红蓝攻防 构建实战化网络安全防御体系（奇安信官方出品，多年服务各类大型政企机构的经验总结，红队、蓝队、紫队视角全面揭示红蓝攻防）(z-library.sk, 1lib.sk, z-lib.sk)

# 红蓝攻防：构建实战化网络安全防御体系 ## 【One-Line Pitch】 A comprehensive, field-tested playbook from Qi-Anxin's security services team that walks you through the entire red-team/blue-team/purple-team exercise lifecycle—from organizing large-scale attack-defense drills to building a sustainable, combat-ready defense system. Essential reading for security operations leaders, SOC analysts, and penetration testers in government and enterprise organizations. ## 【Book Arc】 - **Opening (~0%–8%)**: Introduces the "red-blue-purple" framework and traces the evolution of live-fire cyber exercises in China from 2016 onward—driven by policy mandates like the Cybersecurity Law, growing常态化 (normalization) of drills, and diversification of attack methods. Establishes why compliance-based security is insufficient and why a实战化 (combat-oriented) defense system is necessary. - **Early (~8%–25%)**: Dives into the blue team (attacker) perspective—the attack lifecycle from intelligence gathering (网情搜集) to external penetration, including toolchains (AWVS, Dirsearch, Nikto, sqlmap, WebLogic/Struts2 exploit tools), privilege escalation techniques, and the four pillars of internal network persistence: tool survival, covert communication, tunneling, and control retention. - **Early-to-Middle (~25%–42%)**: Continues the blue team playbook with vulnerability exploitation categories (sensitive info leakage, credential brute-forcing), phishing tactics (external and internal), watering hole attacks, and social engineering—emphasizing that实战化 capability differs from traditional vuln research: it targets business systems, requires effective end-to-end attacks, and permits social engineering as a legitimate method. - **Middle (~42%–58%)**: Covers advanced attacker capabilities—anonymity techniques (Tor, jump servers, identity spoofing), team composition and role division (6 roles from commander to social engineer), and two detailed case studies: a supply-chain attack against a large enterprise via its software vendor, and a persistent campaign exploiting leftover webshells after a red team migration. - **Late (~58%–75%)**: Shifts to the red team (defender) perspective—the four-phase defense cycle (备战/临战/实战/总结), including asset inventory, network architecture review, security checks, real-time monitoring and analysis, incident response, and the critical work of shrinking the internet-facing attack surface. - **Ending (~75%–83%)**: Covers advanced defense operations—溯源反制 (attribution and counter-offensive) techniques, vulnerability management processes, supply chain risk controls, network-side defense architecture, and a survey of key security products (IPS, email threat detection, honeypots, cloud workload protection) with deployment guidance. ## 【Key Takeaways】 - **Live-fire exercises are now a policy-driven, normalized practice** (Early): The Cybersecurity Law and subsequent regulations mandate regular drills for critical information infrastructure operators. Organizations should treat these exercises not as one-off events but as a recurring mechanism to discover weaknesses and guide security investment. - **Attackers follow a structured lifecycle, not random hacking** (Early): The blue team methodology spans intelligence gathering → external breakthrough → internal lateral movement → privilege escalation → persistence. Understanding this kill chain helps defenders anticipate where to focus monitoring and hardening efforts. - **实战化 capability differs fundamentally from traditional vuln research** (Early): Real-world attacks target business systems in complex environments, not isolated IT components. A vulnerability that cannot be chained into a meaningful attack path is useless—and social engineering is a legitimate, often decisive, tool. - **Social engineering is often the fastest path in** (Middle): Open-source intelligence (OSINT) combined with社工库 (social engineering databases) enables highly targeted phishing. The case study of a finance-department phishing campaign shows how role-based email tailoring dramatically increases success rates. - **Supply chains are the weakest link** (Middle): The case of a large enterprise with strong perimeter defenses being breached through its software vendor demonstrates that attackers will pivot to suppliers,外包商, and partners when direct assault fails. Defenders must audit third-party access and code management practices. - **Defense requires a four-phase, systematic approach** (Late): The red team framework—备战 (preparation), 临战 (pre-deployment), 实战 (active defense), 总结 (review)—emphasizes asset inventory, network path mapping, security baseline checks, and continuous monitoring. "Shrinking the attack surface" is a concrete, actionable priority. - **Attribution and counter-offense are advanced but essential skills** (Late): Effective溯源 (attribution) requires experienced analysts who can trace attack IPs, analyze logs, and even deploy honeypots to lure attackers into revealing their identity—turning the tables on the blue team. - **Product selection should follow defense strategy, not the reverse** (Ending): The book evaluates IPS, email threat detection, honeypots, and cloud workload protection from a实战 perspective—each product must map to a specific gap in your monitoring and response coverage. ## 【Reading Tips】 - **Skim the tool lists in the early chapters** (~8%–25%): The enumeration of scanners and exploit tools (AWVS, sqlmap, etc.) is useful for reference but not for deep reading. Focus instead on the attack methodology and decision logic. - **Deep-read the case studies** (~50%–58%): The supply-chain attack and the webshell-persistence scenarios are the most instructive parts of the book—they show how theory translates into multi-step, adaptive attack chains. Take notes on the decision points. - **Pay special attention to the defense checklists** (~58%–75%): The asset inventory, network path review, and vulnerability management sections are directly actionable. Consider adapting these checklists for your own organization's pre-exercise preparation. - **The product chapters are skimmable if you're not in procurement** (~75%–83%): The IPS and email security product descriptions are vendor-oriented. However, the deployment logic (where to place what) is valuable for understanding defense architecture. - **Read the purple-team sections with both hats on**: The book's strength is showing how attacker thinking informs defender strategy. If you're pressed for time, read the blue team chapters first, then jump to the red team response—the symmetry is the core insight. ## 【Coverage Limits】 The excerpts focus heavily on the blue team (attack) perspective and the organizational/defense framework; detailed coverage of purple team integration, specific tool configurations, and post-exercise remediation metrics is limited in the available material. ##