7 ms·
This happens in many corporations as well. It's fun and exciting to be on the red-team (doing the penetration testing, writing exploits, etc) but the blue team
by LinuxBender 6y ago
This happens in many corporations as well. It's fun and exciting to be on the red-team (doing the penetration testing, writing exploits, etc) but the blue team (infrastructure teams and developer teams hardening things) is not only boring to most, but it's also the team that gets the most grief from developers for inducing friction. If your company has a red team, ask how big the blue team is and if they have the same freedom to develop and implement mitigating controls as the red team has to exploit things.
Hacker competitions mirror this. Red teams are allowed to bring in any exploits and do just about anything (as criminals would be expected to do) and the blue team are stifled by bureaucracy and not allowed to bring in anything.
- willcipriano 6y agoHacker competitions often seem very contrived to me. I suspect that in order for the red team to make any progress you have to tie the blue teams hands behind their backs. Most of what I see from the penetration testing community is pretty gimmicky and situational generally and often doesn't take into account the attackers risk/reward ratio.
- LinuxBender 6y agoI agree completely. I see it as entertainment and a way to recruit people out of college.
- AnHonestComment 6y agoWhat would be a less gimmicky setup?
- olivierduval 6y agoAllowing Blue Team to fight back maybe? Or to be able to actively track the red team instead, using an active defense, instead of only passive defense? Moreover, the outcomes are different for both teams: - RedTeam success => they are seen as "real" hackers/heros and the BlueTeam are the poor incompetent - RedTeam fail => the BlueTeam did "only" its job, the investments in cybersec for the company paid off... so the budget for the cybersec can be reduced. So, for RedTeam, it's either a win or a tie. And for BlueTeam it's either a tie or a loss... If the BlueTeam could fight back, maybe this could change...
- willcipriano 6y agoThat's good. Perhaps something like if they can attribute the attack to a particular machine the red team gets "arrested".
- DaiPlusPlus 6y agoDo the feds still attend DC? >:}
- birdyrooster 6y agoNo and they don’t come because hackers asked them not to. >:/
- Shared404 6y agoFound the Fed.
- Bnshsysjab 6y agoEasier said than done, the red team can’t break real laws (routing through compromised hosts) where real hackers will.
- mindslight 6y agoIt's inherent to the field. A successful blue team is a distributed win - every line of code did what it was supposed to do. A successful red team is a concentrated win, for the people who found the few lines of code that did something else. The job of a red team is to make things interesting. The job of a blue team is to keep things boring.
- close04 6y agoThat's true but only because it mimics real life. The defenders are always at a disadvantage here, they have the boring job but one where one mistake is one too many. And they have to achieve that perfect score while operating within the rules. On the other side the attackers have the more exciting job and only need one success which they can achieve by using whatever means they see fit. You'll see this outside of IT just as well, like in sports. Goalkeepers (defenders) vs. strikers come to mind but at least there they all operate within the same set of rules.
- deleted 6y ago[deleted]
- LinuxBender 6y agoLet the non-red teams use pre-existing scripts, code, etc, to harden things. This of course would make the competition a level playing field and would make it much less fun for the red team. Attendance would drop off quickly and companies would no longer sponsor these events, as the primary purpose is to recruit people out of college.
- olivierduval 6y agoActually, this could be made like "CS:GO" competition: - RT is the terro - BT is the AT The RT has to "plant" an exploit. The BT can either block/track the RT or "diffuse" (find/disable) the exploit. The "maps" would be the kind of system: - an AD behind a firewall - a WebServer with datas to extract from a backend DB - and so... The sponsors could sell either the skills of their pen-testers to hire, or their solution to secure a system, so it might be a good maketing campaing for the winner...
- count 6y agoI can't tell if you're being facetious, but you just invented 'capture the flag' competitions.
- deleted 6y ago[deleted]
- badrabbit 6y agoI disagree completely. Red team tools and techniques are different and gimmicky for a reason, their goal is to demonstrate lack of or effectiveness of security controls and processes. While bad guys have more time and more precise target. For example, 0days and disruptive actions are mostly prohibited for red teamers
- badrabbit 6y agoThat's why "purple team" is the way (not sarcasm for people not aware of purple team methodology)
- thephyber 6y agoAnother, related paradox is that in corporate org structures, the CIO is responsible for making sure the company's systems are available and working correctly, but the CISO is responsible for securing systems. Departments of CIOs can frequently be seen as a profit center which unlocks potential for the company while CISOs are almost always seen as a cost center which (ostensibly) slows the potential of the company. This also contributes to perverted incentives (like the red/blue teams) where the CIO frequently gets their way and is more likely to get budget while CISOs take all the blame when their budget increase requests get declined and IT is tasked with keeping unpatched systems up and stable rather than patching systems quickly. Obviously, the best orgs find a way to get both done, but resources are always scarce for the rest of us.
- jtdev 6y agoI left a high pay info-sec position at a large insurance corporation for this very reason. CIO trumped CISO (fractional) on literally every security issue that was surfaced - and worse yet the CIO and CEO refused to acknowledge the risk being onboarded/ignored. The irony of insurance execs refusing to acknowledge information security risk was just too much.
- thephyber 6y agoStrange. I can imagine the average corp board member underestimating the risk accumulated by consistently ignoring CISO request for more cybersecurity investments, but the insurance industry is used to dealing with the low-frequency, high-impact payouts. Do you think it was mis-communication, ignorance, greed, hubris, or something else?
- jtdev 6y agoAll of the above.
- jcims 6y agoI've been in infosec since the 90's. A lot of times I think this is on us. As much as I respect the technical acumen and creativity of my colleagues in the industry, I don't think we broadly understand risk that well and as a consequence we do a pretty bad job of communicating it. We tend to peg the panic meter with multiplied likelihoods and catastrophized impacts of possible scenarios while directly causing revenue losses by adding sometimes insane amounts of friction to the product delivery process. That's not to say there aren't cowboy CxOs recklessly ignoring reality, but accepting risks is part of the job. The real answer generally lies somewhere in the middle of the two extremes.