Tiger team versus red team?

Question

What's the difference between a tiger team and a red team? Are there any other "color" teams out there (relevant to IT security)?

Answer 1

I have only heard of two types of teams:

• Blue team - The defenders of a network

• Red team - Attackers of a network

• Tiger team - Same as red team, however is a older term of the attacking/opposition side of an engagement

• White team - The team that establishes the rules of engagement and are usually the employees of the organization. The white team does not conduct any testing.

CISSP study guide has the following explanation of the different teams:

White team A neutral team of employees acting as observers, referees, and judges between > a red team of mock attackers (offenders) and a blue team of actual defenders of their enterprise’s use of information systems. The white team establishes rules of engagement (ROE) and performance metrics for security tests. The white team is also responsible for deriving lessons-learned, conducting the post engagement assessment, and communicating results to management. Occasionally, the white team also performs incident response activities and addresses bot attacks on an emergency basis.

Answer 2

from: http://stormsecurity.files.wordpress.com/2012/01/phd_thesis_adrian_furtuna.pdf

There are multiple definitions for Red Teaming, according to the specific domain of activity (e.g. military, computers, corporate, etc).

In the context of information security, the term Red Teaming is closely related to other terms like penetration testing, ethical hacking, tiger teaming.

Even though the terms penetration testing, ethical hacking and tiger teaming are not precisely defined, they all refer to simulation of computer „hacking‟ activities for testing the security of an information system.