Red Team Journal » Announcements

The First (Canadian) Red Teaming University and Conference

Robert J. Bunker — Fri, 08 Apr 2011 17:14:32 +0000

The First Red Teaming University and Conference was held in Kingston, Canada, from 16 to 18 March 2011. It was presented by the Adversarial Intent Section, Defence Research and Development, Canada Toronto; Defence and Security Research Institute; Centre for Security, Armed Forces and Society; Queens Centre for International Relations; and the Royal Military College, Canada. Additional participating groups included University of Foreign Military and Cultural Studies, Fort Leavenworth, Kansas; Red Teaming representatives, United States Marine Corps; Joint Force Command, North Atlantic Treaty Organization; International Society of Military Sciences; Global Futures Forum; Vancouver Olympic Games Red Team (historical); and University of Greifswald, Germany.
      The conference was attended by approximately three dozen participants, predominantly from Canada, with delegates from the United States and some European countries also represented. Presenters included David Connell, DRDC; Col. Jeanne Arnold, UFMCS; Col. C.M. Benson, Ph.D., USA (Ret); Maj. Philip Cushman, USMC; Dr. David Last, RMC; Anthony Seaboyer, RMC; Dr. Genevieve Susemihl, University of Greifswald, Germany; Dr. J.D. Young, RMC; Maj-Gen. Ed Fitch, Canadian Forces (Ret); and Maj. Bruce Sand, Canadian Forces (Ret).
      University and Conference panels, workshops, and exercises took place on the Red Team Concept Explained, Alternative Methods (Intelligence, Military, and Law Enforcement), Creative Thinking, Specific Techniques, Canadian Experience & Experimentation, Red Teaming Exercise, the (Canadian) Red Team Project, National Perspectives on Red Teaming, Sudan: Exploring Alternative Analysis, ANSA: Exploring Alternative Perspectives, and Experimentation: New Tools for Red Teaming?
      Event lessons learned include:

The conference helped to teach key audiences about red teaming as it is currently practiced, report on research to support new forms of red teaming, and gauge interest in further development of red teaming in Canada.
Future red teaming activities may involve a major research project beginning in August, multinational collaboration through the Technology Cooperation Program (TTCP) with Australia, Britain, and the United States, and development of a new Canadian army capability.
Proceedings from the Conference and research papers funded under this initiative will be published by Defence Research and Development Canada after internal review.

These events were conducted in support of the facilitation of the creation of a Canadian approach to red teaming decision support and to provide leading-edge knowledge and tools to the Canadian security community. This initiative, the Red Teaming, Red Cells, and Decision Support Project, is a major program being implemented by the Canadian military forces in cooperation with other Canadian governmental agencies. For further information, contact Dr. David Last, Royal Military College, Canada at last-d at rmc dot ca.

Red Teaming Group on LinkedIn

Mark Mateski — Fri, 28 Jan 2011 23:15:02 +0000

Some time ago, I started a LinkedIn group for red teaming and alternative analysis (called, not surprisingly, “Red Teaming and Alternative Analysis”). I viewed it as an opportunity to engage red teamers and analysts in a forum qualitatively different from this one, which, as readers know, represents the more traditional post-and-comment blog format. I’d forgotten about the LinkedIn group until recently but still see utility in it. I have less time than I’d like to keep up on articles of import, advances in software, and people and companies of interest, and I think a forum to help red teamers do just that would complement RTJ nicely. I invite you to sign up for the group discuss how we might all benefit from it.

RTJ Occasional Paper Series

Editor — Tue, 27 Jul 2010 15:04:45 +0000

We are pleased to launch the Red Team Journal occasional paper series with an article by John P. Sullivan and Adam Elkus titled “Adaptive Red Teaming: Protecting Across the Spectrum.” In the article, John and Adam propose three methods of improving analytical red teaming and discuss each in turn. Additional papers in the series will follow in the coming months.

Cross-Domain Red Teaming

Raymond Parks — Fri, 23 Jul 2010 17:34:31 +0000

Cross-domain red teaming, also called multidimensional or full spectrum red teaming portrays real adversaries better than single-domain red teaming. Cross domain doesn’t refer to Microsoft domains or multilevel security domains. We’re talking about how attacks by real adversaries take advantage of three major security domains–cyber, physical, and human–to attack systems. Small digression–here at Sandia, we define systems as a combination of people, processes, and technologies–not as a computer system alone. Thus, cross-domain red teaming attacks systems through the people, their processes, and the technology (cyber or physical) to achieve the effect that the portrayed adversary would want.
      In 2003, Sandia’s assessment community embarked on a research program to understand how to portray real adversaries who move freely between the physical security domain and the cyber security domain. The Critical Infrastructure System of Systems Assessment Methodology (CISOSAM, pronounced “Shazaam”) research tried to understand the problem through a number of existing tools and methodologies–fault-tree analysis, adversary sequence diagrams, red team attack diagrams, and red team attack trees. The result of the research, in 2006, was a prototype software application that implemented a risk assessment methodology that explicitly accounts for both physical and cyber security while preserving the traditional security paradigm of detect, delay, and respond.
      Since that work, Sandia has recognized that at least one additional domain needs to be considered: the human domain of the people in the system. We’ve debated about adding a fourth domain–RF–to represent the radio frequency footprint of a system. For now, we consider RF to be contained within the physical domain because it is a physical process.
      Red teams currently use attack methods drawn from real adversary intrusion sets that are cross-domain. Two examples include spearphishing and war-driving. Spearphishing is the practice of crafting an email based on open-source intelligence (OSINT) about a particular person or class of persons in a target system. War-driving is the practice of using radio transceivers and computers to detect and attack technology that uses RF transmissions. The primary RF technology attacked in war-driving is the IEEE 802.11 family of wireless protocols, including WiFi and WiMax. Other targets of war-driving can include the IEEE 802.14 family which includes Bluetooth and Zigbee. Even radio frequency identification (RFID) can be a target of war-driving.
      In the case of spearphishing, the attacker starts in the cyber domain to obtain information about the human domain (OSINT), then moves back into the cyber domain to craft an exploit payload, which is sent in a human domain email to the target. When the payload executes, the attack moves back into the cyber domain. This happens relatively quickly and practitioners are so used to it we don’t think of the transitions, but they are there nonetheless.
      Each of these represents a chance to cause problems with a customer that we are red teaming. We could collect information that we have no authorization to collect–even though it is openly available. The customer may want the payload to be detectable, at least in theory, or they may allow custom payloads that will bypass rather than test defenses. The human target of the email can be part of a protected group (e.g. union-represented) which the customer wants exempted. The content of the email that entices the user into opening the delivery exploit may cause the target to contact some other human once the attached delivery fails–thus causing another person to get involved and potentially even leading to incident response including law enforcement. Finally, the customer may want the payload to be detectable or may allow for custom payloads. All of these transitions and steps in the attack need to be considered in rules of engagement and operational plans.
       In the case of war-driving, the attack starts in the physical domain, both in the RF sense but potentially in the sense of trespassing upon the physical location of the target. In our experience war-driving, we have been confronted by security guards because they thought we might be one of the vandals of cars in the parking garage–fortunately, they and other guards have no problem with antennae and laptops. Once a wireless network is detected, the attack shifts into the cyber domain as we analyze the type of RF transceiver (access point (AP) or ad-hoc), the network protocol (WEC or WPA) and the type of encryption. Cracking into a wireless network involves physically (RF) inserting cyber packets onto the airwaves. At some point, the attacker may gain access to the wireless network and engage in cyber attacks against other computers on that network. Each of these transitions and attack steps has implications with regard to rules of engagement and operational plans.
      The cyber domain is the one with which most red teamers are familiar. Some red teamers are familiar with the physical domain since they do close-access work. Finally, some red teamers are allowed to engage in attacking the human domain – the people and processes of the system.
      Real adversaries use a full-spectrum of attack techniques and take advantage of the overlapping of the three domains to bypass defenses, jumping back and forth between the domains. Red teamers need to able to do the same thing and the customers of red teamers need to allow that process.
      If you would like to discuss these issue in depth, Sandia National Laboratories and The Johns Hopkins University Applied Physics Laboratory are sponsoring a workshop, RT2010: Planning for Cross-Domain Red Teaming, on 2-4 August 2010 at JHU/APL in Laurel, Maryland. This workshop is intended for red team planners, managers, and leads and the customers of red team services within the U.S. Government. If you do not feel you are the right person to participate, feel free to pass this invitation on to the right person in your organization. This will be a real, working event from which all participants will take away useful tools for planning red teaming that seamlessly operates in the cyber, human, and physical domains. The workshop will take place at the Secret level and there will be a $50.00 fee to cover security and refreshments.
      Sandia has an informational web-site that points to the registration web-site which JHU/APL has set up for the workshop participants to register, pay, and get information on sending clearances, getting directions, and finding a hotel. The intended audience for this workshop is not the shooters but the planners, managers, project leads and customers of red teams. This is their chance to get templates for rules of engagement and operational plan that include network, close access, and social engineering. Even if you can’t go yourselves, please pass the information on to customers that have concerns about allowing red teams full authorization for full-spectrum red teaming. They can help by suggesting possible limits and workarounds to allow red teams to portray real adversaries as realistically as possible while staying legal.

Raymond Parks is the point of contact for Sandia’s Information Design Assurance Red Team.

The Shadow of Limited War

Adam Elkus — Thu, 15 Jul 2010 05:18:43 +0000

One of the biggest hot-button issues in strategy today is limited war. The degree of restraint and the amount of force that can be employed without jeopardizing the mission is both an ethical and operational controversy in counterinsurgency theory and practice. There’s also a growing frustration over the way that the West has been constrained in utilizing force against irregulars and rogue states that do not play by the rules. Shelby Steele’s June 21 op-ed, “The Surrender of the West” typifies a certain kind of reaction to this feeling of futility. The problem, however, is that we have been living in an era of what might broadly can be called “limited warfare” for over sixty years. And this limit may be structural.
      To be sure, talk of “limits” are relative. Clausewitz instructs us that the concept of “absolute war” exists mostly in theory. And even wars fought under limitations or limited political objectives can be horribly destructive. In 1991, we fought a (somewhat unsuccessful) battle of annihilation against the Iraqi Army that while failing to completely eliminate Saddam Hussein’s forces certainly devastated them and routed them. And the “clear” phase of the Surge was, by all accounts, rougher than many imagine. But there is a common thread going back from the beginning of the Cold War of steadily increasing limitations on action.
      In the 1930s, Basil Liddell-Hart moved from writing about infantry tactics and maneuver operational theory to strategy. The doctrine of “limited liability” and the idea of the offshore-based “British Way in Warfare,” coupled with Liddell-Hart’s endorsement of strategic bombing theory, created the prototypes for a number of contemporary doctrines–containment, today’s “over-the-horizon” strike, and the idea of “limited warfare.” They did not really catch on (with the notable exception of British intellectuals) and were followed by the most destructive conflict in human history. But Azar Gat argues (convincingly) that these doctrines really set the stage for how a certain faction of military and civilian intellectuals perceived the next stage of strategic history. Especially since nuclear weapons created an powerful set of external limitations.
      From the 1950s onwards, an entire science of “limited warfare” sprang up, devoted to figuring out how the West could accomplish its objectives short of general war with the Soviet Union and China. In short, squeezing the maximum of strategic effect from a calculated minimum of force. These questions were very serious. How does one calculate the relative value, say, of the defense of a small island chain off the coast of Taiwan in the 1950s, as Thomas Schelling did in Arms and Influence? How does one defend against a calculated campaign of state-supported terrorism, guerrilla warfare, and political subversion, as Western states did from the 1950s up to the late 80s? It is here that the whole concept of the “War of Ideas” originated, and the bare bones of modern irregular warfare theory sprung up.
      Limited warfare, from the beginning, frustrated the military. McArthur’s jeremiad against Truman was based on Truman’s refusal to let him expand the theater of war into China. The postwar military consensus critique of Vietnam, as embodied in the tremendously influential book On Strategy, argued that the United States erred in not taking the fight to Hanoi directly. And today, as Crispin Burke notes, there is a distinct body of military literature that seems to take a similar tack about the modern “Long War.” The main debate about strategy in Afghanistan is about different forms of limited warfare–a counterinsurgency campaign that does not cross over the border into the Pakistani sanctuary vs. a stripped down “limited liability” approach that Basil Liddell-Hart might have heartily approved of.
      That being said, limited warfare also not just structural–it is, to take a Constructivist approach, a way the West views the use of force. As I’ve noted in my last post, the embedded liberalism in how many intellectuals perceive international relations acts as a self-imposed set of limitations in the employment of force. Israel, for example, which tends to have a drastically different strategic culture than most in the West, does not play by these limitations and now finds itself somewhat isolated as a result. The fact these limitations–both structural and self-imposed– exist is a source of great consternation for many defense intellectuals, who rage over the existence of a situation in which terrorists and insurgents escape criticism while nation-states who fight them are put under a microscope. The problem, however, will not go away.
      For a variety of reasons (nuclear weapons, the economy, the UN, interdependence, etc), limited wars are likely to continue. This doesn’t mean that limited wars will not be harsh or intense–the 1973 Yom Kippur War featured some of the most intense tank warfare since Kursk, after all. But what could have been a ruinous defeat of the Egyptian-Syrian alliance was capped off by the intervention of the Soviet Union and a UN-imposed ceasefire. Moreover, the West has made a cultural choice that it wants to live in a world of “liberty under law.” In the long run, this may or may not be the correct grand strategy–the debate in international relations theory never ends. But this choice has been culturally made, and perhaps as early as 1919 with Wilson’s vision of a harmonious world.
      So strategists ought to start thinking, as their forefathers did, about how force might employed under these constraints to achieve our objectives. We can start by re-examining the canon of limited war theory and history, and extracting the nuggets while discarding the duds. We can also, in our taxonomy of future war debate, abandon the dichotomy between Soviet Operational Maneuver Groups (OMGs) streaming through the Fulda Gap and light infantry chasing bandits in the jungle. Limited wars range from counterterrorism actions to large-scale conventional wars like the Indian campaign in modern-day Bangladesh. We ought to study the Israelis’ great Sinai campaign in 1956 as intently as we study the British in Malaya or the French in Algeria.
      That being said, the time of limited war we are living in may be an epoch that is soon to pass, as Victor Davis Hanson suggests. We ought to carefully consider whether or not our assumptions about limited war are presentism projected into the future. Napoleonic warfare, for example, did not conform to the outlines of 18th century warfare, and we might be making the same mistake as those who predicted the political-military arrangements of that period would last into the future. But since no one has a crystal ball, the record of the last 60 years provides ample data for consideration about the future.

Modeling and Simulation Update

Editor — Tue, 27 Apr 2010 15:13:14 +0000

Regular RTJ readers will remember the article by Michael Skroch from last December titled “Modeling and Simulation of Red Teaming, Part 1.” For those who are interested in this topic, it’s worth visiting the updated Umbra site. The site offers information on the Umbra simulation engine as well as Dante, Operations Viewshed, and other related tools. As the site notes, “Umbra and derivative applications are generally export controlled, and are available for U.S. government use. Umbra may be available for universities and industries through various licensing arrangement[s].”

Open Forum on Millennium Challenge

Adam Elkus — Mon, 27 Jul 2009 21:30:36 +0000

Charles Martel writes in to challenge what he views as the hegemonic interpretation of the Millennium Challenge 2002 wargame:

The key to Red Teaming is to ascertain and draw conclusions based on the facts and not just conventional wisdom. …[Van Riper's] actions during the experiment pointed out flaws in the implementation of some of the concepts under study. Those failures were documented then the experiment continued. van Riper was upset that the experiment wasn’t halted in the middle since ‘he had won.’ The leadership at the time felt it was better to reset the conditions and see how the concepts could be applied after the bluefor had learned a hard lesson. As a result of the experiment, some of the experimental concepts were canned, others modified. Seemed like exactly what an experiment is supposed to do.”

As perhaps the most controversial wargame of recent times, MC2002 undoubtedly provokes strong discussion. So I’ll open this up to RTJ readers: is the current interpretation of MC2002 wrongheaded? Has the process of mythmaking clouded accurate analysis? Does MC2002 have relevance to greater US defense policy and strategy, or is it a relic of the Rumsfeld age? Lastly, did MC2002 pose a fatal blow to some Transformation concepts or simply indicate correctable flaws? We would especially like to hear from those involved in the exercise.

A Call for Papers at the Journal of Strategic Security

Editor — Tue, 21 Jul 2009 14:24:13 +0000

Red Team Journal readers may be interested in the latest call for papers (PDF) at the Journal of Strategic Security. The topic is insurgency and terrorism, and the deadline for submissions is 31 August 2009. The journal is seeking insights and ideas of the sort red teamers generate. As they note in the call, “your creativity and unique perspective are welcome.”

Reciprocal Net Assessment: Pro Bono Analysis

Mark Mateski — Wed, 15 Jul 2009 14:11:43 +0000

In the past few months, I have built and refined an approach to analysis I have dubbed reciprocal net assessment (RNA). It is based on principles inherent in hypergame analysis and is designed to encourage analysts and decision makers to avoid decision breakdowns and create and exploit decision opportunities. Although I am still refining the approach, I now believe it is ready for testing. I am currently offering pro bono analysis of two cases: one military- or security-related and the other business-related. If you might be interested in submitting a case for consideration, read on.
The need for RNA is rooted in the following conditions:

Competition and conflict involve a continuous, dynamic interaction, sometimes described as the reciprocal nature of conflict.
Within this domain, a participant will seek to achieve a differential advantage over his or her opponents.
Rarely do all participants in a conflict or competition perceive precisely the same situation.
All perceptions are open to manipulation.

Given these conditions, a participant may pursue an almost unlimited number of strategies. Many of these strategies will be highly contextual, but patterns do exist. Successful participants, for example, will be likely to

understand and respect the potentially complex interplay of opposing strategies and perceptions;
manipulate the opponent’s perceptions and biases;
exploit seams and opportunities;
exploit the elasticity of risk; and
resist their opponent’s efforts to do the same in reverse.

Presuming a static opponent is the main decision making flaw that drives the need for red teaming, yet the red team itself may also presume it faces a static opponent. To complete the loop, the analyst or decision maker should “red team” the red team or, in other words, account for the actual and perceptual interplay between the attacker and defender (roles which may themselves may be dynamic). Traditional forms of red teaming, I believe, do not address this issue adequately. A more complete form of analysis would emphasize (1) what each participant could or might do to the other and (2) how awareness of this interplay offers advantages to the participant who possesses this awareness. I view RNA as one possible form of this more complete analysis.
RNA is based on five basic concepts, each of which is either stated or implied within the game theoretic structure of hypergame analysis:

Any player may perceive or misperceive the other players’ options, preferences, and intent.
What each player perceives or misperceives influences each player’s intent.
Perceptions are based on information and awareness.
Perceptions can be manipulated.
A player who perceives an opponent’s misperception secures an advantage.

These five concepts are captured in two complementary diagrams. The first diagram—the wheel (figure 1)—portrays the reciprocal nature of decision opportunities. The second diagram—the ladder—portrays the advantage a player gains by perceiving another player’s misperception. If applied properly, the RNA diagrams should encourage red teamers, analysts, and decision makers to consider the perceptual aspects of conflict much more explicitly and systematically than they might otherwise. By varying the aspects of perception and misperception using these diagrams, it is possible to generate critical scenarios that intuition may overlook. These scenarios may in turn help decision makers avoid decision pitfalls and recognize decision opportunities.

Figure 1: “The wheel”–one of the two main RNA diagrams.

If this approach sounds like it might be of use to you, consider submitting a case. Again, of the cases submitted, I will choose two to analyze: one from the military or security domain and another from the business domain. A good case will embody a strong potential for misperception, deception, and surprise. Cases must be unclassified, and you must be willing to allow me to publish the results of the analysis here or elsewhere. I am, of course, willing to genericize the case as necessary for publication. To submit a case for consideration, draft a one-page description and send it directly to me at editor at redteamjournal dot com. The deadline for submissions is 1 August 2009.

IDART Web Site Redesign

Editor — Mon, 18 May 2009 15:01:13 +0000

Sandia National Labs’ Information Design Assurance Red Team (IDART) recently redesigned its Web site. The new site features some useful resources, including information on the IDART methodology, the Red Teaming for Program Manager’s (RT4PM) course, red teaming metrics, and red teaming threat matrices. Whether you want to hire Sandia to red team for you or not, the site is worth bookmarking as a valuable source of information.