Many thanks to the great folks at XQ Digital Resilience, who have sponsored my writing for the past week.
In the era of cyber insecurity many mature organisations have little or no idea of their security and resilience posture. They invest significant sums on people, processes and technology, and yet they often never subject themselves to any realistic testing. In a recent report, Accenture estimates that as few as 9% of businesses run inward directed attacks that emulate real word adversaries or simulate major failures in IT.
Red teams have been around since the Cold War and the concept is now beginning to be adopted in the cyber security world. Red teams simulate the ‘bad’ guys. They launch physical, social and digital attacks that mimic the behaviour of threat actors.
As well as identifying gaps in defences, they also measure resilience (how well you fail, how quickly you might recover). They can test the effectiveness of your cyber defence team as well as your outsource service providers, and they spot where you are wasting money on stuff that doesn’t work. They can inform you when your investments are being undermined by error or omission. They identify training, technology and process fixes to enhance security. They guide investment and prevent money being wasted. Above all, they inform risk management with ground truth.
Despite initial low adoption the idea is slowly gaining traction. The Bank of England now mandates the CBEST scheme for Tier 1 Banks. Barclays recently announced the formation its own internal red team capability.
XQ are red team specialists. They train and develop red teams, or provide red teaming services where a truly independent view is required.
They are currently offering a free 1-day workshop for organisations considering red teaming. At the end of the session, which costs nothing and is commitment-free, you’ll have a blue print for your own red teaming exercise that can be used to build your own red team, conduct your own exercise or procure a service from a trusted third-party.
If you’re interested in exclusively sponsoring my site for a week, and reaching an IT-savvy audience that cares about cybersecurity, you can find more information here.