For Consideration when Red Teaming

This was originally drafted as a thought exercise for an article on RECOIL OFFGRID but wasn’t used.

Red teaming can mean a lot of things to a lot of people. In the truest sense and how we will define it here for the purpose of this article; it’s adopting the adversarial mindset, or more plainly, thinking like the bad guy or how a situation can go wrong. Understanding and viewing how things can go wrong and why is extremely important in everyday life. With random acts of violence and terror occurring seemingly everyday, it’s important to understand how to think critically and apply it to your life. For red teams, this is paramount, for applied critical thinking is a make it or break it skill set.

Below are a few ‘lessons learned’ or consideration points when building out and operating a red team. There are a plethora of posts and material covering this topic out there, so I tried to be brief on the matter and only highlight what I would consider a few key points.

Lessons Learned

Don’t overthink it and don’t fight your gut- sometimes you just need to go with your initial instinct. If you start to think something might be amiss or just plain wrong for the environment you’re in, chances are it is. There are times where you need to embrace that feeling of uncertainty and either get the hell out of the area or ensure you approach the situation in front of you with multiple strategies. If you are too reactive to what’s around you, you will be one step behind. Good proactive actions will always win the day over bad reactions or freezing in place. If you’re conducting a red team operation, drill and practice the plan over and over. Approach the problem set from multiple angles to better understand what could go wrong and what success actually looks like.

You don’t know everything - accept it. A good red team is exactly that, a team that’s comprised of others that have their own specialties and abilities to contribute. To build a good team you need to think about what skills and experience you’ll need to get the job done. Also, in that same vein, you cannot settle for less. A team may be successful on one hand for a particular situation but if the playing field were to change, you should consider these modifiers and adjust team composition as necessary. Given enough time good team members can adapt, however, if you have timelines that can’t be moved it’s better to swap in teammates that can’t multiply your chances of success; or call the operation off. The worst case scenario would be to proceed with an inadequate team where you don’t achieve mission success or someone gets hurt or worse.

Encourage disagreement and alternative planning - until planning has been completed and you’re in an operational state, encourage feedback and dissenting opinions during the plan design phase. This is where it matters most. If you have a red team leader (RTL) dictating every step of the plan and ignoring voices of teammates, then you have a bad RTL. This doesn’t happen too often, however, just like the above point where you don’t know everything, the same is true for the RTL. This is why it’s a good idea to shift RTLs based on the engagement. If the predominant activity will involve physical entry, then the RTL should be someone with a solid understanding of this area, not a computer expert, or someone that has no experience in that area.

A good red team is a thinking and adapting red team. It might be obvious to most, but if you’re not adapting to what I like to call the atmospherics around you, things can go very wrong, very fast. When creating your operational plan, it’s important to have a backup plan (which you should also dry run as well). We like to follow the PACE principal of planning. Having a primary, alternative, contingency and emergency plan based on the original OPORD is key. Just because your primary plan goes to shit, doesn’t mean you can’t still be successful - but you have to plan for it to ensure success. Know when you’ve reached the point of no return or failure. Often I’ve seen red teams continue to hammer away even though their chance of success is nil. You have to be honest with yourself and your teammates when you’ve reached that point. Continuing to execute can bring further harm to your operation, team or the target itself. Lastly understand what the point of no return is within each stage of your plan. This is vital in case you need to shift or adapt your tactics or go to plan b. Otherwise it may be too late and you’ll find yourself staring at failure.

ᛞ ᚾ