Black Box Operational
Model
In Black Box operational model, the cyber red team is provided just with the target name. Post which the cyber red team uses various TTPs listed in the ATT&CK framework and follow a linear approach from reconnaissance to impact phase. During this phase the cyber red team attempts to gain foothold into their customer’s environment, elevate rights, steal data or achieve some desired effect. This operational model comes with a limitation that cyber red team needs to face the restriction that are not faced by a real adversary. The restrictions include time, scope, compliance with the law issues (based upon the state and the country).
Assumed Breach Operational
Model
In Assumed Breach Operational Model, the cyber red team work with the organization’s blue team to train and assess network defenses. This operational model starts with a plausible scenario. The scenario assumes that the adversary has achieved initial foothold onto one of the organization’s host. Post this an objective is defined wherein the blue team of the organization has to track and note down all the alerts which are caught by the blue team tools against the TTPs used by the adversary. This concept was introduced from Integrated Training Team at NASA.
