Red Team: How to Succeed By Thinking Like the Enemy

by Micah Zenko

Essential reading for business leaders and policymakers, an in-depth investigation of red teaming, the practice of inhabiting the perspective of potential competitors to gain a strategic advantage Red teaming. The concept is as old as the Devil's Advocate, the eleventh-century Vatican official charged with discrediting candidates for sainthood. Today, red teams are used widely in both the public and the private sector by those seeking to better understand the interests, intentions, and capabilities of institutional rivals. In the right circumstances, red teams can yield impressive results, giving businesses an edge over their competition, poking holes in vital intelligence estimates, and troubleshooting dangerous military missions long before boots are on the ground. But not all red teams are created equal; indeed, some cause more damage than they prevent. Drawing on a fascinating range of case studies, Red Team shows not only how to create and empower red teams, but also what to do with the information they produce. In this vivid, deeply-informed account, national security expert Micah Zenko provides the definitive book on this important strategy -- full of vital insights for decision makers of all kinds.

Genres: Business, Nonfiction, Leadership, Military Fiction, Politics, Management, Computers

338 pages, Kindle Edition

First published November 3, 2015

Reviews

[Dwight · Rating 3 out of 5]

Solid book, though some of the anecdotes go on and a few chapters are a little scattered.

His six best practices for Red Teams are solid:

Red Teams must:
Be outside & objective while being inside & aware
Be fearless skeptics with finesse
Have a bag of tricks (that doesn't grow stale)

The Organizations that want to implement red teaming must:
Have a boss that buys into the process (This is listed first in the book because it is most important)
Be willing to hear bad news and act on it
Red team just enough, but no more.

[Ryan · Rating 3 out of 5]

I think this was a very thorough coverage of the topic. It felt a little unsatisfying, but I don't think that was the fault of the author. I think that in reality, Red Teaming hasn't been adopted as thoroughly as it might warrant.

If the reader is expecting stories of Red Teaming changing the course of military or corporate events, they may be disappointed.

[Graham · Rating 5 out of 5]

I know, I know; five? But yes, dear reader, for Micah Zenko has managed to capture that most elusive of talents in this book: real creative thought. Red teaming is hard, all the more so as it requires not just abstract and obtuse thinking but also challenging entrenched mores and heartfelt convictions. The book's case studies run the gamut from defense and intelligence to business and information security, and while there could have been a few more, managing to synthesize the small but burgeoning and vital field into a single volume is no mean feat.

Or, to put it more succinctly, Zenko has done a real service by laying out some basic methodologies and applications for red-teaming in its various forms. One hopes that many more institutions and organizations will put the power of alternative approaches to good use.

[Chris Ingram · Rating 4 out of 5]

You can't grade your own homework, but you can learn the myths, best practices, and worst cases of red teaming. The book is a great intro into the topic of red team alternative analysis, and will be useful for those considering the use of red teams, or deciding if it is an endeavor they'd like to consider. Loaded with real world cases, the book lets you know the land mines to avoid and the factors to consider when hiring/assigning a red team to a project.

[Justin Walker · Rating 1 out of 5]

Misleading title

History of red teaming, yes. Value of red teaming, maybe. How to red team, no. No discussion on tools to break through biases or "think like the enemy." Disappointing purchase.

[Scottnshana · Rating 4 out of 5]

A good exploration of how successful organizations--both private and public--fight for quality feedback in order to improve performance. Zenko clarifies what is necessary to ensure that quality--such as a boss who won't shelve the findings, and the composition of an effective Red Team. Some of it was pretty disturbing, such as the number of organizations that will do it just to claim their process has been audited by an outside entity (with no follow-up on the recommendations) or the vulnerabilities each of us has taken on by simply carrying a cel phone around. I would recommend this book to anyone interested in national security affairs, business strategy, or Boyd's OODA Loop.

[Eddie Choo · Rating 5 out of 5]

Comprehensive guide to red teaming

Micah Zenko has probably written the most authoritative guide to red teaming in the military, government and in the private sector. An important guide to the limits and opportunities that red teaming offers.

[Tadas Talaikis · Rating 4 out of 5]

Conformism provides opportunities to red teams.

[Daniel · Rating 3 out of 5]

decent book on the process of red teaming, and the insights on what makes red teaming successful. Zenko's ability to distinguish between government and private red-teaming was especially insightful

[Tarmo Tali · Rating 4 out of 5]

Useful, but repetitive and reads like a government report, not like a book.

[Drew Weatherton · Rating 2 out of 5]

YAWN. This book could easily have been half its length an conveyed all the key points. I had to top and return to it twice (going off to read other, more engaging books) to get through it all.

[Kristaps · Rating 2 out of 5]

Book on quite popular approach of analysis called red teaming. Often used in military and politics, but more recently it gains traction also in private business sector (mostly in realms of security testing (both physical and online), competitor analysis). Red teaming is basically a quality feedback method that applies out-of-the-box thinking to issues any structure with an action plan is concerned with. In the book you'll find many case studies of red team principle application in real life practice, however, first, you might not get many insights on how to actually do red teams. Secondly, the cases sometimes are a bit stretched out. Overall I'd say a good book on the concept, but might not be that interesting for people who do not care about the topic at all. One of the biggest issues with this book is - if you don't care about the case studies, you can read all of the conclusions in the introduction part.
Few take-aways:
- The boss must buy in
- Outside and objective while inside and aware - correct structure, know the culture
- Red teamers usually are weird, unsocial or have some other traits that are not 100% team player quality.
- Have a big bag of tricks, think outside the box when doing red team
- Be willing to hear bad news and act on it
- Red team just enough but no more - don't do it too often, too much
Worst practices of red teaming:
- Don't apply one person and say to them to think like a group (red team is not one person)
- Red team findings are not policy, you still have to analyse them
- Red team should not make further decision, but provide feedback
- Red team that fails to consider institutions structure, processes and culture will fail
- If leaders distrust red team, it will not work.

[John · Rating 4 out of 5]

This book is an analytical look at the full spectrum of Red Team activities. These activities are both efforts to "think like the enemy" and critical, open-minded analyses of a range of organizations. These can include governments, military, and corporate operations that want to take a critical look at their opportunities and their shortcomings.

Zenko outlines examples of both the beneficial, qualified applications of red teaming and the useless, self-serving forms that groups may take. One is given adequate resources and scope to do an unbiased critical analysis of the entity with adequate access and range. The second is used to either fulfill a requirement or to provide a proof that the company tried in case of a failure. Examples of both fill the pages.

Red Team: How to Succeed By Thinking Like the Enemy goes into more than just the assumed roles of computer and network security - which I will admit was my interest in the book - to include physical penetration of a company or agency. It actually spends less time discussing the data and IT security side, focusing on a broader reach of topics: social engineering, analyzing strategies and making plans, and responding to crises, such as September 11th. Overall, I must say that the book is thorough in its coverage and broad in examples. I enjoyed the detail and have a greater appreciation for the broader scope of applying a red team.

[Summer · Rating 3 out of 5]

I checked this book out in April and just finished it today. It is dense. It is often dry. But it is very informative. The stories about brilliant red teaming were really quite elucidating.

This book will make you feel annoyed as you read about all the red teaming that was done before 9/11 and the airline industry's persistent refusal to change their security in the SLIGHTEST until the government took it over. It might also make you feel kind of helpless as you read how easily our military is defeated by "red teams".

Of course, you probably know that cybersecurity is almost a joke. Seems like almost any system can be hacked by almost anybody who is motivated to do so. Zenko includes interesting (and depressingly familiar) examples.

Overall, although not exactly a light read, this book gives one a solid background on what red teaming is, what it's not, and how it can be best used. I thought I was picking up more of a "how-to" guide, maybe something that would help me challenge my own biases, but this was not that. Rather, it explained that the kind of thinking a good red teamer needs is not found in a book. You can get a bit of it through extensive training, but overall, it's a rare trait that no one can claim to have at all times.

[timnc15 · Rating 5 out of 5]

How do you break through groupthink and battle-test your systems without paralyzing your organization? This book provides an effective summary of the various types of "red-teaming" used to do exactly that. Through a series of case studies stretching from chemical warfare assessments to car dealership security, Zenko provides numerous case studies of effective (and ineffective) red-teaming throughout American history across a variety of sectors.

Each chapter examines a new case study and is clear in its goal of teaching the reader a certain lesson about the practice of red-teaming. These case studies, which fortunately never overstay their welcome, are consistently engaging and simply interesting to read about. An example that sticks out to me is a series of wargaming exercises done in advance of the invasion of Iraq in which an American commander assigned to "red team" Saddam's forces successfully repelled an American invasion using unconventional tactics, only to have the board flipped against him by changes in the rules by the "green" arbitration team. Zenko's writing is both interesting and insightful, giving the reader a blunt, efficient argument for his chosen method of analysis.

Would highly recommend.

[Maria · Rating 3 out of 5]

Red Team was/is the military team that is assigned to play the part of the opposition during war gaming. Zenko illustrates some of the points where Red Teams have been used to test security, online and offline; and how difficult it can be to bring the weaknesses found to the attention of management.

Why I started this book: I'd heard Red Team exercises from talking to retired soldiers and from other professional reading material.

Why I finished it: Interesting to learn the origin of Devil's Advocate. And the importance of and how difficult it is to incorporate disrupters into your organization.

[Cold · Rating 2 out of 5]

Red Teaming has three purposes: simulation, vulnerability probes and alternative analysis. The challenge is to be successfully incorporated into organisation, without being captured by organisational culture and biases.

The book was full of examples but lacked a wider theory to tie it all together. It was just a succession of `red teaming found X problem, the bosses didn't listen, X happened, the bosses now value red teaming'.

[Jen Savage · Rating 5 out of 5]

For individuals that work in information security, your definition of red teaming may be a bit more narrowly defined than in this book. This challenged my own views on red teaming and gave me the feeling that I have been on the right track, but could expand my understanding on how engagements could proceed if given an expanded scope.

[Scott Ouellette · Rating 4 out of 5]

An excellent and thorough review of how red team thought processes can be an essential tool in the growth of a business / organization. The author provides several case studies in which red teams were used to great success, and, unfortunately, ignored to disastrous consequences.

[Chris · Rating 4 out of 5]

Case studies of how to make organizations stronger, particularly from cyberattack, by thinking, and acting, like the adversary. Security through obscurity is no longer sufficient, and the status quo is ticking time bomb.

[Fred Leland · Rating 5 out of 5]

Great resource

This book is a great resource on red teaming, its history and the adaptable methodologies used to influence positive change with in organizations. It well written and well researched. I highly recommend it.

[Aaron Bright · Rating 3 out of 5]

I didn’t finish this book, got about halfway and stopped. I’m sure it’s a good book but I live this life already and I’m not going to the school that it references time and again. I was hoping for some stronger insights into “how” but they just weren’t there. Oh well.

[Antony · Rating 4 out of 5]

What to improve your objectivity? Everyone needs a little challenge in their lives. Seek out some constructive disagreement.

[Jim Jenkins · Rating 3 out of 5]

Good concepts, but the book is a bit too dry for my tastes.

[Steinar Dahl · Rating 4 out of 5]

Good read and pitches several interesting concepts. Must read for anyone interested in intelligence work, decision making or leadership positions from junior to strategic levels.

[Eric · Rating 4 out of 5]

Exceptional read. Very good red team methods thoroughly described for different situations in order to think "outside the box".

[Frank Kelly · Rating 3 out of 5]

An interesting history of the use of Red Team assessments. Excellent and essential if you are considering conducting a Red Team assessment.

[Chris Doelle · Rating 3 out of 5]

Great start for someone new to the concept. My full review --> http://www.ridingwiththewindowdown.co...

[Thor Toms · Rating 3 out of 5]

Ok book, lots of repetition, could have used a better editor to tighten the writing up.

[Iván Martínez · Rating 5 out of 5]

My strong foundation about cyberthreat handling was given by this book.