How a Red Team Operates

Red teaming is an attack technique used in cyber security to test how an organisation would respond to a genuine cyber attack. It is done through an Ethical Hacking team or similar offensive security team.

The red team that simulates the attack is often an independent cyber security provider, while the organisation's defensive cyber security capability is known as the blue team. The blue team aren't given warning of the exercise so that the organisation receiving the red teaming gains a realistic measure of its ability to respond to a genuine cyber attack.

What is a Red Team?

A red team is a form of penetration test (pentest) that has a very different set of goals to the more traditional pentest. While a typical pentest focuses on finding vulnerabilities and potentially exploiting them within a predefined set of company systems, a red team is target-driven and seeks to gain access to predetermined objectives by exploiting relevant weaknesses anywhere within an organisation. It does not seek to provide an exhaustive list of vulnerabilities present.

The value of a red team is in simulating how an organisation could be targeted in a real world attack and testing how the blue team responds to such an attack. The tactics, techniques and procedures (TTPs) of a red team are modelled on real-world malicious threat actors, with the goal of highlighting gaps in the security response.

The lack of notice is what distinguishes red teaming from pen testing. Blue teams are often purposely left in the dark during these evaluations. The goal of this is to force the blue team to respond as if it were an actual attack, providing a more accurate assessment.

Red Team results

The test can last anywhere from weeks to months, but at the end the results are collated and a workshop is run with the blue team. The complexity of this workshop depends on the target. It can be:

• a high level summary of where they performed well and where they can improve;

• a technical review of each attack and counterattack between the two teams; or,

• or a set up for a larger “find and fix” project the company wants to launch on the back of the red team.

Red teams offer a means of measuring response to specific scenarios as business operations change. For example the unattended laptop scenario which has changed, due to the dramatic shift to remote working in the pandemic, to a shared remote environment which has a different risk profile and possible attack paths. Red teams are ideal for companies that are keen to assess how good they are at preventing, detecting and responding to real world cyber attacks.