In a world where technology runs through every aspect of our lives, cybersecurity has become more than a protective measure; it is a form of autonomy. From small everyday actions, such as protecting our passwords, to defending digital activism against sophisticated attacks, the digital environment poses increasingly complex challenges. We are currently at a critical moment with the expansion of the surveillance technology industry, the proliferation of spyware programs1 and other invasive tools. These tools are seeing growing demand from state and non-state actors. In this regard, civil society organizations are vulnerable because of their crucial role in promoting and protecting human rights. In that sense, these organizations face significant challenges due to the sensitive nature of their work and resistance from governments.
Cybersecurity thus emerges as a vital element for protecting organizations’ digital assets in our era. “Blue Team” tools2, specialized in defending those assets, play a necessary role in this field. “Blue Team” is a term that comes from military jargon. Initially, in that field the terms “Red Team” and “Blue Team” were used to tell apart the teams that attack from those that defend in tactical combat exercises. Likewise, in cybersecurity, both expressions are used to describe the groups of experts tasked with attacking and defending a computer system. “Blue Team” tools, or BTT for short, are those that allow specialist teams to carry out monitoring and preparation for detecting cybersecurity threats in organizations. Meanwhile, teams prepared to carry out offensive cybersecurity tasks are called “Red Team.”
Along these lines, at TEDIC we are part of the INSIGHTFUL project led by Internews, whose goal is to analyze open-source tools designed to address digital threats. These tools, known as “Blue Team Tools” (BTT), are aimed at defending against and investigating risks in digital environments. BTTs range from simple software for individual use to advanced, scalable solutions suited to large work teams. In particular, we carried out analyses and tests of the PiRogue tool suite (PTS) and Wazuh.
In this blogpost we present two “Blue Team Tools” (BTT) and their main features. These tools stand out for their ability to help technical teams detect threats dynamically. Their advantages include:
- Agile response: Their teams are ready to act on detected errors or to collaborate on improvements.
- Free software licensing: This allows for community auditing, since their algorithms are available to anyone interested and skilled enough to analyze them.
- Economic accessibility: They do not require high spending on licenses, which makes them easier to use, especially for teams with limited resources.
- Ease of implementation: All that is needed is a technical cybersecurity team that learns how to install and use them.
PiRogue tool suite
This tool makes it possible to analyze internet traffic and carry out detailed investigations on mobile devices. It can be installed on a Raspberry Pi, a small and inexpensive computer that many people use to browse the internet, watch videos, code, or play games. You can also install it on a virtual machine or a remote server, depending on your needs.
If you choose to use a Raspberry Pi, you can place it next to your router to create an exclusive wireless network. On this network you can connect one or two mobile phones to analyze data traffic, identify connection points, see which countries the connections are being made from, and monitor possible threats. In addition, the tool includes an alert system called Suricata, which notifies you if it detects any risk.
During our tests, we found some details that could be improved in the installation process and in the documentation. We shared these observations with the PTS team, who were very receptive and open to implementing our suggestions in future updates.
Wazuh
The second tool we tested was Wazuh, a system that works by connecting different computers to a central server in order to detect and prevent digital threats. This server, which you can install on a computer or on a virtual machine, offers many useful functions such as: reviewing configurations, detecting malware, monitoring file changes, scanning for vulnerabilities, and hunting security threats.
There are several ways to install the server, but at TEDIC we used a simple option with Docker-based containers, and it worked very well for us. However, it is important to mention that the server needs quite a lot of resources to operate, since it has many tools active at the same time. For Wazuh to work properly, we also installed a program called an “agent” on the computers we wanted to monitor. This agent is responsible for sending all the information to the server, which analyzes it in real time.
The result is a dashboard accessible from the server, where you can see a list of all connected devices. This dashboard shows threat levels for each one and lets you explore other functions. Something very practical about Wazuh is that its agents can be installed on computers running Windows, Linux, or Mac operating systems, which makes it very versatile for any organization that wants to actively protect its devices.
What’s next? Protecting ourselves is a collective commitment
Cybersecurity is not only about protecting ourselves from threats. It is a means to empower ourselves, to take control of our tools and defend our rights in the digital environment. At TEDIC we believe this responsibility is collective, and we thank all the people and organizations that joined this project. With BTTs we strengthen the resilience of civil society organizations against cyber threats. Beyond their defensive role, “Blue Team” tools have a significant impact on an organization’s security culture. By educating activists about security best practices and fostering a security mindset at all levels, they help create a safer environment. In that sense, at TEDIC we will continue working collectively to build a digital future where privacy and security are rights exercised by everyone.
1It is a type of software that is installed on the computer without the user being aware of it.
2These are cybersecurity tools used to defend an organization’s systems from cyberattacks.
Anti-NGO Law in Paraguay: Major setbacks and concerns for Democracy