red teaming (noun) [Word Notes]

Summary

Hacking Humans: Red Teaming Episode Summary

Podcast Information:

• Title: Hacking Humans
• Host/Author: N2K Networks
• Description: Deception, influence, and social engineering in the world of cyber crime.
• Episode: Red Teaming (noun) [Word Notes]
• Release Date: November 5, 2024

---

Introduction to Red Teaming

The episode opens with Rick Howard delving into the concept of red teaming, distinguishing it from mere opposition by emphasizing its role as a group activity aimed at emulating adversary behavior against an organization’s defenses.

“In Computer Security, the Red Team assumes the role of the adversary group trying to penetrate the Blue team's digital infrastructure.”
— Rick Howard [00:02]

Defining Red Teaming

Rick meticulously breaks down the term, explaining its dual nature:

• "Red," signifying opposition.
• "Teaming," indicating collaborative group activity.

He provides a clear definition to set the foundation for listeners unfamiliar with the term.

“Red teaming spelled red as in opposition and teaming as in group activity.”
— Rick Howard [00:02]

Historical Origins

Rick Howard traces the origins of red teaming back to the Roman Catholic Church in 1587. The role of the Devil's Advocate during the beatification process of St. Lawrence Justinian is highlighted as the precursor to modern red teaming practices.

“The avocatus diable was to be the opposing force, the Red Team to make sure that no person received the honors of sainthood recklessly and too fast.”
— Rick Howard [00:45]

This historical context underscores the methodical approach red teams take to identify potential weaknesses and objections, ensuring that only truly deserving individuals or systems gain approval or security.

Prussian Army Influence

Transitioning to military origins, Rick Howard explains how the Prussian army in the early 19th century contributed to the nomenclature and practice of red teaming. Through the adoption of war games like Kriegspiel, the distinction between Blue (home team) and Red (enemy forces) teams was cemented.

“Blue game pieces stood in for the home team, the Prussian Army. Since most Prussian soldiers wore blue uniforms, red blocks represented the enemy forces, the Red Team, and the name has stuck ever since.”
— Rick Howard [02:30]

This military strategy laid the groundwork for structured adversarial simulations, a practice that seamlessly transitioned into the cybersecurity domain.

Evolution into Cybersecurity

The podcast elucidates how red teaming evolved with the advent of digital technologies. In the 1960s and 1970s, as mainframe computers began to serve government and commercial interests, the U.S. Air Force pioneered Tiger teams to test system vulnerabilities.

“In Computer Security, the Red Team assumes the role of the adversary group trying to penetrate the Blue team's digital infrastructure.”
— Rick Howard [01:15]

James Anderson’s 1972 After Action Report is cited as a foundational document outlining methodologies to breach system defenses, principles that remain integral to contemporary penetration testing.

Key Developments and Contributions

Rick Howard highlights significant milestones in red teaming within cybersecurity:

1. System Development Corporation Conference (1965):

   • A pivotal event where 15,000 mainframe operators explored various methods to infiltrate computers, signaling the rise of proactive security testing.

2. The Willis Paper:

   • Authored by Dr. Willis Ware and colleagues, this document revealed potential vulnerabilities in computer systems that could be exploited by spies.
   • William Hunt from the College of William and Mary emphasizes the paper’s impact on government-led efforts to secure sensitive information.

“The Willis Paper showed how spies could actively penetrate computers, steal or copy electric files, and subvert the devices that normally guard top secret information.”
— Rick Howard [04:50]

These contributions ignited over a decade of intense activities by elite computer scientists within the U.S. Government, consistently succeeding in breaching sensitive systems and thereby enhancing defensive strategies.

Modern Red Teaming Practices

Moving into the early 2000s, the episode discusses the integration of Red Team and Blue Team exercises, often referred to as Purple Team exercises. These collaborative drills are designed to simulate known adversary attack campaigns within an intrusion kill chain framework, offering dual benefits:

• Testing Defenses: Evaluating the robustness of existing security measures.
• Training Analysts: Accelerating the skill development of new and mid-tier cybersecurity professionals.

“Red teaming hit the digital age in the form of penetration testing.”
— Rick Howard [03:10]

Such practices not only fortify an organization’s security posture but also ensure that incident response teams are well-prepared to handle real-world cyber threats.

Conclusion and Credits

The episode concludes with acknowledgments, highlighting the collaborative efforts behind the production of the Word Notes series.

“Wordnotes is written by Naila Genowi, executive produced by Peter Kilp, and edited by John Petrick and me, Rick Howard. The mixed sound, design and original music have all been crafted by the ridiculously talented Elliot Eltzman. Thanks for listening.”
— Rick Howard [06:00]

---

Key Takeaways

• Red Teaming Defined: A strategic practice involving simulated adversary attacks to identify and rectify vulnerabilities.
• Historical Roots: Originating from the Roman Catholic Church and military practices of the Prussian army.
• Evolution in Cybersecurity: Transitioned into digital security through pioneering efforts in the 1960s and 1970s.
• Modern Practices: Incorporates Red, Blue, and Purple Team exercises to enhance defensive mechanisms and analyst training.
• Influential Studies: Documents like the Willis Paper have been instrumental in shaping cybersecurity defenses.

This episode provides a comprehensive overview of red teaming, tracing its lineage from historical adversarial roles to its critical function in modern cybersecurity strategies. Whether you’re a seasoned professional or new to the field, Hacking Humans offers valuable insights into the methodologies that safeguard our digital infrastructures.

Transcript

[Rick Howard]

You're listening to the Cyberwire Network powered by N2K. The word is red. Teaming spelled red as in opposition and teaming as in group activity. Definition the practice of emulating known adversary behavior against an organization's actual defensive posture. Example sentence In Computer Security, the Red Team assumes the role of the adversary group trying to penetrate the Blue team's digital infrastructure. Origin and context. The Roman Catholic Church may have invented the concept in 1587 when Pope Sixtus V assigned the job of Devil's Advocate during the beatification process of St. Lawrence Justinian. The avocatus diable was to be the opposing force, the Red Team to make sure that, according to Ellen Lloyd of Ancient Pages, no person received the honors of sainthood recklessly and too fast. Every potential weakness or objection to the state's canonization was raised and evaluated in order to ensure that not only those who were truly worthy would be raised to the dignity of the altars. The origin of the Red Team and Blue Team names to indicate adversary and good guy activity, respectively, isn't a random choice. We have the Prussian army to thank for that. According to Peter Attia over at Media, in the early 19th century the Prussian army adopted war games to train its officers. One group of officers developed a battle plan and another group assumed the role of the opposition using a tabletop game called Kriegspiel, literally war game in German, resembling the popular board game Risk. Blue game pieces stood in for the home team, the Prussian Army. Since most Prussian soldiers wore blue uniforms, red blocks represented the enemy forces, the Red Team, and the name has stuck ever since Red teaming hit the digital age in the form of penetration testing. In the 1960s and 1970s, just as mainframe computers started to become useful for government in the commercial space in 1971, the US Air Force contracted James Anderson to run Tiger teams against their multics operating systems, the precursor to Unix. His 1972 After Action Report described a methodology to penetrate and compromise those systems, which is fundamentally the basis for all penetration testing, even today. In the early 2000s, the idea of a combined Red Team, Blue Team exercise or Purple Team exercise became popular to test defenses against known adversary attack campaigns in an intrusion kill chain kind of way. This had the added benefits of exercising incident response teams and accelerating the training of newbie and mid tier analysts in the Soc Nerd Reference at maybe the first cybersecurity conference ever hosted by the System Development Corporation In California in 1965, 15,000 mainframe operators from around the world discussed all the ways in which these new machines could be penetrated by unsavory people. By the late 1960s and the early 1970s, elite computer operators were passing around a paper authored by Dr. Willis Ware and others called the Willis Paper that, according to William Hunt at the College of William and Mary, the paper showed how spies could actively penetrate computers, steal or copy electric files, and subvert the devices that normally guard top secret information. The study touched off more than a decade of quiet activity by these elite groups of computer scientists working for the US Government who tried to break into sensitive computers. They succeeded in every attempt. Wordnotes is written by Naila Genowi, executive produced by Peter Kilp, and edited by John Petrick and me, Rick Howard. The mixed sound, design and original music have all been crafted by the ridiculously talented Elliot Eltzman. Thanks for listening.