Blue Team, proactive defence against threats

Blue Team proactively looks for threats that could put an organisation’s assets at risk and intervenes in detecting, responding to, and analysing incidents

6 billion a day. The CERT in Israel, one of the countries hardest hit by cyberattacks, estimates that security incidents cost companies around the world this amount daily. This economic loss is detrimental to companies’ profitability, impacting their business model and negatively affecting their reputation. This estimate shows that companies must place the security of their IT assets at the centre of their strategy, providing cybersecurity services that help them to protect themselves against threats, such as Red Team services, pentesting or the creation of a Blue Team.

In a scenario characterised by the growing cyber-exposure of companies as a consequence of digitalisation, cybersecurity must be approached from a proactive point of view and not from a merely reactive one.

It is precisely on the idea of proactivity that the work carried out by a Blue Team is based.

Although this concept is now commonly used in the field of cybersecurity and the business world, many professionals still need to be made aware of their functions and objectives.

In the following, we will dissect the characteristics of the Blue Team, the activities carried out by this team to protect organisations against malicious actors and what differentiates it from Red Team services.

1. What is the Blue Team?

The Blue Team is, as its name suggests, a team made up of professionals specialised in various areas of cybersecurity who act as an organisation’s last line of defence against cyber-attacks. The Blue Team must be constantly on the lookout for suspicious activity and thus anticipate future attacks. It is, therefore, a proactive defensive security team.

If preventive measures are insufficient, this team is responsible for responding to an intrusion as quickly as possible and minimising the consequences of a security incident. The Blue Team must also analyse such an incident to optimise defences and monitoring, detection and response protocols.

Given its mission, what characteristics should a Blue Team have?

Be a multidisciplinary team
Focus on providing defensive security services tailored to the company’s characteristics and resources
Focus on security from within the organisation
To work proactively and continuously
To know the company’s characteristics to combine business interests with security objectives

1.1. Multidisciplinary team: Forming The Justice League

Cybersecurity is an extremely broad area of expertise. For example, professionals who perform pentesting have different skills than those who perform a security audit of IoT devices.

Due to its transversal nature in the securitisation of a company, the Blue Team must be made up of professionals with diverse profiles: Threat Hunters, security auditors, forensic analysts, system bastioning experts, and attack response specialists…

Multidisciplinarity is essential for the Blue Team to develop all its activities and meet its objectives. In contrast to some security services provided by profiles highly specialised in a particular subject, the Blue Team must draw on varied and complementary profiles, drawing on different expertise to form a broad view of security and threats.

Suppose we resort to a comic book analogy. In that case, when putting together a Blue Team, the aim is to create a Justice League in which Superman’s superpowers are complemented by Wonder Woman’s and Batman’s skills to face the bad guys with maximum guarantees.

1.2. Defensive and customised security

The key to the Blue Team is that it is, as already mentioned, a defensive security team. This distinguishes it from Red Team and pentesting services, which carry out offensive security activities.

Hence, its mission is to defend an organisation over time and continuously. This translates into constantly searching for threats and early detection, response and analysis of cyber-attacks launched against the company.

To carry out their defensive security tasks, Blue Team members must design all their actions in a customised manner, adapting their strategy to the company’s resources, the characteristics of its business model and the objectives of its business strategy.

The Blue Team acts as one more actor within the organisation; its tasks cannot be understood in isolation but are part of the company’s comprehensive security strategy.

Thus, although the different Blue Teams have common characteristics and objectives, each one operates differently, 100% adapted to the reality of the company in question.

1.3. An inside-out approach

In addition to being a defensive security team, this team is characterised by its approach to protecting the organisation against attacks: from the inside out. What does this mean?

While the professionals who run Red Team’s services put themselves in the shoes of the malicious actors to act like them and understand their tactics, techniques and procedures, the Blue Team approaches security from the organisation’s heart.

This approach is carried through to all its activities and enables the Blue Team to gain extraordinary knowledge of the organisation, its assets and its defensive layers.

1.4. Proactive and continuous activity

The Blue Team is not a defensive security team that merely responds to attacks; its mission is to detect threats, mitigate weaknesses and anticipate criminals proactively.

Proactivity is essential for the Blue Team to go beyond mere mitigation and containment of security incidents and strengthen the organisation, protect assets and prevent incidents.

In addition, their work must be stable over time. Unlike other cybersecurity services such as audits, the Blue Team does not operate at a specific time, but its activities are carried out continuously. Otherwise, it would need more time to meet its objectives.

1.5. Knowledge of the business

This characteristic is directly related to some of the previous ones. A Blue Team must have a very high level of knowledge of the business it seeks to protect to focus its strategy from the inside out and customise its actions to the maximum.

Likewise, business knowledge is essential to combine the two central issues in protecting a company: security needs and business interests.

More is needed for this team to be composed of professionals with extensive knowledge of multiple areas of cybersecurity and counter-attack. In addition, the defensive security team must understand how the business operates, the critical assets, and the business strategy. Only then will their work be aligned with the business objectives and greatly add value to the company.

How can you do it if you don’t know precisely what you need to protect?

1.6. Complementary team

The Blue Team does not, in itself, form a security strategy. It is just another element of it. Therefore, more is needed for a company to have a Blue Team; it must also have other internal and external teams in charge of operating security elements.

Even if the Blue Team is the Justice League, it is not all-powerful and omnipresent. Red Team and pentesting services, security audits, threat hunting, cyber-intelligence services… There are many essential services for securing an organisation that go beyond the objectives and actions of the Blue Team.

2. Blue Team objectives

The Blue Team‘s commitment to protecting an organisation against cyber-attacks translates into five basic objectives, from improving defensive layers to analysing security incidents to prevent future attacks.

2.1. Ensuring the effectiveness of security controls

The first objective of any Blue Team is to verify that the security controls deployed in the organisation are effective.

To do this, Blue Team professionals must conduct security studies to detect and address possible hidden vulnerabilities before malicious actors exploit them.

Security controls are the keystone of a company’s defence system. Therefore, the Blue Team must provide sufficient assurance of the effectiveness of controls and defensive layers.

2.2. Assessing the threats affecting an organisation

Assessing the threats looming over the company is also a priority objective of the Blue Team.

In addition to detecting threats, professionals must:

Analyse them.
Establish their risk level based on the potential impact on the organisation and the likelihood that malicious actors will exploit them.
Monitor them until they are remediated.
Prioritise them to manage resources efficiently, considering not only security but also the business model.

2.3. Establishing remediation plans

The information gathered in the threat assessment allows the Blue Team to draw up remediation plans to mitigate risks until there are definitive solutions to remedy the threats and weaknesses found in the organisation.

Remediation plans are essential to ensure that the defensive layers do not present gaps that attackers can exploit. As well as to prioritise threats according to available resources and business objectives.

2.4. Responding effectively to cyber-attacks

What happens if the bad guys try to breach security controls and attack company assets? The Blue Team must be prepared to act.

The professionals of this defensive security team have to perform incident response tasks to:

Stop attacks.
Prevent their propagation.
Expel malicious actors.
Safeguard critical assets.
Ensure business continuity.
Restore normality as soon as possible.

2.5. Analyse security incidents

Finally, Blue Team professionals must also be responsible for the analysis of security incidents:

Forensic analysis of the affected machines.
Traceability of attack vectors.
Proposal of solutions to remedy the effects of the attack.
Establishment of detection and response measures to successfully deal with future cases.

3. Activities performed by a Blue Team

How does the Blue Team meet the objectives we have just outlined? Proactively and continuously implementing a series of actions that improve defence, detection and response. We can group all the activities a Blue Team carries into five major groups.

3.1. Threat detection and Threat Hunting

As we pointed out when talking about the multidisciplinary nature of the Blue Team, this team needs to have Threat Hunters since one of its essential activities revolves around Threat Hunting and Detection. In other words, the active search for threats in SIEM or EDR solutions.

As well as creating and monitoring indicators of compromise (IOCs), which allow the professionals to detect suspicious activity in the early stages of a cyber-attack.

3.2. System bastioning

Another of the activities carried out by the Blue Team is the creation of bastioning guidelines to implement measures, both at the technical and organisational level, to reduce the vulnerabilities of the company’s system and minimise the consequences of a security incident.

Therefore, the Blue Team must define security controls for all IT systems, contributing to the securitisation of the systems, networks and equipment of the company it defends.

3.3. Early threat detection

Time is of the essence in the field of cybersecurity. It is, therefore, crucial for the professionals to be able to detect threats early.

To achieve this, the team carries out a series of actions that serve to implement an effective detection system:

Study of the latest hacking techniques
Analysis of CVEs and zero-day vulnerabilities
Definition of proactive alerts
Deception or decoy deployment

3.4. Incident response

In addition to implementing proactive measures such as those mentioned above, the Blue Team must activate reactive measures to respond to an attack and contain a security incident.

Responding to attacks is an essential task. However, sometimes an organisation does not have an effective response system. In that case, the attack will spread, affecting critical assets, paralysing the company and triggering devastating economic, reputational and even legal consequences for the company.

3.5. Forensic analysis

Forensic analysis of a security incident is essential to understand how the attackers proceeded and to detect the security issues that facilitated the successful attack.

The Blue Team studies the security incident to trace the origin of the intrusion and assess its impact and scope on the company as a whole.

As is popularly said, «we learn from everything, and from the bad things that happen to us, even more so».

4. Red Team: The Avengers of offensive security

What if the Blue Team‘s «rival» was not a movie villain but another team that seeks to achieve the same as him in a different way? That is precisely what the Red Team does.

To continue with the simile of the comic book world, if the Blue Team is the Justice League of defensive security, the Red Team would be the Avengers (Captain America, Iron Man, Hulk…) of offensive security.

With the particularity that both teams work in the same universe. The Blue Team carries out all the actions described in this article. And the Red Team services test, to a large extent, the Blue Team’s effectiveness in meeting its objectives and help train Blue Team professionals to be prepared to deal with real intrusions and attacks.

To do so, the Red Team simulates acting as a malicious agent, aiming to:

Enter corporate systems
Persist over time
Carry out privilege escalation and lateral movement
Avoid detection
Attack the organisation’s assets

What is the mission of all these actions performed during Red Team services? To help the organisation prevent real attacks, detect them in their early stages of development and respond effectively to any security incident.

This is why Red Team’s services are of great added value and extremely useful for companies with a solid security strategy to prove that it is effective against the most sophisticated attacks and to improve their resilience against advanced persistent threats.

4.1. Identifying security gaps

Given the above, it is clear that the Red Team’s approach is opposed to the Blue Team’s: from the outside in. Or, to put it another way, from the attackers’ point of view.

Red Team’s services are therefore used to evaluate the defensive layers in search of security gaps that can be used to penetrate the system.

The Red Team explores all the attack vectors and routes to get into the system and succeed in violating the organisation’s assets. In this way, they can detect breaches and weaknesses that have gone unnoticed by the Blue Team and other cybersecurity services.

4.2. Optimisation of defensive security

The raison d’être of offensive security is to strengthen defensive security. Red Team activities optimise the organisation’s defensive layers, mitigate weaknesses found and improve resilience to attacks.

By acting as malicious actors, Red Team professionals can evaluate the defensive layers from a different perspective and find weaknesses that the bad guys can detect.

4.3. Exploiting vulnerabilities to simulate real attacks

Red Team services do not simply detect vulnerabilities; they exploit them. As a result, their actions are made to look like real attacks.

By exploiting weaknesses, Red Team can complete the phases of a real attack, studying the paths that malicious actors might take and extracting valuable information from them.

This is where the ability of the Blue Team and the other elements of the organisation’s defensive layers to detect and respond to the Red Team’s actions comes into play.

For the Blue Team to improve, the Red Team must be able to push it to the best of its abilities and teach it the various attacking options it faces.

4.4. Supporting the training of the Blue Team

The Red Team does not seek to undermine the Blue Team. On the contrary, one of its most important objectives is to help train Blue Team professionals.

Red Team scenarios offer Blue Team professionals a perfect opportunity to learn, train and improve their detection and response capabilities.

We are all aware that no matter how much we study, the best way to learn how to do something is to do it. Putting knowledge into practice. Red Team’s services allow defensive teams and technologies to test their robustness against attacks without risking a real security incident.

4.5. Improving Blue Team detection and response capabilities

In addition to optimising how defensive layers and threat monitoring are articulated, Red Team services help the Blue Team to improve its tactics and procedures for detecting and responding to real attacks.

As we said earlier, time is of the essence when it comes to cyber-attacks. The Red Team makes it possible to assess how long it takes a Blue Team to detect an attack and how long it takes to contain it and drive out the malicious actors.

If cybersecurity were a sport like boxing, the Red Team would be a major rival in training a champion. An opponent who would surely be able to make you kiss the canvas. And become stronger after the blow.

In short, Red Team’s services are of great added value for companies with advanced cybersecurity maturity. They allow them to evaluate how their protocols, technologies and teams (including the Blue Team) respond to real attacks. We could say that the Red Team is grounding the Blue Team in the reality of an increasingly complex and dangerous cyber threat landscape.

If companies worldwide could count on the Justice League and the Avengers to protect them, they would not suffer from security incidents currently costing them $6 billion a day. The Blue Team and the Red Team are not mutually exclusive but can be complementary.