Thread by @MalwareJake

There is a much larger need in the industry for blue team than red team. Yes, red team *looks* sexy (okay, it really *is*).

But blue team is sexy too. What's cooler than finding an attacker all smug they "won" and disrupting a multi-million dollar intelligence operation? 1/

Because that's a lot of what you're doing when you work blue - beating up APT.

If you retort with "no, you're just fighting script kiddies" then you need to up your game (or go be blue somewhere else). I think people idolize red because it's easier to "feel" the awesome. 2/

But I've worked IR engagements where the very existence of the org is being threatened. Blue pulled through and directly saved thousands of jobs. This just doesn't happen in red.

I'm not saying red isn't important. It is absolutely critical to any serious security program. 3/

And this isn't us vs them. I'm just going to note that:
The best paid tech people I know in infosec are blue
There are *WAY* more jobs for blue than red
It's easier to get entry level into blue than red
Purple team is the future anyway

Thanks for coming to my TED talk /FIN