4 ms·

Allowing Blue Team to fight back maybe? Or to be able to actively track the red team instead, using an active defense, instead of only passive defense? Moreove

Allowing Blue Team to fight back maybe? Or to be able to actively track the red team instead, using an active defense, instead of only passive defense? Moreover, the outcomes are different for both teams: - RedTeam success => they are seen as "real" hackers/heros and the BlueTeam are the poor incompetent - RedTeam fail => the BlueTeam did "only" its job, the investments in cybersec for the company paid off... so the budget for the cybersec can be reduced. So, for RedTeam, it's either a win or a tie. And for BlueTeam it's either a tie or a loss... If the BlueTeam could fight back, maybe this could change...

willcipriano 6y ago
That's good. Perhaps something like if they can attribute the attack to a particular machine the red team gets "arrested".
- DaiPlusPlus 6y ago
  Do the feds still attend DC? >:}
  - birdyrooster 6y ago
    No and they don’t come because hackers asked them not to. >:/
    - Shared404 6y ago
      Found the Fed.
- Bnshsysjab 6y ago
  Easier said than done, the red team can’t break real laws (routing through compromised hosts) where real hackers will.
mindslight 6y ago
It's inherent to the field. A successful blue team is a distributed win - every line of code did what it was supposed to do. A successful red team is a concentrated win, for the people who found the few lines of code that did something else. The job of a red team is to make things interesting. The job of a blue team is to keep things boring.
close04 6y ago
That's true but only because it mimics real life. The defenders are always at a disadvantage here, they have the boring job but one where one mistake is one too many. And they have to achieve that perfect score while operating within the rules. On the other side the attackers have the more exciting job and only need one success which they can achieve by using whatever means they see fit. You'll see this outside of IT just as well, like in sports. Goalkeepers (defenders) vs. strikers come to mind but at least there they all operate within the same set of rules.
Enginerrrd 6y ago
I kind of like the dual approach. First team to get in to the box has to try and hold onto it while still maintaining specified services it's supposed to be providing in the simulation. Winner is whoever holds it the longest.
deleted 6y ago
[deleted]
deleted 6y ago
[deleted]

willcipriano 6y ago

That's good. Perhaps something like if they can attribute the attack to a particular machine the red team gets "arrested".

DaiPlusPlus 6y ago
Do the feds still attend DC? >:}
- birdyrooster 6y ago
  No and they don’t come because hackers asked them not to. >:/
  - Shared404 6y ago
    Found the Fed.
Bnshsysjab 6y ago
Easier said than done, the red team can’t break real laws (routing through compromised hosts) where real hackers will.

mindslight 6y ago

It's inherent to the field. A successful blue team is a distributed win - every line of code did what it was supposed to do. A successful red team is a concentrated win, for the people who found the few lines of code that did something else. The job of a red team is to make things interesting. The job of a blue team is to keep things boring.

close04 6y ago

That's true but only because it mimics real life. The defenders are always at a disadvantage here, they have the boring job but one where one mistake is one too many. And they have to achieve that perfect score while operating within the rules. On the other side the attackers have the more exciting job and only need one success which they can achieve by using whatever means they see fit. You'll see this outside of IT just as well, like in sports. Goalkeepers (defenders) vs. strikers come to mind but at least there they all operate within the same set of rules.

Enginerrrd 6y ago

I kind of like the dual approach. First team to get in to the box has to try and hold onto it while still maintaining specified services it's supposed to be providing in the simulation. Winner is whoever holds it the longest.

deleted 6y ago

[deleted]

deleted 6y ago

[deleted]