Red Blue or Kung Fu

Recently I came across a security blog sighting the use of red and blue teams for internal auditing if you will. This could be a good thing since it is sort of thinking outside of the box . I do mention sort of. Since the dawn of computers people have been using tools to conduct audits on resources. Some of the well know from back in the 90's such as AutoHack. You know you remember using it. This was basically Pentesting. So the value of red blue teams really depends of the skill of the team member. Will it give you a fuzzy happy safe feeling that I trained Offensive Security and that I can write a buffer overflow or that I can script a quick html and BEEF and pwn. I say yes and no. Let me digress. I have been trained in the martial arts for over 21 years and understand the dynamics of defensive and offensive tactics. Yes I have read " The art of war". What I am getting at is that I was the best in my dojang. Yes. Did I do fairly well in local tournaments? Yes. Did I rock when at colorado OTC. No. How about the US OPEN. No. This is the no part. Is your team the best of the best? If they are using the tools and being a monkey and see-and-do from a video I say no. If your members can script there own exploit with ruby,python, perl...etc and really think outside the box and attack then it is a good idea.

Now the use of red/blue as an outcome I am not really sure about. In my eyes Red team if well versed will always pwn. Using the team as a means to redirect the income again will just be putting you back in a blue / defensive behavior. Now add a social aspect to team and you have an even more complex scenario. For example red team fail to capture the flag as you will on a test system it is demed compliant. Operator at said compiant system get rooted from a zero day or BEEFd site and blew the security. I guess a prime example is pwn to own. If you were to take attack vector 1 day one as said security. All systems are compliant they didn't hacked. Add human social interaction the playing field changes and said system is no longer compliant. So add the social factor to the RED team and you are getting more rounded.

So just as a recap. There are people smarter, faster, more cunning than you or your team. If this statement was false I wouldn't be writing this and life would be happy and my brother wouldn't have called me and hour ago complaining about antivirus 2010 on his system. So what part does a red team really get us? Really to make us better blue team.. because they are smarter and faster so we must defend. ../../

how much detection is enough

This week I have added an additional layer of security with a great product called Sguil. Yes I know it has been around and Yes I know I have toyed with it before and felt that at the time I didn't need the granularity that it provides hence the reason that I have been using BASE. The need has arisen with the growth of security issues and the need for security escalation. Being a one man show things can be a little daunting and using BASE it added a little more overhead on me since I did have to trace pcap's just to make sure that nothing really did happen and if it did what happened. With Sguil I should get that and have the overhead transfered to the software in a single console. Maybe I can get a little rest then. If you are looking to do the same there are several pieces of of software that will get you going fast such as nsnnow and the boot-able security onion that works great if you are looking to give it a test run.. it has the nice feature of being able to run snort 3.0 woohoo. Anyway good luck to all NSM's out there and bad_mojo stay away from my net , my little ones keep me up enough as is. ../../

What happened to stegnography?

In light of the recent rise of security and all the posts I recently viewed a video posted on taosecurity blog and noticed a few of the programs such as Autohack that brings to mind the time spend at MSU and windows 95 was fresh and the scope of the computer landscape was changing . AHHH the late 90's. This brings to mind other security issues that seemed to have come to pass such as stenography. The days of Stegdetect seems to have passed. How often do I come across Steg... Never. Does this mean that is it dead? Possibly, especially with how well encryption has become and with the 4th amendment they don't have to give out the passwords. So we as security minded have to turn to brute force to decrypt. Still it baffles me that are not using steg with encyption to store there most valuables or communicate. Maybe it is .. ../../