Skip to main content

So what is this red teaming thing anyway?

A grounding definition.

2 min read
offensive security red team essay

Seeing how I like to talk about offensive security around here, I should probably clarify what I mean about some things, like red teaming. There are plenty of running definitions out there, but just to have something to anchor on for now: 1

Red teams apply adversarial methods to identify where there’s divergence between an organization’s intended position on a topic, and reality.

The organizational position on the topic of security could be something like: “Our perimeter is secure and our defenses are strong, including our ability to detect and respond to attacks.”

“What if it isn’t though?”: a red team does the work to (in)validate that stated position through repeated end-to-end testing (operations), playing the role of a determined, goal-driven attacker. In doing so, the red team can establish the truth about preventive, detective, and corrective controls and capabilities as they actually exist.

For a red team to be effective, what’s non-negotiable, in my view, is the adversarial part: the ability to think and operate free of as many assumptions and constraints as possible. To be creative, persistent, and unorthodox.

Note that I’m very deliberately avoiding the technical specifics here. I think those are a very important implementation detail, but fundamentally shift focus away from the core of what red teams do. Sure, frequently it looks like: find a bug, maybe even a 0-day vulnerability, then move internally through various systems towards the goal, write up the findings, help with remediation. But those aren’t requirements. Red teams are not a vulnerability-finding function (though incidentally they do find a lot of issues), and in the extreme they don’t even have to be technical all the time. Operations are usually live, with attacks being executed against the production environment of the organization, but it’s also legitimate to run tabletops when the risk is too high to do otherwise (or to expedite the process).

All the technical stuff is largely a function of what red teaming looks like in practice today. But it’s not fundamental to the concept. Lateral thinking and experimentation are.

Footnotes

  1. This post may get updated occasionally ↩