What is an 'Orange team'?

Question

I heard that Google had an unofficial 'Virtual' team called the Orange Team that consisted of staff from outside the official security team, who engaged in a range of white hat activities to both develop their own skills, and to improve security at Google. (sort of like a team of Dick Feynmans roaming Los Alamos)

Sadly I've had trouble identifying more information about defining the role and parameters of operation of an Orange Team so one could safely and effectively establish one.

Can anyone help;

• More clearly define the role of an Orange Team and its members?
• Define what is acceptable practice?

In short, ensure team members can contribute to security safely, without endangering the organisation's security?

Answer 1

There are a number of companies that do this. Typically, the organization defines the scope of the team, clearly defines the activities, trains and supervises.

I have seen it done as part of the Security Awareness Champions programme that allows people who have been active in improving the security of their peers using the tools and processes available to everyone. This new level of training is a type of "reward" for being a leader in security among their peers.

By tapping into the Champions programme, you give employees something to aim for and you get those who are truly showing interest in security and not those who are attracted only to the "hacking" part.

After that, it all depends on what your organisation wants to tackle. I've seen phishing teams (phish your peers!), physical security teams (Mission Impossible your way into the building!), and application security teams (break our product!).

Answer 2

There's not a lot of information out there about what specifically the scope of google's orange team is or what they've done (kind of obvious why...), but in general there are two kinds of penetration testing one would want to do: the obvious one where you ensure that systems that are exposed to the outside world are secure, and the less obvious one where you ensure systems are secure from within.

Think of it this way: what could someone with inside knowledge of the systems and a standard-security level access to them do that would be bad. it's not necessarily about protecting yourself against an evil employee (though that's part of the goal for larger companies), it's about keeping your own architecture honest. You want bad things to be impossible even in principle, not just because you assume no one will bend the rules (whether that's for nefarious purposes or just plain laziness).

My understanding based on what I have heard on the internet is that google's orange team is something like that, that they essentially try to hack google from within using any means they can think of (to your question, I'm guessing short of causing production visible effects), including making calls to internal APIs that are not available externally.

For a large company where many teams and team members are supposed to have different levels of access to different internal resources, this kind of penetration testing helps improve the security of the internal systems architecture. And yes I'm sure the "evil employee" factor looms large over this kind of businesses... imagine what would happen if the wrong person managed to insert a bit of code in a compiler, or a popular browser.

Also, that's got to be a really fun job! :P

Answer 3

I'm not sure these other answers are correct, but they are also not entirely wrong either

An Orange Team is the team that pretends to be the board/clevels, HR, or other clickers. They context the malicious execution flow as a regular end user, rarely as a privileged user, and play dumb. It is literally the most-fun role you can play if you are already a blue teamer or red teamer -- although sometimes the hardest to get into character for since you cannot let your expertise guide you.