Widely proposed as a best practice, but little to no empirical evidence, or empirical evidence that is contradictory.
A Red Team must be able to operate independently
For the results of its activities to be credible and analytically useful, a Red Team cannot be influenced by, or appear to be influenced by, parties or concerns outside of the simulation process.
Sources Discussing the Best Practice:
Contexts Represented in Sources: General Red Teaming; Other (Military Planning)
Overall Assessment of Best Practice: There is consensus in the Red Teaming literature, with anecdotal evidence but no empirical validation.
Leadership must buy into Red Teaming process
Without support from organization leadership (especially direct supervisors), it becomes less likely that the resources necessary for appropriate Red Teaming activities will be sustained or that the results of the Red Teaming will shape organization decisions or behaviors.
Sources Discussing the Best Practice:
- Command Red Team, Joint Command (May 2016)
- Craig, Susan. Reflections from a Red Team Leader, Military Review, 60 (2007)
- Kardos, Monique and Patricia Dexter. A Simple Handbook for Non-Traditional Red Teaming, Australian Department of Defense, Joint & Operations Analysis Division, 26 (2017)
- Mulvihill, Timothy. What Can Stifle a Red Team? Medium, Homeland Security (October 14, 2014)
- Red Teaming Guide Second Edition, UK Ministry of Defense, 2 (August 2021)
- The Role and Status of DOD Red Teaming Activities, Department of Defense (2003)
- Sandoz, John F. Red Teaming: Shaping the Transformation Process, Annotated Briefing, Institute for Defense Analyses (2001)
- Santarcangelo, Michael. Want to Be a Better Security Leader? Embrace Your Red Team, CSO (September 29, 2017)
Contexts Represented in Sources: General Red Teaming; Cyber Penetration Testing; Other (Military Planning)
Overall Assessment of Best Practice: There is consensus in the Red Teaming literature, with anecdotal evidence but no empirical validation. Most sources cite the 2003 Defense Science Board report.
Avoid mirror imaging bias
Mirror imaging (attributing one's own beliefs and thinking to the adversary) is detrimental to Red Teaming because it prevents Red Team members from considering the adversary's point-of-view and thus undermines a core aim of the Red Teaming approach.
Sources Discussing the Best Practice:
- Zhang, Liza and Gigi Gronvall. Red Teaming the Biological Sciences for Deliberate Threats, Terrorism and Political Violence (2018)
- Maritime Commander's Red Team Handbook, Navy Warfare Development Command (2011)
- The Role and Status of DOD Red Teaming Activities, Department of Defense (2003)
- Red Teaming Tactics, Techniques, and Procedures, TRADOC G-2 (2015)
- The Applied Critical Thinking Handbook, TRADOC G-2 (2015)
- Joint Publication 2-0: Joint Intelligence, Joint Chiefs of Staff (2013)
- Sandoz, John F. Red Teaming: Shaping the Transformation Process, Annotated Briefing, Institute for Defense Analyses (2001)
- Longbine, David. Red Teaming: Past and Present, United States Army School of Advanced Military Studies (2008)
- Landry, Thomas. Embracing the Devil: An Analysis of the Formal Adoption of Red Teaming in the Security Planning for Major Events, Naval Postgraduate School (2017)
- Gladman, Brad. The 'Best Practices' of Red Teaming, Canada Command Operational Research and Analysis (2007)
Contexts Represented in Sources: General Red Teaming
Overall Assessment of Best Practice: Although there are no direct empirical tests in the Red Teaming literature, this appears to be universally accepted among the Red Teaming community as an essential best practice.
Red Teams generally benefit from diversity
In almost all cases, Red Teaming is more efficient if there is diversity among Red Team members in terms of their knowledge, experience, demographics and/or cultural background. This allows for a broader range of perspectives, more multi-faceted analysis and more synergistic collaboration amongst team members.
Sources Discussing the Best Practice:
- Domestic Nuclear Detection Red-Teaming, Nobilis, Inc. (2007)
- Kardos, Monique and Patricia Dexter. A Simple Handbook for Non-Traditional Red Teaming, Australian Department of Defense, Joint & Operations Analysis Division, 26 (2017)
- Ham, Carter et. al. Red Team Reign: Red Team Support to Joint Task Force Decision Processes, Red Team Journal (2010)
- Sandoz, John F. Red Teaming: Shaping the Transformation Process, Annotated Briefing, Institute for Defense Analyses (2001)
- The Red Team Handbook, TRADOC G-2, 9 (2019)
- Red Teaming Guide Second Edition, UK Ministry of Defense, 2 (August 2021)
- Craig, Susan. Reflections from a Red Team Leader, Military Review, 60 (2007)
- Red Teaming of Advanced Information Assurance Concepts, Sandia National Laboratories (n.d.)
Contexts Represented in Sources: General Red Teaming; Cyber Penetration Testing
Overall Assessment of Best Practice: There is consensus in the Red Teaming literature, with anecdotal evidence but no empirical validation.
A Red Team needs a clear mandate
Successful Red Teaming begins with defining the scope and objectives of the team. This helps to ensure that the team remains focused on the intended issues, assists with creating benchmarks for evaluating the team's performance, and increases the likelihood of its outputs being accepted and implemented.
Sources Discussing the Best Practice:
- Kardos, Monique and Patricia Dexter. A Simple Handbook for Non-Traditional Red Teaming, Australian Department of Defense, Joint & Operations Analysis Division, 26 (2017)
- Bartels, Elizabeth. Building a Pipeline of Wargaming Talent: A Two-Track Solution, War on the Rocks (November 14, 2018)
- Gladman, Brad. The 'Best Practices' of Red Teaming, Canada Command Operational Research and Analysis (2007)
- Red Teaming Guide Second Edition, UK Ministry of Defense, 2 (August 2021)
- Zenko, Micah. Red Team: How to Succeed by Thinking Like the Enemy, New York: Basic Books (2015)
Contexts Represented in Sources: General Red Teaming
Overall Assessment of Best Practice: There is consensus in the Red Teaming literature, although there has been no empirical validation.
Judicious Application
Red Teaming should be applied as needed to solve the prescribed problem being faced by the organization, but no more than that.
Sources Discussing the Best Practice:
Contexts Represented in Sources: General Red Teaming; Cyber Penetration Testing
Overall Assessment of Best Practice: The low number of sources for this Best Practice is likely due to the fact that many sources focus on the process or best practices for a singular Red Team engagement, instead of a Red Team program or series of engagements.
Record All Outputs
Capturing and documenting all outputs from a simulation is important to ensure successful delivery of feedback to participants. Equally important is providing a review for participants during the simulation, when learning opportunities are presented by the identification of vulnerabilities or poor performance (Kleiboer, 1997).
Sources Discussing the Best Practice:
- Culpepper, Anna. Effectiveness of Using Red-Teams to Identify Maritime Security Vulnerabilities to Terrorist Attack, Naval Postgraduate School (2004)
- Kick, Jason. Cyber Exercise Playbook, MITRE Corporation (2014)
- The Red Team Handbook, TRADOG G-2, 9 (2019)
- Red Teaming Guide Second Edition, UK Ministry of Defense, 2 (August 2021)
- Wargaming Handbook, UK Ministry of Defense (2017)
- Red Teaming of Advanced Information Assurance Concepts, Sandia National Laboratories (n.d.)
- Demarco, Joseph V. An approach to minimizing legal and reputational risk in Red Team hacking exercises, Computer Law & Security Review 34, pp. 908-911 (2018)
Contexts Represented in Sources: General Red Teaming; Other (Military Planning)
Overall Assessment of Best Practice: Many sources appear to imply this Best Practice without explicitly talking about it. Data collection seems to be considered a fairly obvious, implied function of a Red Teaming exercise. Even though the basic idea of data collection is implied, there are few discussions of methodology or best practices for this particular function.
Collect as much information as possible about the target
A critical preliminary step in Red Teaming is gathering thorough information on as many aspects of the targeted entity as possible, including such aspects as its infrastructure, operations, stakeholders, defenses and competitors. Of particular importance is understanding where the entity places the most value, i.e. its “crown jewels”, since this will differ across targets.
Sources Discussing the Best Practice:
Contexts Represented in Sources: General Red Teaming; Cyber Penetration Testing
Overall Assessment of Best Practice: This has been recommended by several sources, but there have been no direct empirical tests in the literature.
The Red Team must be involved in all stages of an effort, from initial planning through implementation and reporting
This ensures that crucial Red Team principles are considered during both the design and conduct of an exercise or penetration and allows for alternative analysis to play a role throughout.
Sources Discussing the Best Practice:
Contexts Represented in Sources: General Red Teaming; Other (Military Planning)
Overall Assessment of Best Practice: There appears to be consensus in the Red Teaming literature, although there has been no empirical validation.
Inhabit the Adversary’s Mindset
The Red Team must attempt to accurately emulate the adversary’s mindset, by internalizing (but not necessarily sympathizing with) the motives of the adversary and making sure that their portrayal is precise and detailed. Although Red Team members might be able to perceive multiple possibilities for action, they should make decisions based only on factors which reflect the adversary’s cultural influences and biases rather than their own or those of the organization conducting the Red Teaming. Red Teamers should actively avoid ethnocentrism, which causes the Red Team to be “blind to the ability to see the world through the eyes of another national or ethnic group.” (Ken Booth, Strategy and Ethnocentrism, New York: Holmes & Meier, 1979, 15.)
Sources Discussing the Best Practice
Contexts Represented in Sources: Military Wargaming, General Red Teaming
Overall Assessment of Best Practice: Context rating based on the assessment that this is only applicable to Red Teaming in which the adversary is being simulated by a human, so it must not apply to some contexts.
Maintain a Cooperative Attitude
It must always be remembered that the Red Team exists to improve the defense (i.e., to serve the Blue Team). This requires that the Red Team maintain a cooperative and constructive attitude throughout the process, especially during after-action briefings to the Blue Team. It is important to present exercise results in a manner that explains how the organization can utilize the results to improve its practices. The emphasis should thus be on learning, progress, and mutual trust, while smug or condescending “Gotcha!” attitudes should be avoided.
Sources Discussing the Best Practice
- Craig, Susan. Reflections from a Red Team Leader, Military Review, 60 (2007)
- Lauder, Eles, and Banko. The Glaucus Factor : Red Teaming as a Means to Nurture Foresight, Canadian Army Journal (2012),
- Zenko, Micah. Red Team: How to Succeed by Thinking Like the Enemy, New York: Basic Books (2015)