Red Team vs. Blue Team

Clearing the confusion between ‘offensive’ (red) and ‘defensive’ (blue) operations.

Do you keep hearing the terms ‘Red Team’ and ‘Blue Team’ quoted in the board room? Have you been asking yourself what they mean?

This blog aims to demystify these increasingly common C-level terms and how they apply to cybersecurity.

Red Team and Blue Team – explained

The term ‘Red Team’ has been adopted by the technology and cyber industry from the military world. The term is frequently used to describe offensive operations that involve a cyber team performing simulated ‘attacks’ against a target. These Red Teams primarily use computer-based cyber-attack techniques but can extend their portfolio of techniques to include physical attacks such as social engineering.

The term ‘Blue Team’ is the natural opposite and sees ‘defensive’ operations aligned to its use, with Blue Teams being charged with defending against the cyber-attacks induced by their counterpart Red Team members.

What is a Blue Team?

Every company, whatever its size or organisational structure, will already employ a form of Blue Team – it is likely that you simply don’t label it as such: For example, this could be a traditional and dedicated team such as a Security Operations Centre (SOC); the person in charge of IT; or even your office receptionist. The individuals, or teams, inside a company that act to form a defensive barrier to ‘attack’ are your organisation’s ‘Blue Team’ - even if they don’t realise it or have it on their job specs. They are responsible for defending your organisation from cyber-attack, social engineering attempts and malicious threat actors in general.

With this definition in mind, it will be immediately apparent as to how your organisation’s Blue Team needs to remain constantly watchful, alert and ready to respond should a simulated – or genuine – attack take place.

A well-tuned, and trained, Blue Team should be constantly looking for indicators of compromise (IoCs) and provided with the knowledge and real-world experiences to be able to keep one-step ahead of cyber threats.

The key to maintaining this level of alertness is to continually expose your Blue Team members to real world simulations of threats - by procuring a Red Team that can continually test and strengthen the Blue Team’s senses.

Why do you need a Red Team engagement?

Procuring a Red Team engagement is different from that of a traditional ‘Penetration Test.’ Unlike a pen test, a Red Team engagement tends to explore an organisation’s cyber risks with greater depth – but less breadth - than snapshot penetration testing.

By adopting this ‘pinpoint’ approach to attacks, a Red Team more closely mimics the approaches of genuine threat actors, such as state-sponsored groups and Advanced Persistent Threats (APTs).

A traditional Red Team engagement involves its members performing a simulated attack against the client organisation, usually a small and well-defined part of it. The area that is target is called the Red Team’s ‘scope’, or ‘criteria’, of engagement. This is normally discussed and agreed upon between the Red Team leader and client ahead of any simulated attacks commencing.

Be careful though – many organisations frequently offer ‘Red Teaming’ when in fact they simply deliver traditional snapshot penetration testing. It wouldn’t be the first time that marketing teams be accused of being over-zealous in the terms they choose to use to chase that next sale...

What does a Red Team target?

The Red Team perform ‘Red Teaming’ that typically targets some, or all, of the following:

· People – This could be your employed staff, contractors, or suppliers and would be driven using a methodology adopting ‘social engineering’ i.e. manipulating people to provide information or access, including credentials to systems.

· Processes – Certain aspects of your organisation’s processes or procedures are targeted and purposely invoked to trigger points of security vulnerability or weaknesses for the Red Team (attackers) to take advantage of. e.g. triggering a denial of access at a corporate site’s location to force a redundant one to be used that has a lower barrier to entry from a security perspective.

· Technology – Targeting your specific technology stack and its known – and ‘to be found’ zero-day cyber vulnerabilities. These attacks could be against Web Applications; APIs; Mobile Applications; and/or Network Infrastructure.

· Physical – Physical locations that an organisation relies upon to operate such as data centres, office buildings, distributions centres or even employees’ homes could targets for real-world attacks, and often form part of a Red Team’s scope.

The overarching focus should not be ‘what not to target’, but rather ‘what not to forget to target’. Think of a real-world attacker – your organisation is the target and as such is fully ‘in scope’ for them with them attempting multiple routes into your estate before fixating on a likely avenue to breach you. A strong and effective Red Team will uncover aspects of vulnerability well in advance of the reconnaissance that is typical from a genuine threat actor.

How often should I perform a Red Team engagement?

Constantly.

Some organisations are yet to have a Red Team engagement performed; others perform these once a year; CovertSwarm’s clients have them performed continually.

It is a mistake to believe that a smaller corporate ‘size’ reduces the need for you to employ a continual Red Team engagement: Every organisation, regardless of size and no-matter what they ‘do’, is a valuable target for cyber-attack by malicious threat actors.

Is it already likely that your organisation has been the victim of a cyber-attack, and has perhaps already been compromised – would you even know?

Ask whether your designated ‘Blue Team’ could answer this question for you?

How do you know you are ready and capable to defend against the constant real-world risk of cyber-attack, if you never simulated one as a ‘fire drill’ for your team?

How CovertSwarm can help

CovertSwarm is modernising legacy ‘point in time’ offensive security engagements: by operating and aligning our constant client focused cyber-attacks with the evolving techniques, practices and methods used by real threat actors.

We offer constant cyber-attack and are always watching on the look-out for new ways to compromise our client’s cyber security.

Our approach can provide a 365/24/7 view of your organisation’s security posture; and prove that your Blue Team are always ready to respond to genuine cyber risks and exploits.

CovertSwarm’s team of ethical hackers empower you with the insights and data to support strategic decision making to protect your people, processes, technology and physically locations and business health.

Get in touch today and have CovertSwarm revolutionise your cyber security.