What It Takes to Build the Blue Team of Tomorrow – Security Intelligence

A good defense takes some testing. Ethical hacking involves pitting two teams together for the sake of strengthening digital security defenses. The red team attempts to bypass digital security barriers. By doing so, they reveal both misconceptions and flaws in their employer’s attack detection. Then, the blue team tries to defend against the red team’s attack attempts. Putting together a good blue team can be difficult. How do you make the best one you can?

Making the Most of This Exercise

Both red teams and blue teams need trained personnel and sufficient resources to make an ethical hacking exercise work. This can be challenging for blue teams.

One of the biggest obstacles is a lack of knowledge. Sometimes, it’s an issue of not knowing what defenders are. Here’s Bill Mahony, a head of cybersecurity, with some insight.

For people just starting out in security, I think part of the issue is the lack of understanding of what “blue team” actually is. The offensive security side certainly gets more press. I meet people who think it’s all about penetration testing and have little awareness of areas such as incident response, threat intelligence, etc. Without an understanding of what roles are actually available in cyber defense, it’s harder for people to identify and develop the skills they need to break into the industry.

Even when people are aware of the blue team, there can still be confusion around its nature. How does the defense team work, in practical terms?

“To be successful, defenders have to get it right 100% of the time, whereas when it comes to attackers, they need to get it right just that 1% of the time to break in and deliver a knock-out attack that halts business operations,” explained Jay Hira, a cybersecurity advisor. “This fact demonstrates how defenders must not just stay on top of security strategy for the business they’re defending but also have a deep and comprehensive knowledge of security detection and response tools and capabilities.”

Hiring for Blue Teams

This poses a bit of a problem. How are people supposed to develop that “deep and comprehensive knowledge” if they can’t gain entry into the industry? It’s a catch-22 of which James Hinton, an incident response team leader, is familiar.

“Many organizations desire candidates who have experience,” he noted. “This means it can be tough to get started in the industry.”

Plus, some employers aren’t as realistic as they could be with their job postings for defender roles.

<…….

Source: https://securityintelligence.com/articles/building-blue-teams-of-tomorrow/