Trusted Agent in red team engagements
Learn about the role of the Trusted Agent in a red team engagement
A Trusted Agent (TA) is like a wise and responsible person in the family, who knows everything that is going on in the family. They are often the chosen conflict resolvers of the family and, if need be, they can intervene and take an action for the betterment and the safe keep of the family.
Similarly, in a red team engagement, a Trusted Agent is a chosen employee of the organization who is made aware of everything about the engagement (scope, timelines, rules of engagements etc.). Usually, someone from the upper management is selected as a Trusted Agent and they are also the part of the White Cell. Each red team engagement establishes a Trusted Agent Agreement, that defines whom to deliver the information and the approval process for the same.
The role of the Trusted Agent is crucial:
They ensure that the engagement stays on track and does not have any unintended impact on operations of the organization.
They are responsible for enforcing the rules of engagement, as and when necessary.
They are also responsible for vetting and act as approver of any activity that, lies within the rules of engagement, but may have impact on operations of the organization. For example, firing an exploit at the Domain Controller or launching an injection attack against a business critical web application.
They initiate and execute the deconfliction process, as and when required.
They act as conflict resolvers for both, the red team and the blue team.
They can pause or terminate the engagement if it poses a significant threat to business continuity or safety.
Red Team Notes
- A trusted agent is an individual within the organization who is aware of the red team assessment's objectives, scope, and timeline. Unlike the rest of the organization, the trusted agent is informed about the engagement to ensure it is conducted safely, aligns with organizational goals, and does not interfere with business-critical operations.Follow my journey of 100 Days of Red Team on WhatsApp or Discord.