Development and Testing of a Core System for Red and Blue Scenario in Cyber Security Incidents

In the context of continuous digitalization in all business areas, cyber-attacks became a major challenge. The data security component is a priority in the development of this changing environment. There have been many types of cyber-attacks such as Distributed Denial-of-Service, Malware Attack, Password Attack, or SQL Injection Attack that have affected different countries around the world. These security vulnerabilities led to data exfiltration or unavailability of certain critical services for long periods of time, while causing significant material damage. In order to properly manage the problems that may occur, it is necessary for any entity offering services on the Internet to have a cyber security component. Moreover, for a better coordination in the response to cyber incidents, it is necessary to train the teams providing these services. The development of capabilities can be achieved in a controlled environment, where different types of real-life attacks are simulated. A classic training method is considered to be a Red vs. Blue competition. In this paper, a different strategy is proposed, in which the two types are combined in a Red and Blue scenario. To develop it, a central system is needed to generate the information to be captured, to validate its accuracy and to monitor the availability of services. Also, through this, it was possible to observe the behaviour of the players and how they improve their knowledge. Compared to the Red vs. Blue version, the proposed one in which the teams are combined offers more advantages for understanding how a hacker acts and for reducing the response time in case of a cyber security incident.