Introduction to Purple Teaming
What is a Purple Team?
Last updated
What is a Purple Team?
Last updated
We probably heard of red teams and blue teams in cybersecurity. We know that red teams are the offensive security teams and blue teams are the defensive security teams. We also know about Red team vs Blue team exercises. But what about purple teams? What do they do? Why are they there? What are their objectives? These are the questions we will be finding out in this sharing.
Purple is the result of red and blue mixing together. Essentially, the purple team is a mix of existing red team and blue team members working together. It is not a unique team like the red and blue team but rather a process. A purple team will combine the offensive capabilities of the red team with the defensive capabilities of the blue team.
Since the purple team consists of red and blue team members. They continue to do what they are doing. The red team will attack using real-world tools, tactics and procedures (TTP). The blue team will identify, assess and respond to the red team's attack TTPs. Both teams will collaborate throughout the exercise.
The key difference between a normal Red vs Blue exercise and a purple team exercise is this: Red vs Blue exercise only collaborates at the end of the exercise. Sometimes, in a red vs blue team exercise, the blue team won't know that they are going through an exercise until the end to help improve the realism of the engagement. However, in a purple team exercise, the red team and blue team work together in unison. This allows for organizations to gain a true security posture of their organization due to the collaborative nature of the purple team exercise. This allows the blue team to gauge the effectiveness of existing defensive capabilities, practice and refine procedures for responding to a breach and understand their abilities to detect and respond to a specific type of threat. Thus enhancing the security posture of an organization that will often be missed in a Red vs Blue exercise.
Is the purple team really a team? Who does consist of?
What is the primary goal of a purple team exercise?
How does Purple Teaming differ from traditional Red vs. Blue Team exercises?
