A few days ago a reader asked me if I could write a post about common uses of the Red Team Mindset. Think everyday activities, work, school and such. Think non-technical everyday Red Teaming.
Red Teams can solve problems through an indirect and creative approach, using reasoning that is not immediately obvious and involving ideas that may not be obtainable by using only traditional step-by-step logic.
Using “Ridiculous Thinking” a Red Teamer plays with the different sides of the problem, looking at it as if it was a hollow cube: you have the 6 external sides to check, however you can't forget the 6 internal sides. The idea here is to go beyond the visible, the obvious, and check also those extra things that no one bothered to look at before.
The application of this, coupled with other alternative analysis techniques provide a comprehensive set of potential adversarial attacks on a given concept, or in everyday parlance: it helps you decide whether something makes sense or not, whether something is right or not. It helps finding potential (or actual) problems with any given thing.
Red Teams attack the classic three fronts: digital, physical and human. Exploit each front and its weaknesses separately and you might bring some insight, however exploit them as a whole to generate a more successful view of a real scenario where the adversaries win. Take this and apply it to everyday activities. When confronted with a problem, try to look at it as if the problem has an external and an internal side. What can you see from the outside? What's the view from the inside? Where do the two fronts meet? Or they don't?
Once you have all your facts and you've collected enough intel you can then either attack the problem, if something is not right, or make a decision based on better information.
The same can be applied to your own plans. If you make it a habit to red-team your own thoughts and plans, you will be surprised with what you find. More often than not you will find ways around a solution you thought was the best and air-tight. It becomes relatively easy to look at things with a Red Team Mindset after doing it for a while. Once it's second-nature it's almost impossible to shut off.
Red teams play with situational awareness or lack thereof. Like an adversary, they identify patterns that lead to the breaking of the target. A good Red Team often exposes alternative ways to test policies and plans by using misdirection: using a noisy attack and let the target follow it, while having a secondary, stealthy, attack that it's the one that exploits the vulnerabilities found.
This often disrupts the way organizations react and more holes are found. Think about this when you are faced with a decision: what's the underlying reason for what's in front of you? Is there something else you are missing?
Ultimately, you want to have a general posture of being proactive, being aware, of thinking one or two steps ahead. It is a good idea to be prepared and establish problem detection measures as well as deception traps. Make a future attack harder. The more you think this way, the earlier it is for you to start seeing the signs and markers of problems coming your way. The more you analyze and assess your own plans and strategies, the easier it will be for you to spot weaknesses in the plan or future problems emerging from things that seemed trivial during the planning phase.
A proactive mindset will push you to seek better solutions for you and your friends and families. Your adversarial thinking provides the early-problem-detection that will not only help you make better decision, but help those around you have a better understanding of what they face.
Apply the Red Team Mindset as:
- Plan: Get your facts right, analyze the potential problems and make a plan.
- Execute: Once you get the plan ready, go for it. Stop occasionally to see if you missed anything on the initial assessment, but just execute.
- Vanish: Complete your plan and when you are done, move on. Focus on the next thing.
I hope this helps in understanding the Red Team Mindset. Like with everything, you need to practice and practice. Some people are born with the proper mindset; others need to learn it.
Oh, and don't forget Rule 1: Always have an escape plan.