Training for Incident Response: The Red, the Blue, and the Ugly
summary
Advocates run through concrete steps: start with purple team drills that pair detection with attack playbooks, move from tabletops to live tests using tools like Atomic Red Team and MITRE ATT&CK mappings, and validate assumptions about detection, telemetry and backups (time-to-telemetry can jump from seconds in lab to seven hours in production). Expect tooling gaps—about 25% of tools are unused or misconfigured and 74% of breaches involve humans—so schedule regular frequency, test containment/restore during maintenance windows, and use Backdoors & Breaches cards or an ICS sandbox to build repeatable fixes.
AI-written summary · about
chapters (21)
- 0:00Incident response training intro
- 1:04Why training matters
- 3:12Tabletop exercises basics
- 8:07Engaging tabletops
- 13:21Tabletop limitations
- 18:18False confidence risks
- 19:23Purple teaming beyond tabletops
- 23:21Testing complex systems
- 27:17Simplifying attack models
- 30:32Hackers' efficiency rules
- 33:39Preparation phase
- 35:46Vulnerability management risks
- 37:35Testing detection
- 38:59HTTPS as malware protocol
- 40:02Forensics in real envs
- 41:28Containment challenges
- 42:52Testing adversary persistence
- 43:34Eradication in OT
- 44:17Backup failures worst case
- 46:26Stress testing recovery
- 47:28Key takeaways
related talks
41mPurple Is the New Red - Providing the Most Value from Offensive Security
30mShall We Play a Game?
39mColorful AppSec - Red, Blue, or Purple?
52mBuilding the Always-On Purple Team
01h 11m2024 Security BSides // Adam Pennington
54mHacked in hours: Red team assessments unveiling vulnerabilities
54mSOCcing: Responding to a Cyber Incident
27mThe Offensive Approach to Cybersecurity