-: So in the last lesson we talked about penetration tests,
in this lesson we're gonna talk about
a little bit different test called
a security exercise and testing.
Now what's the difference?
Well we use a lot of the same skills
and even sometimes the same people
but there is a big difference.
In penetration testing we are dealing with it
on a live production network but when we start dealing
with a security test we're actually gonna do this
on a simulated environment not our production network.
So these security exercises can put
penetration testers and defenders against each other
and give each of them more training.
The way we do this is we're gonna
use something like a virtual environment
that simulates what our real world environment looks like.
That way the bad guys, the Red Team here,
is gonna be able to take down the network if needed
and the Blue Team is gonna try
to keep that network up and running.
There's three types of teams, Red, Blue, and White,
when you do one of these security tests.
The Red Team is gonna participate as the attacker.
These are your bad guys.
Their job is to do the reconnaissance
and the exploitation and try to gain access
to the network and take it down.
And because you're dealing with a simulated area
a lot of times they can go a little bit further
than a pen tester really would.
So they can actually create havoc on your network
and delete hosts and delete files
and take the network down where you wouldn't
wanna do that in a production environment.
You can do that here in a security testing exercise
because it's in a simulated environment.
Now conversely to the Red Team we have the Blue Team.
And the Blue Team is gonna participate as your defenders.
These are your system administrators
and your network administrators
and your vulnerability analysts.
These people are gonna have the job
of trying to secure the network as best as they can
and attempt to keep the Red Team out,
or to minimize the damage caused by the Red Team.
And the real benefit in the security exercise
is the Blue Team, your defenders,
are getting exercised on how they're gonna go through
their defensive posture and how they're
gonna kick a bad guy off the network.
That Red Team, those malicious actors,
are pretending to be the bad guys
and if they hack into the network
how is the Blue Team gonna eradicate them
and clear the network from them?
That's the whole benefit here inside the security exercise.
You can play all that out
in real time on a virtualized network.
So if we have Red Team and we have Blue Team
we have one more team we have to have
and that's the White Team.
The White Team is gonna be your referee.
They're the ones who are overseeing this whole exercise
and making sure that everyone is participating by the rules.
They coordinate the exercise
and they arbitrate any disputes.
So when the Red Team says, "No, I did this",
and the Blue Team says, "No but we blocked it this way",
the White Team acts as the referee.
Their job is to maintain the simulated environment
and make sure the exercise is going as planned
within the parameters that you've set up.
So that's it, that's the idea
of a security testing and exercise.
It's just like a pen test, the only difference
is you're not doing it on the live network
and it's more of a game, it's more for training.
And it's a really great way to get your Blue Team,
your system administrators and your defenders
additional training and hands-on experience
on what an attack looks like.