Who guards what, and who tests it.
Security work is often described in colours. The colours show which team owns what, and where nobody does.
The InfoSec wheel, and the piece it misses.
April C. Wright’s InfoSec wheel describes the teams most organisations have or need. Yellow builds, blue defends and red attacks. Where two of them work together a new colour appears: green builds security automation into design and code, orange teaches builders what attackers do, and purple brings offensive results into defence. White sits in the middle, with the analysts, compliance, logistics and management.
After April C. Wright’s InfoSec Wheel, Orange Is The New Purple (Black Hat USA 2017).
Put the colours together and they form a shield, with one piece missing. The wheel comes from software and has no colour for the reception desk, the badge reader or the contractor with a laptop in the meeting room. That piece belongs to nobody, so nobody tests it. Grey teaming is the missing piece, and without it the shield is not complete.
Three ways to think like an adversary.
Organisations bring in specialists to test the wheel. A red team simulates an external attacker and probes technical defences. A black team works covertly with advanced techniques, often without the organisation knowing. A grey team works from the inside, on the human factor, insider threats and social engineering.
Each of them finds what it is looking for. Grey teaming is the overlap: insider context combined with the covert and technical methods of the other two. In most organisations nobody has tested that overlap, and that is the gap.
Looking for a grey team?
The people who developed this approach to grey teaming founded OnyxTrace together. If you are looking for a grey team, OnyxTrace is one of the parties you can approach. If they are not the right fit, they will gladly help you find someone closer to home.
Talk to OnyxTrace