| Red teaming is the practice of rigorously challenging plans, policies, systems and assumptions by adopting an adversarial approach. The purpose of red teaming is to countermand cognitive errors that impair critical thinking such as group think and confirmation bias. In the enterprise, a red team may be either a contracted external third party or an internal group whose existence has not been shared with employees. Red teaming as a formal discipline originated with the military and intelligence agencies. The North Atlantic Treaty Organization (NATO) handbook defines red teaming as the art of applying critical thinking from a variety of perspectives to challenge assumptions and explore alternative outcomes. Its earliest implementation in the enterprise was in security, where ethical hacking and pen testing are two common examples of using contrarian thinking as part of an organization?s strategic planning process. A properly conducted red team exercise extends further than simply identifying gaps in security practices and controls. Instead, it determines how an organization is equipped to deal with real-world attacks. For example, results can be used to engage a board of directors to get further investment in security defenses and staff security awareness training. Red team testing vs. pen testing Red team exercises generally start with passive reconnaissance and open source intelligence gathering, using publicly available data such as social media postings and online searches to identify individuals to target within the organization. While a penetration test usually relies upon the company providing relevant information such as the IP addresses to scan or the necessary credentials to access an application, a red team starts from the same position as a real attacker ? from inside or out of the organization. Red team exercises also take place without the knowledge of most personnel at the target organization. The legal implications of a red team are much the same as for a penetration test. This means the attack team could potentially be in contravention of the Computer Misuse Act, and the Data Protection Act (DPA) could come into play where access to data is concerned. Provision of the relevant authorization avoids the former, and if the security company conforms to standards such as ISO27001 and ISO9001, DPA issues can be avoided. Principles of red teaming In 2015, Bryce Hoffman became the first civilian to graduate from the U.S. Army?s Red Team Leader Program at the University of Foreign Military and Cultural Studies at Fort Leavenworth, Kansas. In his 2017 book, Red Teaming: How Your Business Can Conquer the Competition by Challenging Everything, Hoffman recommends a few exercises that can help a red team gain a fresh perspective: Be your own worst enemy - a role-playing exercise in which red team members assume the role of a competitor trying to gain a competitive advantage. Devil's advocacy - a role playing exercise that requires red team members to take a belief central to an organization's strategy and develop a compelling case for the opposite. Think-Write-Share - everyone on the team thinks about the problem and writes down their ideas before sharing them with others. The goal of this exercise is to avoid groupthink and encourage people to value their individual perspectives.
| 
Posts
1 comment:
Very informative blog. This blog share complete information on red team exercise. Red team exercise is not an alternative to traditional testing, but it is a very valuable additional activity.
Post a Comment