Carey, Marcus J., and Jennifer Jin. Tribe of Hackers Red Team: Tribal Knowledge from the Best in Offensive Cybersecurity. New York: Wiley, 2019.

Earlier I reported on ‘Tribe of Hackers Blue Team.’ This week it is ‘Tribe of Hackers Red Team.’ In reading about offensive cybersecurity, I am reminded of a U.S. Army saying from bygone times: “If you want to have a good time, join the calvary.” While my heart is with the infantry, and the blue team, the red team has more fun!
Just like the blue team book, this one is written in the style of a cybersecurity conference panel discussion. The 47 experts are asked the following 22 questions:
How did you get your start on a red team?
What is the best way to get a red team job?
How can someone gain red team skills without getting in trouble with the law?
Why can’t we agree on what a red team is?
What is one thing the rest of information security does not understand about being on a red team?
What is the most toxic falsehood you have heard related to red, blue, or purple teams?
When should you introduce a formal red team into an organization’s security program?
How do you explain the value of red teaming to a reluctant or nontechnical client or organization?
What is the least bang-for-your-buck security control that you see implemented?
Have you ever recommended not doing a red team engagement?
What is the most important or easiest-to-implement control that can prevent you from compromising a system or network?
Why do you feel it is critical to stay within the rules of engagement?
If you were ever busted on a penetration test or other engagement, how did you handle it?
What is the biggest ethical quandary you experienced while on an assigned objective?
How does the red team work together to get the job done?
What is your approach to debriefing and supporting blue teams after an operation is completed?
If you were to switch to the blue team, what would be your first step to better defend against attacks?
What is some practical advice on writing a good report?
How do you ensure your program results are valuable to people who need a full narrative and context?
How do you recommend security improvements other than pointing out where it is insufficient?
What nontechnical skills or attitudes do you look for when recruiting and interviewing red team members?
What differentiates good red teamers from the pack as far as approaching a problem differently?

I intend to read the other two ‘Tribe of Hackers’ books and will report back to you.

The Authors
According to the book cover Mr. Carey has 25+ years in the business. His LinkedIn profile says he has an MS in Network Security. Using the same sources, Ms. Jin in a marketing professional.
The Metadata
A used paperback copy from online ordering of the book will cost you under $20. The books are not available, at this writing, through the Pikes Peak Library District System. The writing level and style is reasonable. The paperback book is 275 pages, but the print is much smaller than the blue team book.

The Content

This is an important book to read if you want are applying for a red team or penetration testing job or are considering hiring the same. I did not say it was an ‘easy to read’ book. It took me quiet a bit of time to get through it. This is not a story – again it is a panel discussion. For job applicants, you learn what skills and attitudes employers want. If you want to ‘red team’ because you like to break things and make people look dumb, the employers say, “Do NOT apply!” They are looking for collaborators that help the defenders grow stronger, not mischief makers. For company leaders that are looking to hire a red team, look to see if your defenders have been made strong first! The experts say without a mature defense (blue team), “You are just wasting your money.” Also for employers, the book forces you to think about what Rules of Engagement you want to establish for the external (or even internal) red team. Too tight: you do not get a worthwhile look at your defense. Unlimited: You risk real damage, including physical damage to your building or loss/corruption of your data and your client’s data in your safekeeping.

For me, I get confused over what is a red team and what is a penetration test. The experts cannot agree, and in fact that is one of the questions, “Why can’t we agree?” Here goes a try, but I am sure some of my readers will shout me down, as their opinions are strongly held and just as strongly defended. Please realize I am not criticizing your mother!

In my opinion, gathering material from the book, ‘red teaming’ seems to be a broader and more holistic look at a company’s security defenses, dealing with detection of security issues and responses to those issues. One panelist used those exact words: “Detection – Response.” Great red teamers apparently only count it a victory when they find things that can be strengthened, and the defenders actually (and happily) put those changes into practice. Penetration testing seems more directed at vulnerabilities (again an exact word). “Can we find any way through the defenses (a vulnerability)?” “Where can we go and what damage could we do once we are inside?”

Now comes they brutal criticism from my readers, as obviously I do not know anything, and I am ugly. They former may well be true, the later I certainly admit.

Oh, one parting comment: Without any exception I could see, ALL potential red team employers want great writing skills in their red teamers. One even talked about making a salary offer lower if the candidate was a sloppy written communicator, because they would have to pay for a document reviewer’s time!

Overall, I recommend the book.

 

Happy Reading!

 

William J. (Jay) Carson

ISSA-COS Executive Vice President