Hi everybody.
This particular video is about the blue the more detailed about the blue team.
So the blue team in a nutshell is able to identify detect respond to almost any threat that the organization
faces from a insider or outsider based attack.
They handle all security related issues around breaches compromises access control failures so anything
that can throw a security based alert that needs to be investigated is handled by this team.
In most cases they operate 24/7.
And this is normally accomplished by having multiple groups in different time zones to cover all bases.
Alternate names to this which you may have heard of before is search which is a security incident response
team and soc which is a security operation center.
So normally the blue team kind of covers those two core names.
So in an organization you're probably going to see them related as Sirte or SOC.
But in this particular case they are also covered also called the blue team as well lose for the defensive
side.
So why are they needed so they bring real time protection to the organization.
Like I said before they they're the first line of defense for internal and external threat.
They're able to contain and analyze and mitigate threats to an organization whether that be new malware
that comes out current malware detecting malicious executable is that have been ran.
They also handle the antivirus what it scans static analysis on malware as well.
And in some cases depending on the compliance requirements that you have as an organization a blue team
is required.
And the customers SLA which is a service level agreements that you that the organization and customer
signed together for notifications of breaches or having issues patched within a certain amount of days
for high critical criticality issues you might be looking at three or two days to respond and patch
things up.
So based on that it it can.
It's very important that the blue team is present for those type of situations.
So it's a yes and no.
Similar to red team as if they're required.
So for smaller organizations that may not have a lot of compliance requirements or they're smaller and
they're small enough organization to wear one or two people could probably handle a lot of the alerting
normally this can fall on top of the the network administrator or the systems administrator.
Normally the red team are in smaller organizations does not handle this but it's entirely possible that
that individual might be responsible for that side of the fence as well.
But in large organizations it is most definitely required.
It's like I said before there's too many moving parts.
It has to be it has to be there.
There's just too much work.
And the response side of the house that Red Team and system administrators just can't handle.
And a lot of the times a lot of the in-depth stuff that the blue team does is this is this is a special
skill set just like red team is.
So it's different skill set.
There is overlap however in most cases there is a fine distinction between the two so the team structure
really does vary depending on organization and the size of the organization.
Now what we're looking at here is an average per site.
So as I said in the red team video there there may be a senior manager a director of V.P. an executive
that sits over top of this.
That might be included under the blue team.
However in most cases there's normally a single manager per site two or three leads per site for a mid
level as well per site.
And then the entry level is where things get unique.
So there's different design aspects of a blue team.
And depending on who you talk to it might be a better approach.
So a lot of organizations tend to use rotation on contractors so they may have five or 10 different
contractors that need to be on rotation.
So they will start off for a year and then after their contract is up they either renew it or give them
full time offer or let them go.
So that allows a rotation of talent to come through as well as get people the experience to kind of
get into the security field that might not have been able to before this part is important because a
lot of these people tend to move up pretty quickly inside the organization.
So an A.
And with that skill set they there's even good possibilities that they can move to Red team since they
work so closely as we talk.
We'll talk about later that Red team blue team do share knowledge pretty frequently through Team trainings
and role swaps.
So we'll talk about that in a later video in the course.
But just keep in mind that the blue team is a much larger team with a lot more security analysts in
play to kind of handle a lot of the day to day activities.