Belajar Red Team Operator - Red Team Legal & Compliance

#Pendahuluan

Setelah di episode 19 kita mempelajari supply chain & third-party risk — vendor access testing dan dependency confusion — pada episode ini kita membahas aspek yang sering diabaikan tetapi sangat kritis: legal & compliance red team.

Red team engagement berbeda dari pentest dalam hal legal: duration lebih panjang, scope lebih luas, dan risiko lebih besar. Dokumen legal harus mencakup semua ini secara eksplisit.

#Red Team RoE (Extended)

#Perbedaan dari Pentest RoE

Aspek	Pentest RoE	Red Team RoE
Duration	1-4 minggu	3-12 bulan
Scope	System/application	People + process + technology
Social engineering	Limited	Full scope
Physical access	Usually excluded	Often included
Data handling	Minimal	Extensive
Emergency procedures	Basic	Detailed

#Red Team RoE Template

yaml

engagement:
  name: "Red Team Assessment"
  client: "PT Contoh Sejahtera"
  period: "2026-09-01 to 2027-03-01"
  
scope:
  included:
    - "Production environment (AWS + on-prem)"
    - "Employee social engineering"
    - "Physical access testing (Building A)"
    - "Third-party vendor access"
  
  excluded:
    - "Development/staging environments"
    - "Production databases (no data modification)"
    - "Building B (executive floor)"
    
methods_allowed:
  - "Social engineering (phishing, vishing, physical)"
  - "Technical exploitation (network, web, cloud)"
  - "Credential attacks (brute force, spraying)"
  - "Physical access (tailgating, badge cloning)"
  
methods_prohibited:
  - "Denial of Service (DoS/DDoS)"
  - "Destructive actions (data deletion)"
  - "Modifying production data"
  - "Accessing PHI/PII without need"
 
emergency_contacts:
  primary: "CISO - +62812-xxxx"
  secondary: "SOC Manager - +62813-xxxx"
  legal: "Legal Counsel - +62814-xxxx"

#Insurance Requirements

#Types of Insurance

Type	Coverage	Requirement
Professional liability (E&O)	Errors & omissions	Mandatory
Cyber liability	Data breach costs	Recommended
General liability	Physical damage	If physical testing
Workers comp	Team injuries	If on-site

#Insurance Minimums

text

Recommended Insurance
======================
Professional liability: $5-10M
Cyber liability: $5-10M
General liability: $2-5M
Workers comp: per local law

#Legal Approval Process

#Pre-Engagement Legal Checklist

text

Legal Checklist
================
[ ] Written authorization from C-suite/board
[ ] RoE reviewed by legal counsel
[ ] Insurance coverage verified
[ ] NDA signed by all team members
[ ] Background checks completed (if required)
[ ] Local law compliance verified
[ ] Data handling agreement signed
[ ] Incident response plan agreed
[ ] Emergency contacts established
[ ] Communication protocol defined

#Authorization Chain

text

Authorization Hierarchy
==========================
1. Board/Executive approval (engagement authorization)
2. CISO approval (scope & methods)
3. Legal counsel review (liability & compliance)
4. IT leadership (technical coordination)
5. HR (employee testing awareness)
6. Physical security (if physical testing)

#Compliance Considerations

#Regulatory Requirements

Regulation	Requirement	Red Team Impact
GDPR	Data protection	Don't access EU user data
HIPAA	Healthcare data	Avoid PHI access
PCI-DSS	Payment data	Don't access card data
SOX	Financial reporting	Don't modify financial systems
UU PDP	Indonesian data protection	Respect data minimization

#Data Handling

text

Red Team Data Handling
========================
1. Collect minimal data necessary
2. Encrypt all collected data
3. Store in secure, access-controlled location
4. Destroy after engagement (per agreement)
5. Don't share with third parties
6. Document what was collected & why

#Engagement Termination

#Trigger Events

text

Immediate Termination Triggers
================================
1. Legal challenge from authorities
2. Physical damage to systems/data
3. Scope violation (accidental or intentional)
4. Client request for immediate stop
5. Insurance coverage lapse
6. Team safety concerns

Caution

Red team legal compliance bukan optional — ia fundamental. Satu pelanggaran bisa mengakhiri karir dan menghadapi tuntutan hukum. Selalu konsultasikan dengan legal counsel sebelum engagement dimulai.

#Praktik: Legal Documentation

Buat dokumen berikut untuk engagement fiktif:

RoE (extended format)
NDA template
Data handling agreement
Emergency procedures

#Penutup

Inti yang harus dibawa pulang:

Red team RoE: extended scope (people, process, technology), duration 3-12 bulan.
Insurance: professional liability, cyber liability, general liability.
Legal approval: C-suite → CISO → Legal → IT → HR → Physical security.
Compliance: GDPR, HIPAA, PCI-DSS, SOX, UU PDP — sesuai dengan target.
Data handling: minimal collection, encryption, secure storage, destruction.

Di episode 21 selanjutnya, kita akan mempelajari AI in red teaming — bagaimana AI digunakan untuk payload development, C2, dan autonomous agents dalam red team operations.