Incomplete Thought: The Psychology Of Red Teaming Failure – Do Not Pass Go…
team fortress red team (Photo credit: gtrwndr87)
I could probably just ask this of some of my friends — many of whom are the best in the business when it comes to Red Teaming/Pen Testing, but I thought it would be an interesting little dialog here, in the open:
When a Red Team is engaged by an entity to perform a legally-authorized pentest (physical or electronic) with an explicit “get out of jail free card,” does that change the tactics, strategy and risk appetite of the team were they not to have that parachute?
Specifically, does the team dial-up or dial-down the aggressiveness of the approach and execution KNOWING that they won’t be prosecuted, go to jail, etc.?
Blackhats and criminals operating outside this envelope don’t have the luxury of counting on a gilded escape should failure occur and thus the risk/reward mapping *might* be quite different.
To that point, I wonder what the gap is between an authorized Red Team action versus those that have everything to lose? What say ye?
/Hoff
Related articles
Recent Comments