Red Team vs. Blue Team: What’s the Difference?

Posted On: Oct 25, 2022

Red Team vs. Blue Team: What’s the Difference?

The software industry often borrows names and processes from the US Army. One example is when the army splits its team into blue and red.

The blue one is defending a target, and the red one is attacking.

Some software companies adopted the same approach. The blue team consists of experienced experts responsible for keeping company assets secure. In turn, the red team specializes in finding a way to bypass security measures.

Find out why you should have a dedicated red team that constantly tests your cybersecurity and how your organization can benefit from creating its own red and blue teams.

The blue team is responsible for maintaining an IT infrastructure. They are defensive security professionals. Areas of their specialization include:

network,
identity management,
cloud,
user devices, and many more.

The required skillset depends on the company's infrastructure.

Together they ensure that all solutions are properly configured and maintained to ensure that all company assets are secure. Their skillset consists of understanding company security strategy, analytical skills to identify threats, and hardening skills. That means they know how to reduce the attack surface and eventually spread security awareness in the organization.

Examples of blue team exercises

The blue team implements a set of exercises to verify security.

The first (and key) step is ensuring that all security devices and tools deployed in the organization are properly configured and up-to-date.

That means checking the firewall, IDS/IPS antivirus configuration hardening, and update management.

The blue team needs to ensure that access to assets in the company is limited. They do it by reviewing permissions to networks and assets, in general, using the least-privileged access concept. That means the user should not have access to something they do not need.

The best way to grow in a blue team is to monitor new public security tools and verify if they are correctly detected or blocked.

It is a great way to ensure that the team is aware of the newest threats and if current tools and processes are sufficient to handle them properly.

The results from such exercises are:

improved knowledge of the blue team members,
new detection rules in detection and prevention systems,
configuration improvements,
and scheduling urgent software updates.

Another exercise the blue team can do is to look for publicly available servers under the company DNS address. They do that to ensure that all of them are monitored and properly managed.

What is the red team?

A red team can simulate attacks on company assets.

They consist of security professionals qualified in the:

network,
application,
operating system security vulnerabilities,
malware development,
social engineering,
and sometimes hardware and physical security.

Their skillset is similar to what malware operators or hacking groups like LAPSUS$ have, but they use it only ethically. They are developing TTPs (Tactics, Techniques, and Procedures) to simulate already known and new attacks.

As many companies use different software and have various infrastructure approaches, it requires a great effort to ensure that the team can deliver satisfying results for the exercises. For example, there can be a massive difference in attacks on on-premise infrastructure vs. the cloud-based one.

Examples of red team exercises

Depending on the team structure, red teams may work to break security controls to achieve target access. They can learn how to execute sophisticated attack techniques using training, research, and publicly available articles and tools.

Sometimes these security teams arrange access to widespread business tools. They do that to see how they work, and to find security vulnerabilities or common misconfigurations that they can use for attacks.

For learning purposes, the IT security community provides applications and virtual machines that are deliberately broken. That way, they want to show typical vulnerabilities for specific cases.

With all that knowledge, red team members can provide attack simulations to test the security controls of an organization. Typically there is a specific target.

It can be, for example, Domain Admin in Active Directory services, high-value data in the database, or proof of getting access to a restricted area.

Another thing to clarify before the test is to confirm the scope. A team needs to agree on what to attack, what is prohibited, and who to contact in case of any issues.

A good example is a letter stating that this is a test with contact info to a person responsible for a test on the company side.. After the tests, the team delivers a report with the scope, findings, and recommendations. It may contain all of the executed steps so that blue team members can review them, find blind spots and remove them.

Security systems are getting more complex each day. More and more processes are being automated and moved to the company infrastructure. Companies are using the new web, mobile applications, appliances, and even Internet of Things devices. In the age of digital acceleration, it is the only way to keep up with the market.

Benefits of red team vs. blue team approach

Unfortunately, each of these elements is a potential security risk if not properly assessed and verified in the whole environment.

Blue teams can do their best given limited budgets, headcount, experience, and priorities to ensure the company is safe.But even then, there is a risk that they missed something or were wrongly prioritized. And then the breach can happen.

That is why red team exercises on company assets are crucial to assess a security posture. By doing such exercises regularly, it is possible to limit how long a vulnerability is present in the system and how severe damage it can introduce to it.

It is also a good idea to retest fixes as soon as they are published. That way the team can be sure that they are sufficient to resolve the vulnerability.

It is also worth noting that even if they did not detect vulnerabilities in a recent test, the threat landscape is still evolving.

New approaches and techniques to break into the systems are invented every day. Finally, it is a good way of elevating awareness about social engineering attacks in the whole organization.

Purple teaming

Quite a new approach for collaboration between the Blue team and Red team is a security methodology called Purple teaming. That means closer cooperation between the teams to improve spreading awareness and boost the performance of all team members.

For a red team member, it is valuable to see how defenders usually work with services they need to protect. In turn, a blue team member can learn new attack techniques and tools with initial research delivered by a red team member.

Purple teaming can improve the security posture of an organization. Keep in mind though that if there is no red team present in the organization, such exercises can be arranged together with penetration testing as a form of a workshop.

Feb 13, 2023

How to Use Ansible to Install and Set Up Docker on Ubuntu 22.04

IntroductionServer automation now plays an essential role in systems administration, due to the disposable nature of modern application environments. Configuration management tools such as Ansible are typically used to streamline the process of automating server setup by establishing standard procedures for new servers while also reducing human error associated with manual setups.Ansible offers a simple architecture that doesn’t require special software to be installed on nodes. It also provides a robust set of features and built-in modules which facilitate writing automation scripts.This guide explains how to use Ansible to automate the steps contained in our guide on How To Install and Use Docker on Ubuntu 22.04. Docker is an application that simplifies the process of managing containers, resource-isolated processes that behave in a similar way to virtual machines, but are more portable, more resource-friendly, and depend more heavily on the host operating system.PrerequisitesIn order to execute the automated setup provided by the playbook in this guide, you’ll need:One Ansible control node: an Ubuntu 22.04 machine with Ansible installed and configured to connect to your Ansible hosts using SSH keys. Make sure the control node has a regular user with sudo permissions and a firewall enabled, as explained in our Initial Server Setup guide. To set up Ansible, please follow our guide on How to Install and Configure Ansible on Ubuntu 22.04.One or more Ansible Hosts: one or more remote Ubuntu 22.04 servers previously set up following the guide on How to Use Ansible to Automate Initial Server Setup on Ubuntu 22.04.Before proceeding, you first need to make sure your Ansible control node is able to connect and execute commands on your Ansible host(s). For a connection test, check Step 3 of How to Install and Configure Ansible on Ubuntu 22.04.What Does this Playbook Do?This Ansible playbook provides an alternative to manually running through the procedure outlined in our guide on How To Install and Use Docker on Ubuntu 22.04. Set up your playbook once, and use it for every installation after.Running this playbook will perform the following actions on your Ansible hosts:Install aptitude, which is preferred by Ansible as an alternative to the apt package manager.Install the required system packages.Install the Docker GPG APT key.Add the official Docker repository to the apt sources.Install Docker.Install the Python Docker module via pip.Pull the default image specified by default_container_image from Docker Hub.Create the number of containers defined by the container_count variable, each using the image defined by default_container_image, and execute the command defined in default_container_command in each new container.Once the playbook has finished running, you will have a number of containers created based on the options you defined within your configuration variables.To begin, log into a sudo enabled user on your Ansible control node server.Step 1 — Preparing your PlaybookThe playbook.yml file is where all your tasks are defined. A task is the smallest unit of action you can automate using an Ansible playbook. But first, create your playbook file using your preferred text editor:nano playbook.yml CopyThis will open an empty YAML file. Before diving into adding tasks to your playbook, start by adding the following:playbook.yml--- - hosts: all become: true vars: container_count: 4 default_container_name: docker default_container_image: ubuntu default_container_command: sleep 1 CopyAlmost every playbook you come across will begin with declarations similar to this. hosts declares which servers the Ansible control node will target with this playbook. become states whether all commands will be done with escalated root privileges.vars allows you to store data in variables. If you decide to change these in the future, you will only have to edit these single lines in your file. Here’s a brief explanation of each variable:container_count: The number of containers to create.default_container_name: Default container name.default_container_image: Default Docker image to be used when creating containers.default_container_command: Default command to run on new containers.Note: If you want to see the playbook file in its final finished state, jump to Step 5. YAML files can be particular with their indentation structure, so you may want to double-check your playbook once you’ve added all your tasks.Step 2 — Adding Packages Installation Tasks to your PlaybookBy default, tasks are executed synchronously by Ansible in order from top to bottom in your playbook. This means task ordering is important, and you can safely assume one task will finish executing before the next task begins.All tasks in this playbook can stand alone and be re-used in your other playbooks.Add your first tasks of installing aptitude, a tool for interfacing with the Linux package manager, and installing the required system packages. Ansible will ensure these packages are always installed on your server:playbook.yml tasks: - name: Install aptitude apt: name: aptitude state: latest update_cache: true - name: Install required system packages apt: pkg: - apt-transport-https - ca-certificates - curl - software-properties-common - python3-pip - virtualenv - python3-setuptools state: latest update_cache: true CopyHere, you’re using the apt Ansible built-in module to direct Ansible to install your packages. Modules in Ansible are shortcuts to execute operations that you would otherwise have to run as raw bash commands. Ansible safely falls back onto apt for installing packages if aptitude is not available, but Ansible has historically preferred aptitude.You can add or remove packages to your liking. This will ensure all packages are not only present, but on the latest version, and do after an update with apt is called.Step 3 — Adding Docker Installation Tasks to your PlaybookYour task will install the latest version of Docker from the official repository. The Docker GPG key is added to verify the download, the official repository is added as a new package source, and Docker will be installed. Additionally, the Docker module for Python will be installed as well:playbook.yml - name: Add Docker GPG apt Key apt_key: url: https://download.docker.com/linux/ubuntu/gpg state: present - name: Add Docker Repository apt_repository: repo: deb https://download.docker.com/linux/ubuntu jammy stable state: present - name: Update apt and install docker-ce apt: name: docker-ce state: latest update_cache: true - name: Install Docker Module for Python pip: name: docker CopyYou’ll see that  apt_key and apt_repository built-in Ansible modules are first pointed at the correct URLs, then tasked to ensure they are present. This allows installation of the latest version of Docker, along with using pip to install of the module for Python.Step 4 — Adding Docker Image and Container Tasks to your PlaybookThe actual creation of your Docker containers starts here with the pulling of your desired Docker image. By default, these images come from the official Docker Hub. Using this image, containers will be created according to the specifications laid out by the variables declared at the top of your playbook:playbook.yml - name: Pull default Docker image community.docker.docker_image: name: "{{ default_container_image }}" source: pull - name: Create default containers community.docker.docker_container: name: "{{ default_container_name }}{{ item }}" image: "{{ default_container_image }}" command: "{{ default_container_command }}" state: present with_sequence: count={{ container_count }} Copydocker_image is used to pull the Docker image you want to use as the base for your containers. docker_container allows you to specify the specifics of the containers you create, along with the command you want to pass them.with_sequence is the Ansible way of creating a loop, and in this case, it will loop the creation of your containers according to the count you specified. This is a basic count loop, so the item variable here provides a number representing the current loop iteration. This number is used here to name your containers.Step 5 — Reviewing your Complete PlaybookYour playbook should look roughly like the following, with minor differences depending on your customizations:playbook.yml--- - hosts: all become: true vars: container_count: 4 default_container_name: docker default_container_image: ubuntu default_container_command: sleep 1d tasks: - name: Install aptitude apt: name: aptitude state: latest update_cache: true - name: Install required system packages apt: pkg: - apt-transport-https - ca-certificates - curl - software-properties-common - python3-pip - virtualenv - python3-setuptools state: latest update_cache: true - name: Add Docker GPG apt Key apt_key: url: https://download.docker.com/linux/ubuntu/gpg state: present - name: Add Docker Repository apt_repository: repo: deb https://download.docker.com/linux/ubuntu jammy stable state: present - name: Update apt and install docker-ce apt: name: docker-ce state: latest update_cache: true - name: Install Docker Module for Python pip: name: docker - name: Pull default Docker image community.docker.docker_image: name: "{{ default_container_image }}" source: pull - name: Create default containers community.docker.docker_container: name: "{{ default_container_name }}{{ item }}" image: "{{ default_container_image }}" command: "{{ default_container_command }}" state: present with_sequence: count={{ container_count }} CopyFeel free to modify this playbook to best suit your individual needs within your own workflow. For example, you could use the docker_image module to push images to Docker Hub or the docker_container module to set up container networks.Note: This is a gentle reminder to be mindful of your indentations. If you run into an error, this is very likely the culprit. YAML suggests using 2 spaces as an indent, as was done in this example.Once you’re satisfied with your playbook, you can exit your text editor and save.Step 6 — Running your PlaybookYou’re now ready to run this playbook on one or more servers. Most playbooks are configured to be executed on every server in your inventory by default, but you’ll specify your server this time.To execute the playbook only on server1, connecting as sammy, you can use the following command:ansible-playbook playbook.yml -l server1 -u sammy CopyThe -l flag specifies your server and the -u flag specifies which user to log into on the remote server. You will get output similar to this:Output. . . changed: [server1] TASK [Create default containers] ***************************************************************************************************************** changed: [server1] => (item=1) changed: [server1] => (item=2) changed: [server1] => (item=3) changed: [server1] => (item=4) PLAY RECAP *************************************************************************************************************************************** server1 : ok=9 changed=8 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 Note: For more information on how to run Ansible playbooks, check our Ansible Cheat Sheet Guide.This indicates your server setup is complete! Your output doesn’t have to be exactly the same, but it is important that you have zero failures.When the playbook is finished running, log in via SSH to the server provisioned by Ansible to check if the containers were successfully created.Log in to the remote server with:ssh sammy@your_remote_server_ip CopyAnd list your Docker containers on the remote server:sudo docker ps -a CopyYou should see output similar to this:OutputCONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES a3fe9bfb89cf ubuntu "sleep 1d" 5 minutes ago Created docker4 8799c16cde1e ubuntu "sleep 1d" 5 minutes ago Created docker3 ad0c2123b183 ubuntu "sleep 1d" 5 minutes ago Created docker2 b9350916ffd8 ubuntu "sleep 1d" 5 minutes ago Created docker1 This means the containers defined in the playbook were created successfully. Since this was the last task in the playbook, it also confirms that the playbook was fully executed on this server.ConclusionAutomating your infrastructure setup can not only save you time, but it also helps to ensure that your servers will follow a standard configuration that can be customized to your needs. With the distributed nature of modern applications and the need for consistency between different staging environments, automation like this has become a central component in many teams’ development processes.In this guide, you demonstrated how to use Ansible to automate the process of installing and setting up Docker on a remote server. Because each individual typically has different needs when working with containers, we encourage you to check out the official Ansible documentation for more information and use cases of the docker_container Ansible module.If you’d like to include other tasks in this playbook to further customize your initial server setup, please refer to our introductory Ansible guide Configuration Management 101: Writing Ansible Playbooks.