Who guards what, and who tests it.
Security work is often described in colours. The colours show which team owns what, and where nobody does.
The InfoSec wheel, and where grey teaming cuts through it.
April C. Wright’s InfoSec wheel describes the teams most organisations have or need. Yellow builds, blue defends and red attacks. Where two of them work together a new colour appears: green builds security automation into design and code, orange teaches builders what attackers do, and purple brings offensive results into defence. White sits in the middle with the analysts, compliance, logistics and management.
Building on April C. Wright’s InfoSec Wheel, Orange Is The New Purple (Black Hat USA 2017), with black and the grey wedge added.
When we worked out which colour on the wheel we would logically be, grey was the obvious choice. A grey team works across black and white, most of red and a bit of purple. Mix those and you end up with a shade of grey.
Every part of an organisation has an owner somewhere on the wheel: the software, the phone at reception, the door, the database. The chain between them does not. An audit reviews each against its own standard, a pentest takes the database, a red team might try the door. Each of these is commissioned and scoped on its own, so the chain is almost never included. A phone call, a door and a database do not seem to belong together.
To an adversary, seemingly unrelated attack vectors like these combine into a way in.
That is why the grey wedge reaches across several colours and beyond the wheel.
Tested, audited and still exposed.
Organisations bring in specialists to test the wheel. A red team usually simulates an external attacker with a focus on technical defences. In this model a black team works covertly with advanced techniques. Leadership mandates the test but the people in scope are not told when it happens. Auditors check whether processes, controls and money flows meet the standard they are held to.
The wheel shows which parts of an organisation grey teaming runs through. The diagram below shows which disciplines it combines.
Each finds what it is looking for. Grey teaming sits where all three overlap. It uses the technical attacks of a red team, the covert tradecraft of a black team and an auditor's knowledge of how processes and money actually move. Then it applies them from the inside, the way someone with legitimate access and bad intentions would. In most organisations nobody has tested that overlap.
One question: what if?
A grey team assignment works best without a predefined scope. The organisation names what matters most and signs a written mandate with the rules of engagement. Within those limits the route stays open because a real adversary would not accept a boundary either.
From there the work follows one line of reasoning: what if? What if an access card is copied? What if a supplier's account is still used after the contract ends? What if an approval step is skipped whenever the amount stays just under the limit?
The answers get interesting when they are combined. A name and an email address can lead to a password that appeared in an old leak and is still in use. A copied access card can log in to a printer and open up everything that was printed or scanned on it. Combinations of attack vectors like these are almost never in scope for conventional security testing and auditing.
Grey teamers are trained to analyse and probe an organisation the way an adversary would. They take processes apart to see where they can be abused. They analyse standards to find the unintended weaknesses that standardisation itself creates. A framework brings interoperability and strong processes. That same predictability tells an adversary where to look.
Looking for a grey team?
The people who developed this approach to grey teaming founded OnyxTrace together. If you are looking for a grey team, OnyxTrace is one of the parties you can approach. If they are not the right fit, they will gladly help you find someone closer to home.
Talk to OnyxTrace