Hi everyone.
I'm Chris.
And welcome back to my course on Enterprise Security fundamentals.
In this section and in the first lesson of course we are going to discuss about to the blue team the
opposite of the red team.
As I've mentioned in the previous lesson now let's have an overview of the blue team and specifically
the blue team role the blue team represents.
And is compromise is comprised of your organization's existing information security and I.T. administration
staff.
While a part of the purpose of the Red Team exercises is to explore how an organization is vulnerable
to digital infiltration by an external attacker and of course to remediate those vulnerabilities.
Another important part of a red team exercise is to train your organizational staff on how to detect
investigate and respond to attacks against the organization's information systems.
Red team exercises function as a practical drill for an organization.
And the the I.T. administration staff of that organization.
They also function as a practical drill for an organization's existing security response policies and
procedures.
Just as in a think think think of it this way just as in a disaster recovery drill tests the adequacy
of an organization's disaster recovery policies and procedures.
A red team exercise tests and organizations Security Incident Response policies and procedure of course.
Now let's take a look at the blue team goals.
So when conducting a red team versus Blue Team exercise the blue team has several overarching goals
just like the red team.
And these goals include the following.
Stopping the red team from successfully achieving its goals.
The best blue team outcome is to block the red team from gaining the foothold in the target's organization.
Depending on how this scenario plays out it could be because the organization's existing security posture
makes it extremely difficult to digitally infiltrate.
However it is important to note that with this outcome.
Just because the organization wasn't infiltrated this time doesn't mean that the vulnerabilities don't
exist in the organization's security configuration or in the organization's incident response policies.
It just means that the red team wasn't able to successfully exploit them this time.
Ah one response when this goal is achieved is for the organization to engage with a new and separate
organization to provide Red Team penetration testing services for the next red team exercise.
The new organization may have a red team approach that exposes vulnerabilities that weren't uncovered
by the previous red team the next goal is early detection and effective response to red team activities.
When this outcome occurs the blue team quickly detects and responds to red team activities while the
red team makes some progress towards its goals.
The blue team has enough information to detect and respond to their activities and to evoke the red
team from the target organization's information systems
another goal is and this is a very important one is post exercise report.
Now this report should detail blue team's successes and failures of course independent of the outcome.
This report will assist in improving the processes that the internal teams follow when a real rather
than simulated attack occurs.
It also gives members of the blue team a formal chance to reflect on what they did well and what they
could do better.
For example if a bottleneck occurred because event logs from a system were not accessible to the investigations
to the investigators sorry during the exercise or the investigator missed critical evidence in the event
logs the report would highlight this problem.
Another goal would be to revise the incident response strategy.
And here we can talk about the outcome of the Red Team exercise this shouldn't only involve remediating
hardware software and configuration vulnerabilities in an organization security configuration but procedural
or procedural vulnerabilities as well in the way that the personnel response to the attack simulation
the incident response strategy provides organizations with a formal process for responding to incidents.
This goes beyond the phases of the blue team's kill chain and will include what responses are performed
at an organizational level.
For example when it is necessary to notify external stakeholders about a potential breach are required.
Based on the results of the Red Team exercise it may be necessary to adjust the incident response strategy
so that the organization is more effectively able to respond to future incidents.
Red team gains complete dominance of the network.
This is the worst outcome from the perspective of the blue team and it's an indicative that the current
information systems configuration and of course the incident response policies need revision and remediation.
This was a quick overview of the blue team and the blue team goals.
I will see you guys in the next lesson where we'll be discussing about the blue team.
Kill gene as well.
As we discussed about the red team kill Gene I hope this has been informative for you.
And thank you for watching.