3 ms·
If people are ignoring alerts because it might be the red team then surely when the red team breaks in... those people all look like idiots who can't keep their
by kiallmacinnes 8y ago
If people are ignoring alerts because it might be the red team then surely when the red team breaks in... those people all look like idiots who can't keep their systems secure?
If this is happening, then either the red team needs to be disbanded as nobody cares enough to warrant their existence... or the engineers ignoring the alerts need to be educated on the value of a red team.
- qaq 8y agoVery true I was not referring to SOC not reacting it's more things getting misinterpreted when things get escalated to higher ups if org is huge and structure is complex sometimes things get complicated. E.g. a company undergoing an external pen test and some real incident in the same time window using tools that a pen tester would use (e.g metasploit)