Behemoth and Leviathan
As nice as it would be to fit the systems we red team into a convenient box, it will never happen, and we have the Behemoth and the Leviathan to thank for that.
This past weekend, I read Harold Kushner’s The Book of Job: When Bad Things Happened to a Good Person. In the book, Kushner describes the Behemoth and the Leviathan in terms that are relevant to red teamers. The Behemoth, he says, is human ambition, in all its erratic brilliance and troubling menace. The Leviathan is nature, in all its overwhelming majesty and shocking power. Let’s not blame God for the powers of the Behemoth and the Leviathan, Kushner tells us; in other words, these are the immanent and necessary conditions of mortality, the peril and potential of life—the conditions (and potential conditions) red teamers must confront daily.
In our world, the insider with access to all our secrets is the Behemoth, and the flood that overturns our plans and knocks our systems offline is the Leviathan. The Behemoth and the Leviathan can ruin a client’s day, especially if the client chooses to believe that bad things will never happen. But the Behemoth is also the technician who notices something amiss, and the Leviathan is the storm that sweeps the enemy fleet from the sea.
Red teamers and their clients who overlook or dismiss the Behemoth and the Leviathan court surprise. Red teamers and their clients who attempt to swindle the Behemoth and the Leviathan risk misfortune. Red teamers and their clients who face Behemoth and the Leviathan squarely, conceding both risk and opportunity, excel.