it's not close to as masochistic as being a blue teamer...

a red teamer have to win only once, a blue teamer have to win every single time... a red teamer have a clear target, a blue teamer is the target and have an undisclosed number of shooters...

@ThoriumBR Nothing masochistic about that. All you have to do is get hired, wait until you lose, then change companies. You can spend your whole life doing the bare minimum and nobody will notice :P

you report something, they ignore... when that thing blows up it's your fault because you should have been more convincing

on the red team there's always lots of things to do, and even if you cannot find one single fault, you can write a detailed report stating all good things they did and you get credit for your failure to discover anything...

but let one ransomware crack your defenses... no report telling all the things they used to bypass IDS, IPS, firewall, endpoint protection, anti phishing and backups will paint a good picture of you

Haha, true

true story: working as infra specialist at some client for an year, the management changed after 6 months. 6 months with the new boss, he calls me to his office and starts with "what have you done in 6 months? I haven't seem anything you have done."

"Just give me a month's paid vacation, and you'll start seeing all the things I've been doing"

s/me/me and my team

one friend of mine said that we work on "sewage services": we are underground doing invisible things to take care of all the shit that happens above ground. nobody notices when everything is going well... but let something go wrong and immediately everyone knows it was your fault.

@ThoriumBR So you brought it down to 0 in less than a month?

yes... they had zVM hipervisor running and a team that had no zVM senior

Nice

basic things went wrong all the time, the team had no idea what was wrong and they had to call premium support at ibm all the time

they once had an entire week of network incidents, had an entire network team working 24x7 on traces and everything, the infra team were sleeping on the floor for 3 days, and was a config issue

I was at IBM and I was the support... my boss called me 9pm to get there ASAP, I got a plane 1h later and landed on the client close to midnight... in 15 minutes I got it solved, because it was something basic to a zVM senior, but wasn't visible to any on the team.

in 30 minutes the issue was fixed, and their boss poached me out of IBM and 6 months later I was working for them and they stopped asking IBM for support

@ThoriumBR Ah, atleast they had the sense to do that

those "high priority support calls" were kinda expensive, and he calculated that 10 calls a month would pay my salary for an year with money to spare...

I asked high and they didn't even blinked

And IBM didn't try to counter-offer? Weren't they losing a lot of business?

I was more happy at IBM... I was a "firefighter", got called on those issues that were life or death for the project. When i solved the issue it was great, when I didn't I wrote a report on all the unsolvable issues and attach the reports of those that tried before me, and boss was "you did your best, we knew the project were doomed anyway"

@nobody no, my manager at the time was terrible, she promised me a rise when I got a technical certification. I got that in 3 weeks and she told me she could give me half the promised rise in 6 months and another half in a year if I had another certification.

at least you can say "enough for today, I will browse cat videos in youtube now and resume in 3 hours"...

if only attackers scheduled first...

I once drove 900km, on my birthday, straight to a client, and went home to sleep 11pm, only to get back 7am the next day

driving all night and seeing the sun rising with you on an active ransomware scenario isn't funny at all

pro-tip: use rate-limiting on your systems

Kind of obscure threat model from what I know, however this is cool nonetheless: mpg.de/18700996/…. Physical shield to put by your router to thwart (timing-of-signal based?) motion detection