Belajar Red Team Operator - Metrics & Maturity Red Team

#Pendahuluan

Setelah di episode 16 kita mempelajari red team tooling & tradecraft — LOLBins, custom tools, dan OPSEC — pada episode ini kita masuk ke aspek manajerial: bagaimana mengukur dan mengkomunikasikan nilai red team kepada organisasi.

Red team tanpa metrics hanya "seru" tanpa ROI. Untuk mempertahankan dan mengembangkan red team program, kalian harus menunjukkan dampak bisnis secara terukur.

#Red Team Metrics

#Operational Metrics

Metric	Keterangan	Target
Mean Time to Access (MTTA)	Waktu dari start ke foothold	< 1 minggu
Mean Time to DA (MTTDA)	Waktu ke Domain Admin	< 1 bulan
Objectives achieved	Berapa % objectives tercapai	> 80%
Noise generated	Detection events selama engagement	< threshold
Dwell time	Berapa lama sebelum detected	> 30 hari (good for red)

#Detection Metrics (Purple Team)

Metric	Keterangan	Goal
Detection coverage	% ATT&CK techniques terdeteksi	> 70%
MTTD	Mean Time to Detect	< 1 jam
MTTR	Mean Time to Respond	< 4 jam
False positive rate	Alert yang bukan attack	< 10%
Gap remediation	Gap yang diperbaiki per quarter	> 80%

#Business Metrics

Metric	Keterangan	Value
Incidents prevented	Serangan yang dicegah karena improvement	Cost avoidance
Breach cost avoidance	Estimasi biaya breach yang dicegah	$X
Compliance achievement	Pencapaian compliance requirements	Audit readiness
Risk reduction	Pengurangan risk score	Quantifiable

#Maturity Model

#Red Team Maturity Levels

text

Level 1: Initial
- Ad-hoc red team activities
- No formal process
- Minimal tooling
 
Level 2: Managed
- Defined engagement process
- Basic toolset established
- Regular engagements (annual)
 
Level 3: Defined
- Standardized methodology
- Purple team integration
- Continuous testing
 
Level 4: Quantitatively Managed
- Metrics-driven improvement
- Automated testing
- Performance baselines
 
Level 5: Optimizing
- Continuous innovation
- Threat-informed defense
- Industry leadership

#Maturity Assessment

yaml

maturity_assessment:
  level: 3
  category:
    methodology:
      score: 4
      evidence: "Standardized ATT&CK-based methodology"
    tooling:
      score: 3
      evidence: "Custom tools + commercial C2"
    coverage:
      score: 3
      evidence: "Monthly purple team sessions"
    metrics:
      score: 2
      evidence: "Basic metrics, need improvement"
    reporting:
      score: 4
      evidence: "Comprehensive reports with ATT&CK mapping"

#Reporting to Leadership

#Executive Dashboard

text

Red Team Dashboard (Quarterly)
================================
Engagements completed: 3
Objectives achieved: 85%
Critical gaps identified: 12
Gaps remediated: 10 (83%)
Detection coverage: 72% (+5% from last quarter)
MTTD: 45 min (-15 min improvement)
Top risk: Credential management, lateral movement
ROI: $2.4M estimated breach cost avoidance

#ROI Calculation

text

Red Team ROI
==============
Cost of red team program: $500K/year
Estimated breach cost: $4.5M (IBM average 2026)
Prevented breaches: 1-2 per year
 
ROI = (Estimated breach cost × prevented) - Program cost
ROI = ($4.5M × 1) - $500K = $4M return
ROI = 800%

#Continuous Improvement

#Feedback Loop

text

Continuous Improvement Cycle
==============================
1. Red team executes engagement
2. Blue team responds
3. Both analyze gaps
4. Improvements implemented
5. Re-test (purple team)
6. Metrics updated
7. Report to leadership
8. Repeat

Note

Metrics harus balanced — jangan hanyaukur "berapa banyak kerentanan ditemukan" (itu pentester metric). Red team metrics harus mengukur detection capability, response time, dan improvement over time.

#Praktik: Metrics Dashboard

Buat dashboard sederhana:

Operational metrics (MTTA, MTTDA, objectives achieved)
Detection metrics (coverage, MTTD, MTTR)
Business metrics (ROI, risk reduction)
Maturity level assessment

#Penutup

Inti yang harus dibawa pulang:

Operational metrics: MTTA, MTTDA, objectives achieved, noise generated.
Detection metrics: coverage, MTTD, MTTR, false positive rate.
Business metrics: ROI, breach cost avoidance, risk reduction.
Maturity model: Level 1-5, assess and improve.
Leadership reporting: executive dashboard, ROI calculation.

Di episode 18 selanjutnya, kita akan mempelajari zero trust evasion & testing — menguji zero trust architecture dan policy enforcement.