Explanation concepts in Cyber Security
Red Team and Blue Team: Modern attacks have a variety of motives and are carried out by people and for-profit organized crime groups, and even by hacktivists seeking to attack organizations they deem immoral or contrary to the public interest. Regardless of the motive and the intruder, many attacks are now organized and carried out by specialized individuals with extensive funding and a plan to reinvest illegal profits in new technology and know-how.
The new landscape pushed the organizations into a struggle for continuous improvement and change of mentality because the cyber security plan and policy did not receive the support they needed from C-level or were simply insufficient.
This situation has led to two fundamental concepts in Cybersecurity, the Red Team, and the Blue Team. Essentially, these are two separate groups where, depending on the strategy and policy of a company or an organization, it sets the necessary roles and uses the technologies it chooses.
Red team
Security measures must be checked regularly by the companies. The team that performs a control process using aggressive actions is called a Red Team. It can be described as a service provided by an external entity/partner that has been called upon to monitor the effectiveness of the organization’s cyber security plan. This is achieved by simulating the behaviours and techniques of a malicious threat factor (MTA) in the most realistic way. The practice is similar, but not the same, as the Penetration Test involves pursuing specific goals.
Blue team
The Blue Group refers to the security group that defends the organization from real attackers and the Red Groups. It differs from the security management team (e.g., NGFW, Endpoint Protection, DLP, Antispam, Secure Web Gateway, etc.) as it has specialized tools and know-how, Incident detection and response, network & system architecture, event tracking and logging, operating system hardening, configuration management, repair, and more. It is organized in Network & Security Operations Centres (NOC & SOC) with SLA and appropriate procedures to be the primary and central defense of an organization in Cyber Security attacks.
Examples
Red: Pentester technician
Pentesters use offensive, commercially available attack tools to test the target or gather information from the target. They more often recognize configuration vulnerabilities than new software vulnerabilities. They think like black hat hackers but use hacking for a good cause. Pentester creates suggestions for other professional cybersecurity technicians on how to fix the vulnerabilities they identify.
Red: Member of a red team
The members of the red team are testers with a wide range of skills, from conventional pentesting to bypassing physical controls and using social engineering methods. These professionals work in a team that has a diverse set of skills. The members of the red team try creative combinations of defense to identify new weaknesses.
Members of the red and blue team
Blue: Computer / Cybersecurity Architect
Security architects design and implement structures for IT services similarly to architects in the construction industry. The security architects design a system for networks, security-related services, and even what services are outsourced if not provided internally. Security architects take into account how each user and device account is identified or authorized (IAM) and how different incidents are recorded. A security architect may focus on a specific area (such as IAM, network, or cloud services) or look at the architecture of the entire business.
Blue: SOC Professional / Analyst
Operational Security Centre (SOC) is a function where an organization centrally monitors most logs and incidents in its IT environment. SOC has special tools and services that collect and associate many entries in logs or incidents triggered by defined rules.
The SOC Analyst is responsible for creating and developing a set of rules using the above tools to detect suspicious incidents and initiates the investigation process if necessary. These “emergency responders” (called Level 1) often operate 24/7/365. SOC analysts can escalate the most challenging Level 2 investigations available to more experienced digital forensics professionals: the art of detecting electronic evidence of a potential breach ensures.
There is a purple group between the red and the blue group in many cases. The role of the purple group is less known but just as important as the other groups. The purple team usually consists of highly qualified staff who take on tasks that exist in both red and blue. That is, the purple team assumes duties of offensive and defensive content. They usually function as an external group in an organization. However, in ideal cases, an organization can create its purple team.
