept.
In this latter phases the red team's activities should never place in the information systems of the
target organization to risk a red team shouldn't need to deploy Queen mining software for example on
domain control to demonstrate that the domain controller is vulnerable to attack.
There are other less deleterious ways of making this point such as installing the harmless application
on the server installing the harmless application demonstrates the ability of an attacker to install
software on a sensitive server which is all that the red team needs to accomplish without going to the
point of having every domain controller running.
Let's see coin mining software and that makes perfect sense.
The overarching aim of the red team is to provide a proof of concept that the organization is vulnerable
to a specific type of attack.
The overarching aim of the blue team on the opposite side is to be able to detect and respond to that
attack in an effective manner
management approval.
It is critical and I repeat myself.
It is critical that management be kept informed of the red team vs. Blue Team exercises especially when
those exercises move beyond the role playing and white boarding too.
Taking actions that directly impact the infrastructure for example it is possible that the infrastructure
functionality might be disrupted by the exercise.
Management should approve of the exercise goals and of course be made aware of what achieving those
goals means in terms of the modification to existing information systems.
Management should also be involved when engaging red teams that are external to the organization and
penetration testing exercises
and finally let's talk about internal versus external red teams.
When initially working on your organization's security configuration and incident response strategies
you might choose to start with internal red team and blue teams.
You could continue to run exercises pitting a red team against blue team until a point is reached where
the security configuration of the organization is at a level where it is beneficial to subject it to
a professional penetration testing that dumped it's likely that until several red team versus Blue Team
exercises have been run there will be obvious and potentially embarrassing holes in the existing security
configuration.
A disadvantage of having members of the red team be exclusively from within the organization is that
they will bring some of the organization's assumptions with them outsiders on the other hand bring their
own assumptions and systems that a member of the organization from the red team might believe to be
secure that they are on assessable.
Mm may have faults that are obvious and exploitable for someone.
For example approaching those systems from outside the organizational mindset as reputable professional
penetration testers will have extensive experience and knowledge.
They are likely to find vulnerabilities that might not be apparent to security engineers who haven't
explicitly specialized in organizational penetration.
As a Red Team versus Blue Team exercises should be ongoing.
Many organizational maybe use internal teams for most exercises but treating with occasional exercises
where the red team is made up of professional penetration testers who specialize in this type of exercise.
This allows for the organization's security configuration to be periodically exposed to people that
aren't inculcated in the organizational security culture.
I will see you in the next lesson.
I hope this has been informative for you.
And thank you for watching.