Red teaming

Red teaming is the practice of rigorously challenging plans, policies, systems and assumptions by adopting an adversarial approach. The purpose of red teaming is to countermand cognitive errors that impair critical thinking such as group think and confirmation bias. In the enterprise, a red team may be either a contracted external third party or an internal group whose existence has not been shared with employees.

Red teaming as a formal discipline originated with the military and intelligence agencies. The North Atlantic Treaty Organization (NATO) handbook defines red teaming as the art of applying critical thinking from a variety of perspectives to challenge assumptions and explore alternative outcomes. Its earliest implementation in the enterprise was in security, where ethical hacking and pen testing are two common examples of using contrarian thinking as part of an organization’s strategic planning process.

A properly conducted red team exercise extends further than simply identifying gaps in security practices and controls. Instead, it determines how an organization is equipped to deal with real-world attacks. For example, results can be used to engage a board of directors to get further investment in security defenses and staff security awareness training.

Red team testing vs. pen testing

Red team exercises generally start with passive reconnaissance and open source intelligence gathering, using publicly available data such as social media postings and online searches to identify individuals to target within the organization.

While a penetration test usually relies upon the company providing relevant information such as the IP addresses to scan or the necessary credentials to access an application, a red team starts from the same position as a real attacker from inside or out of the organization. Red team exercises also take place without the knowledge of most personnel at the target organization.

The legal implications of a red team are much the same as for a penetration test. This means the attack team could potentially be in contravention of the Computer Misuse Act, and the Data Protection Act (DPA) could come into play where access to data is concerned. Provision of the relevant authorization avoids the former, and if the security company conforms to standards such as ISO27001 and ISO9001, DPA issues can be avoided.