Cybersecurity is a team sport  
       08/26/2022
      Created by Noureen Njoroge | Cybersecurity Consulting Engineer Cisco Systems | Global Mentoring Ep#10 Slides
                                        • Independent OPFOR “opposing force”
                                        • (0rganic groups that challenge the org to 
                                          improve its effectiveness by pretending to be 
                                          the opposing force)
       The RED                          • They are also known as Alternative analysis: 
       Teaming 
                                        Where the team test the assumptions of the 
                                           org and potentially expose the weaknesses.
                                        They are experienced security professional that 
                                           often perform pen testing in accordance of 
                                           rules of engagement of the organization.
         08/26/2022                  Created by Noureen Njoroge | Cybersecurity Consulting Engineer Cisco Systems | Global Mentoring Ep#10 
                                                          Slides
       08/26/2022                     Created by Noureen Njoroge | Cybersecurity Consulting Engineer Cisco Systems | 
                                                Global Mentoring Ep#10 Slides
                                                 What makes a Blue Team 
                                                    vs. just doing defensive 
       The BLUE                                     things is the mentality. 
       Team                                     The distinction is as follows 
                                                • A proactive vs. reactive mindset
                                                • Endless curiosity regarding things that are out of the ordinary
                                                • Continuous improvement in detection and response
                                                • It’s not about whether someone is a self-taught tier-1 SOC 
                                                  analyst or some hotshot former Red Teamer from Carnegie 
                                                  Mellon. It’s about curiosity and a desire to constantly improve.
          08/26/2022                       Created by Noureen Njoroge | Cybersecurity Consulting Engineer Cisco Systems | 
                                                      Global Mentoring Ep#10 Slides
                                            •
                                             What makes a blue team different is that once a red team 
                                            imitates an attacker and attacks with characteristic tactics 
                                            and techniques, a blue team is there to find ways to defend, 
                                            change and re-group defense mechanisms to make incident 
                                            response much stronger.
                                            •
                                             The BLUE Team  needs to be aware of the same malicious 
                                            tactics, techniques and procedures in order to build 
                                            response strategies around them. And blue team activity 
                                            isn’t exclusive to attacks. They’re continuously involved to 
     The BLUE                               strengthen the entire digital security infrastructure, using 
                                            software like an IDS (intrusion detection system) that 
          Team                              provides them with an ongoing analysis of unusual and 
                                            suspicious activity.
                                            •
                                             Some tasks include: DDOS Testing, tabletop exercises, 
                                            Reverse engineer, events logs analysis, security audits etc..
      08/26/2022                         Created by Noureen Njoroge | Cybersecurity Consulting Engineer Cisco Systems | 
                                         Global Mentoring Ep#10 Slides