Red Teaming Introduction
In one sentence if i say :
What is red teaming :
Red Teaming is a full-scope, multi-layered attack simulation designed to measure how well a company’s people and networks, applications and physical security controls can withstand an attack from a real-life adversary.
Say what?
To put red teaming in layman’s terms, it’s either a independent team or normal team which just simulates the attack under limited scope
Where does it come from :
The origins of Red Teams are military in origin. It was realised that to better defend there was a need to attack your own defences to find weak points that could then be defended better. This morphed into “War Games” where defenders or friendly forces were denoted as BLUE and the opposing forces were RED.
Red Teaming was seen as a useful toolfor generals to evaluate their security posture, Red Team therefore took on the role of the aggressors or “bad guys”. The bad guys do not follow the rules but utilized in a controlled way simulating and emulating what the bad guys can do, Red Teaming serves to help the defenders spot, respond and stop attacks as well as strengthen and improve.
Moving forwards to the information security realm, first and foremost, despite their “offensive” nature, Red Team are defenders. They are also a tool to allow organisations to better defend from hostile aggressors, learn and improve.
Red Teams are proactive, will simulate real attackers and will attempt to penetrate defences undetected. Their role is to highlight holes in defences and to improve detection capabilities for Blue Team.
Ok fine what is difference b/w red teaming and regular PT :
there are many explanations about it , I would like to quote from rapid7 blog which explains things pretty clear.
Consider Penetration Testers are pirates and Red Teams are ninjas,Is one better than the other? Often Penetration Testers and Red Teams are the same people, using different methods and techniques for different assessments. The true answer in Penetration Test vs. Red Team is just like pirates vs. ninjas; one is not necessarily better than the other. Each is useful in certain situations. You would not want to use pirates to perform stealth operations and you would not want to use ninjas to sail the seas looking for treasure. Similarly, you would not want to use a Penetration Test to judge how well your incident response is and you would not want to perform a Red Team assessment to discover vulnerabilities.
Hope u got the conclusion of what is red teaming and how it differs from normal behavior.Thanks.
Attack is the secret of
defence; defence is the planning of an attack
What is red teaming :
Red Teaming is a full-scope, multi-layered attack simulation designed to measure how well a company’s people and networks, applications and physical security controls can withstand an attack from a real-life adversary.
Say what?
To put red teaming in layman’s terms, it’s either a independent team or normal team which just simulates the attack under limited scope
Where does it come from :
The origins of Red Teams are military in origin. It was realised that to better defend there was a need to attack your own defences to find weak points that could then be defended better. This morphed into “War Games” where defenders or friendly forces were denoted as BLUE and the opposing forces were RED.
Red Teaming was seen as a useful toolfor generals to evaluate their security posture, Red Team therefore took on the role of the aggressors or “bad guys”. The bad guys do not follow the rules but utilized in a controlled way simulating and emulating what the bad guys can do, Red Teaming serves to help the defenders spot, respond and stop attacks as well as strengthen and improve.
Moving forwards to the information security realm, first and foremost, despite their “offensive” nature, Red Team are defenders. They are also a tool to allow organisations to better defend from hostile aggressors, learn and improve.
Red Teams are proactive, will simulate real attackers and will attempt to penetrate defences undetected. Their role is to highlight holes in defences and to improve detection capabilities for Blue Team.
Ok fine what is difference b/w red teaming and regular PT :
there are many explanations about it , I would like to quote from rapid7 blog which explains things pretty clear.
Consider Penetration Testers are pirates and Red Teams are ninjas,Is one better than the other? Often Penetration Testers and Red Teams are the same people, using different methods and techniques for different assessments. The true answer in Penetration Test vs. Red Team is just like pirates vs. ninjas; one is not necessarily better than the other. Each is useful in certain situations. You would not want to use pirates to perform stealth operations and you would not want to use ninjas to sail the seas looking for treasure. Similarly, you would not want to use a Penetration Test to judge how well your incident response is and you would not want to perform a Red Team assessment to discover vulnerabilities.
Ninjas |
|
|---|---|
Strengths |
Weaknesses |
| Fast | No Armor |
| Stealthy | Small |
| Dedicated to Training | |
Pirates |
|
|---|---|
Strengths |
Weaknesses |
| Strong | Loud |
| Brute-Force Attack | Drunk (Some say this could be a strength too) |
| Great at Plundering | Can be Careless |
| Long-Range Combat | |
Hope u got the conclusion of what is red teaming and how it differs from normal behavior.Thanks.
Comments
Post a Comment