AuthorMark Mateski

Syria: Asking the Right Questions (Before and After)

S

The recent U.S. decision to hit a Syrian air field with cruise missiles has triggered a flurry of questions, both in the United States and abroad. It reminds me of RTJ Red Teaming Law #34 (“Question”): In many ways, the art of red teaming is actually the art of asking the right questions, from the right perspective, at the right time. Ask the wrong questions, and it almost doesn’t matter how well...

When to Red Team: Balancing Costs and Uncertainty

W

In my last Red Teaming 101 Webinar, I shared a concept that I often discuss in my red teaming courses. It involves the issue of when you should red team the system of interest, where the system is some combination of people, technology, or processes. Like many issues connected with red teaming, the short answer is “it depends,” the middling answer is “it’s a tradespace,” and the long answer...

Con and Hypercon: Cultivating the Eye of the Sly Jester

C

At Black Hat USA 2014, I shared a diagrammatic method of perceiving what I call con and hypercon.1 A con is just what it sounds like: a state in which one actor attempts to deceive another, most often to do something that benefits the first and hurts the second. Phishing is a con as is “the big store” in the movie The Sting as is—more generally—any case in which one actor willingly...

‘Sitting Around Thinking’—Well … Yeah

&

I spoke briefly yesterday with a gentleman who runs a successful pentesting company. For the most part, I get what he does, but I don’t think he got what I do, nor did he seem inclined to ask any questions to find out exactly what that might be. (At one point, he described my version of red teaming as “sitting around thinking,” which, of course, doesn’t make money!)...

The Annoying Red Teamer: A Philosophical Approach to the Problem

T

Red teamers can be annoying. Sometimes the annoyance is justified, sometimes not. After all, who likes to be told that they overlooked a key assumption or failed to implement a sensible practice? It’s not surprising that many people resist even the idea of red teaming.       As red teamers, we often lament the shortsightedness of this resistance. What we don’t...

Categories

Terms of Use

Please read.