Implementing a red team/blue team strategy allows organizations to actively test their existing cyber defenses and capabilities in a low-risk environment. By engaging these two groups, it is possible to continuously evolve the organization’s security strategy based on the company’s unique weaknesses and vulnerabilities, as well as the latest real-world attack techniques..

Red Team Exercise Examples

Red teams use a variety of techniques and tools to exploit gaps within the security architecture. For example, in assuming the role of a hacker, a red team member may infect the host with maleware to deactivate security controls or use social engineering techniques to steal access credentials.

We use red team activities to seed the environment with data so the blue team can gauge the risk associated with each incident and respond accordingly. As such, we don’t treat this exercise as a proverbial war game where our clients attempt to block each and every red team action, but effectively assess and prioritize those events that the data reveals to be the greatest threat.

Red team activities commonly follow the MITRE framework which is a globally-accessible knowledge base of adversary tactics, techniques and methods based on real-world experience and events. The Framework serves as a foundation for the development of prevention, detection and response capabilities that can be customized based on each organization’s unique needs and new developments within the threat landscape.

Examples of red team activities include:

Penetration Testing
Social Engineering
Intercepting Communication