A red team is a group of external specialists who, at the request of senior management and usually without the IT department’s knowledge, carry out real attacks against the organisation’s IT systems. In these attacks, “anything goes” – as long as it does not threaten to bring the systems down.

The terms red team, blue team and purple team come up often in security assessments. The red team is the attacking side (the hackers), the blue team is the defending side (the IT department). The purple team is the iteration of the two: the in-house IT staff fix the flaws found by the usually external specialists, then the red team attacks again and the blue team defends. A controlled, secure IT environment grows out of the cooperation between the two teams, and this ongoing cooperation is what is usually called purple teaming.

In a typical red team engagement, only the smallest possible group knows about the attack – usually the CEO, the head of information security and perhaps the head of IT. The point of this secrecy is to let the company assess how well the security rules and systems it has built actually meet its expectations.

It is worth carrying out the assessment from two angles. First, the attackers look for weak points in the systems based on information available on the internet. This differs from a security assessment in that the red team’s goal is to find one flaw and exploit it successfully, whereas a security assessment aims to find as many flaws as possible within the available time.

Next, the red team usually plays the role of a malicious employee. The attackers are given low-level access to the internal network (this is often specified in the contract) and then try to reach sensitive information: passwords, internal databases – in other words, any information that could cause financial or reputational damage to the company if it fell into the hands of competitors or became public.

Whiteshield has been carrying out red team assessments against the systems of small and large companies and local governments for several years. Over this time, we have built up in-depth knowledge of exploiting weaknesses in Windows and Linux environments.

Do you have a question? We are happy to help. Write to us!