Security Operations in Practice

11 RED TEAMING AND THREAT HUNTING

At the beginning of this book, I ran through the typical life cycle of a security operations team. So far, as we’ve progressed through the chapters, we’ve tracked along nicely with that life cycle. From early inception in response to a specific business need, to the birth and eventual maturity of defensive, or blue team, capabilities. Now, it’s time to put our work to the test, as we switch gears, turn red, and change our focus to offensive security operations.

The purpose of a red team is to simulate the approach of an adversary, testing our defences and validating the hard work we’ve put in, but also to ensure that we, as a security operations team, are constantly in a state of ongoing improvement. That’s ...