It Is Not Just Red Team Or Blue Team: Exploring The Spectrum Of Cyber Range Teams In our previous blog, we delved into the different types of cyber-ranges and their determiners. Cyber-ranges can vary according to the needs of the user and the number of users it can support. We also learned of the specialized cyber-ranges and the process of decision-making to help us choose the relevant cyber range to meet the requirements. In this blog, we shall understand the different teams and team members required for varying roles and responsibilities. As a basic, it is important to ensure that employees are aware of the basics of cyber security principles and trained for being able to understand the elements to ensure that the entire ownership of security is not on the security team only. At the same time, it is important to identify the teams and team members for different roles and responsibilities. It is also important for a security professional to approach the environment and understand the cyber terrain, irrespective of the team they are in. Not every cyber range is open or meant to be used by every category of user. We can classify cyber range users into four groups as follows: Students:They would use cyber-ranges to apply their theoretical knowledge in a simulated network environment to improve their cyber skills and work as a team to solve cyber problems along with gaining knowledge and preparing for cyber security certifications. Educationists: They use cyber-ranges to teach and evaluate their students. Professionals: They could belong to different groups wanting to improve their skills. Organizations:They would use cyber-ranges in evaluating their own proficiency, training, and enhancing the skill set of their team along with testing new methods before deployment into production. For a cyber range exercise, we would involve several teams with distinct, and in some cases, conflicting roles. The traditional team names used are as follows: Red team This team plays the role of an attacker (malicious users). Their task is to infiltrate and try to break the security of the given infrastructure by compromising a specific resource or accessing specific data or compromising a specific resource. Blue team This team has been assigned the task of defending, which also includes verifying the security of the existing applications and infrastructure in a limited amount of time. Green team: This is the team that is responsible for the exercise infrastructure. Their responsibilities include configuring the entire cyber range infrastructure (network devices and applications), virtual elements, monitoring, and scoring infrastructure. They are also responsible for monitoring the health of a cyber range and fixing any crashes and infrastructure issues if needed. Yellow team This team is assigned the task of improving realism in the scenarios during the action and making legitimate interactions with the environment, which can be partially simulated using automatic tools. White team: This team is assigned the responsibility for the design and construction of the scenario used for the exercises. They act as the supervisor on exercises involving attack and defence paradigms, establishing the final score. As supervisors, they need to ensure that the exercise is conducted according to the scenario and according to the objective. Purple team: They are a part of autonomous teams. Purple teaming is the collaborative function performed by Red Teams and Blue Teams and a new approach to collaborative testing and remediation. They are responsible for information and enhanced effectiveness of the Red and Blue teams. They perform the communication between multiple exercise teams, which increases the effectiveness of the Red team in the attacking exercise and increases the capability of the Blue team in defending. The goal is aimed at reducing the meantime in the remediation for reported risks and vulnerabilities. Orange team: They assign different technical tasks to the Blue team members during the exercise. The Blue team members earn points if they can complete the tasks. Yellow team: They simulate the behaviour of normal users who would be using the infrastructure created by the Green team. They perform tasks like generating legitimate network traffic that can be used by red and blue teams in attack and defence. Understanding different teams and their roles is imperative. This would help us to plan the teams required with clear-cut roles and responsibilities. Having the right team plays a crucial part in the success of cybersecurity preparedness. As we continue this journey of exploring cyber-ranges, we must analyse and discuss the need to be aware of the tools the teams should have to carry out to accomplish their tasks.

In our previous blog, we delved into the different types of cyber-ranges and their determiners. Cyber-ranges can vary according to the needs of the user and the number of users it can support. We also learned of the specialized cyber-ranges and the process of decision-making to help us choose the relevant cyber range to meet the requirements.

In this blog, we shall understand the different teams and team members required for varying roles and responsibilities.

As a basic, it is important to ensure that employees are aware of the basics of cyber security principles and trained for being able to understand the elements to ensure that the entire ownership of security is not on the security team only. At the same time, it is important to identify the teams and team members for different roles and responsibilities. It is also important for a security professional to approach the environment and understand the cyber terrain, irrespective of the team they are in. Not every cyber range is open or meant to be used by every category of user.

We can classify cyber range users into four groups as follows:

• Students:They would use cyber-ranges to apply their theoretical knowledge in a simulated network environment to improve their cyber skills and work as a team to solve cyber problems along with gaining knowledge and preparing for cyber security certifications.
• Educationists: They use cyber-ranges to teach and evaluate their students.
• Professionals: They could belong to different groups wanting to improve their skills.
• Organizations:They would use cyber-ranges in evaluating their own proficiency, training, and enhancing the skill set of their team along with testing new methods before deployment into production.

For a cyber range exercise, we would involve several teams with distinct, and in some cases, conflicting roles. The traditional team names used are as follows:

• Red team This team plays the role of an attacker (malicious users). Their task is to infiltrate and try to break the security of the given infrastructure by compromising a specific resource or accessing specific data or compromising a specific resource.
• Blue team This team has been assigned the task of defending, which also includes verifying the security of the existing applications and infrastructure in a limited amount of time.
• Green team: This is the team that is responsible for the exercise infrastructure. Their responsibilities include configuring the entire cyber range infrastructure (network devices and applications), virtual elements, monitoring, and scoring infrastructure. They are also responsible for monitoring the health of a cyber range and fixing any crashes and infrastructure issues if needed.
• Yellow team This team is assigned the task of improving realism in the scenarios during the action and making legitimate interactions with the environment, which can be partially simulated using automatic tools.
• White team: This team is assigned the responsibility for the design and construction of the scenario used for the exercises. They act as the supervisor on exercises involving attack and defence paradigms, establishing the final score. As supervisors, they need to ensure that the exercise is conducted according to the scenario and according to the objective.
• Purple team: They are a part of autonomous teams. Purple teaming is the collaborative function performed by Red Teams and Blue Teams and a new approach to collaborative testing and remediation. They are responsible for information and enhanced effectiveness of the Red and Blue teams. They perform the communication between multiple exercise teams, which increases the effectiveness of the Red team in the attacking exercise and increases the capability of the Blue team in defending. The goal is aimed at reducing the meantime in the remediation for reported risks and vulnerabilities.
• Orange team: They assign different technical tasks to the Blue team members during the exercise. The Blue team members earn points if they can complete the tasks.
• Yellow team: They simulate the behaviour of normal users who would be using the infrastructure created by the Green team. They perform tasks like generating legitimate network traffic that can be used by red and blue teams in attack and defence.

Understanding different teams and their roles is imperative. This would help us to plan the teams required with clear-cut roles and responsibilities. Having the right team plays a crucial part in the success of cybersecurity preparedness. As we continue this journey of exploring cyber-ranges, we must analyse and discuss the need to be aware of the tools the teams should have to carry out to accomplish their tasks.

« Previous Next »