Use Red Teaming To Build, Not Validate, Your Security Program
Jan 18, 2024
auto_awesome
Guest Richard Ford, CTO of Praetorian, challenges the misconception of red teaming as mere validation, emphasizing its value in strengthening organizations. They discuss conducting red teaming early in the project lifecycle, explore different perspectives and value of red teaming, and redefine it as a proactive tool. The chapter also highlights the importance of aligning definitions and repositioning red teams under the SOC for better defense posture.
Red teaming should be seen as a proactive testing approach to strengthen defenses, not just a validation exercise.
There is a need to redefine red teaming and explore its value, considering diverse perspectives and objectives.
Deep dives
Red teaming as a tool to build defenses
Red teaming has the potential to identify areas where organizations need to strengthen their defenses, but it is often viewed as a mere validation of existing security measures. There is a need to shift the perception of red teaming and consider it as a way to proactively test infrastructure instead of waiting for it to be ready. By moving red teaming upstream, organizations can gain more value from these exercises and improve their overall security program.
Different perspectives on red teaming
There is a lack of consensus on what red teaming entails and what its objectives should be. The community has varying opinions on the definition and purpose of red teaming. Some argue for threat modeling as a better approach to understand vulnerabilities and potential exploits. Others advocate for red teaming to be conducted throughout a project's lifecycle to catch issues early and avoid costly fixes later. These diverse perspectives highlight the need to redefine red teaming and explore its potential value.
Shifting the focus to security culture
Red teaming should not be seen as a stand-alone exercise but as a strategic driver for improving the security culture of an organization. It should promote learning and not punishment, fostering a mindset of continuous improvement rather than a one-time test. Red teaming, when done right, can contribute to baking security into the DNA of a company and building a strong security culture.
Considering the timing and effectiveness of red teaming
There is a debate about when red teaming should be conducted and how effective it can be at different stages of development. While some argue for early-stage red teaming and design evaluations to identify potential vulnerabilities sooner, others caution against frustrating developers with tests on unstable applications. The key is to find the right balance, considering the stability of the application and the available resources. Red teaming should be approached strategically and tailored to the specific needs and maturity level of the organization.
When did we all agree that red teaming was about validating security?
Does it seem like increasingly red teaming is a catch all term for a whole lot of testing that isn't clearly defined?
Is this making it hard to see its value?
Can moving red teaming upstream be more valuable to your organization?
Thanks to our podcast sponsor, Praetorian
Praetorian helps companies adopt a prevention-first cybersecurity strategy by actively uncovering vulnerabilities and minimizing potential weaknesses before attackers can exploit them.
Get the Snipd podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share & Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered podcast player
Listen to all your favourite podcasts with AI-powered features
Discover highlights
Listen to the best highlights from the podcasts you love and dive into the full episode