Does red-teaming encompass the entire skillset of a blue-teamer?

Question

Currently I am potentially facing impostor syndrome in regards to the role and skillset of blue team members (defence) and red team members (attack).

I personally specialise in defence capabilities, such as secure system design, secure programming, secure website architecture, etc.

For example, I have a thorough understanding of how to design a website that is resistant to cross-site scripting, using techniques such as Content-Security-Policy, sandboxing, etc.

However, I have limited experience with actually performing cross-site scripting attacks. I am aware of, but not familiar with the various techniques, WAF bypasses, etc, and I would definitely find it challenging to construct an advanced XSS attack right this second without some prior research.

It seems within the security community that red team members (pen testers, etc) have all the knowledge of the defence people, and they have 'ranked-up' and proven themselves to be good enough for attacking.

My question is whether there really is a distinct difference between blue and red teamers in regards to skillset and experience, or are all red teamers just defence people who have got through initiation and are now doing the trendy hacking stuff?

Answer 1

The idea that redteamers or pentesters are 'skilled up' from blueteamers is a misconception, plain and simple.

In the same way that you can defend against XSS without necessarily knowing how to construct a complex XSS attack (which encompasses more than just the XSS code itself, i.e. the payload), you don't need to know how to write code to prevent XSS before you can construct one.

There are a TON of people who work as redteamers or pentesters without ever having worked in a SOC, or on a blueteam, or certainly done any professional software dev (and thus, no secure coding experience).

Don't let anyone tell you otherwise.

Now, whether blueteamers and readteamers should know how to do both jobs is an entirely separate debate.

Answer 2

I have met various people who have worked both red and blue at some point, and they will pick one or the other for various reasons. Some enjoy the thrill and satisfaction of solving the puzzle and breaking in, while others may find it more enjoyable to be the one who gets to build an elaborate fortress and outsmart the attacker. Ideally, the skill set would be completely overlapping since an attacker would need to stay up to date with what defenders are doing and vice versa. The more you know about the opposite role, the better you can do your job. That said, the jobs are often conducted at a different pace and in a different fashion, from which further preference may be derived.

Red teaming seems like a "hot" job since the tools are flashy and the work can be exciting, but there's nothing that necessarily requires more experience than that of a blue teamer. Sometimes a different mindset is required for each though, and the attacker's seems harder to come by IMO.

However, there are various types of jobs within each field that require different levels of technical knowledge and experience. Some in penetration testing jobs will dig through source code and write their own tools, while others are just running vulnerability scanners and Metasploit without truly understanding (these tools have a place, but they are not everything). Some defenders are simply installing all-in-one enterprise solutions and checking the box on compliance, while others understand their networks in depth and are using automation, performing tests, and have found a way to make the most of monitoring and alerting.

TL;DR; both jobs can be equally technical and require a unique skill set, but it depends on the individual to make the most of each position.