At The Diana Initiative 2020 I have presented the Internal Red Team Operations Framework at the Red Team Village.
The talk covered how to build a practical internal red team: what to set up first, how to grow the team's capability, and how to run operations that actually improve the organisation's defences.
What was different this time
Two weeks earlier I had given a first version of this talk at the DEF CON 28 DCG Village. For The Diana Initiative I gave the framework its proper name, the Internal Red Team Operations Framework, or IRTOF, and tightened the last phase.
In the earlier version, phase 5 was about mature operations, skilled operators, custom tooling and covert physical assessments. Here I added one more thing to it: a well defined purple team model to measure how the red team and the blue team are progressing. If you cannot measure both sides, you cannot show that the programme is working.
Key takeaways
- Internal red teaming is not a vulnerability assessment and not a pentest. It is a team that keeps challenging your plans, defences and assumptions.
- Build it in phases: crawling, getting on your feet, walking, running and flying. Each phase has its own goals, and you earn the next one.
- Bring the blue team in early, and by the last phase, measure both teams together through purple teaming.
- Keep a strategic plan for the long term, and deliver it through short tactical engagements that management can follow.
What was shown
A slide talk with no live demo, presented online at the Red Team Village. The full breakdown of what goes into each phase is on the DEF CON 28 page, and I also wrote about it on the blog: Building your organization's internal red team.
Slides and recording
The slides are linked on this page, and the recording is on the webcast page. A longer version followed at BSides Delhi 2020. Special thanks to The Diana Initiative team.