Closing

This closing segment of the Pros vs. Joes game at BSidesLV 2021 gives an after-action look at a virtual blue-versus-red training exercise that ran for about 36 hours. The organizers explain that the game is meant to grow newer defenders by pairing them with professional attackers on a shared set of network assets. The red cell had early access to the environment and used persistence, default credentials, web shells and several command-and-control tools across Windows and Linux systems, while blue teams worked to find and remove those footholds.

The panelists described how defenders hunted for rogue accounts, unexpected SSH keys, respawning binaries and misconfigurations, using hardening benchmarks and attack-framework thinking to guide their work. They said removing persistence mattered more than patching, since red could often regain root through backdoored binaries without needing an exploit. A mid-event purple phase let blue players try offensive techniques, and paid consulting sessions let red members coach blue teams on specific systems. The game closed with a final scorched-earth hour in which both sides were free to disrupt the remaining hosts.

The main takeaway is that the exercise rewards learning on both sides. Participants said it built practical skills faster than routine work, and they encouraged people interested in security careers to spend time on both offense and defense.