Red, blue, and purple teaming today

• The red team is responsible for simulating or emulating the attackers. Their primary goal is to gain access and achieve a predefined objective. This oftentimes, but not always, is done in a stealthy manner. 
• The blue team protects the environment. Their primary goal is to protect the network by triaging and responding to security alerts. This team has it tougher, as it’s far more difficult to defend than it is to attack.
• The purple team is a bit trickier because it isn’t an actual team, per se. It actually evolved from red teaming in an effort to reduce costs and provide greater security value. The term is meant to refer to the blue team and red team working together to raise the security bar and help improve the organization’s security posture either by collaboration or knowledge transfer. It provides the best return on investment of all the various attack simulation services offered.

How these teams have evolved

Over two decades ago, security testing was split into two main camps: infrastructure and application. Scopes were fairly loose, and the permission to exploit vulnerabilities was freely granted, if not expected, which made for a more robust security assessment. 

As testing has become more mainstream, scopes have been restricted to such an extent that testing now tends to be focused on a small piece of an environment, be it a system or an application, and the permission to exploit vulnerabilities has slowly disappeared. 

When testing in isolation, it’s harder to identify security risks posed by other areas of the business or network. As such, red teaming came about to test the broad scope of the organization and get a big-picture sense of the risk posed by a cyber breach. 

Red teaming wasn’t a strong effort until endpoint detection and response (EDR) was introduced, which prompted teams to completely shift their operating methods to living off the land more. From here, the focus was to achieve the objectives without being detected or evicted by the blue team. These jobs took longer, so the return on investment (ROI) was harder to prove given the increased resources organizations had to invest. This raised the question: is it more important to fix the security vulnerabilities or improve the detection rate?

Many companies decided to invest more in detection, which is where purple teams came into play. Purple teams reduced the time required for red teams to carry out their objectives, and gave blue teams real-time access to specialist knowledge that helped them develop their detection capabilities.

Key considerations

Although this may be frustrating, it’s easier to identify the telltale signs an organization is NOT ready for this kind of teaming. No matter how a team is structured, how many people are on it, and how strong they are, if an organization is not equipped with a 24/7 security team, they will not succeed. Working strictly nine-to-five in cybersecurity just doesn’t cut it, and it’s game over for these organizations with or without red, blue and purple teaming. 

The future of security teaming

Attack simulation of any flavor is a valuable exercise to run, but only when performed as part of a layered security strategy that addresses people, process and technology. Red, blue and purple teams are not silver bullets for cyber defense; they are just another layer of defense and verification.

When it comes to technology, organizations can start with a secure design, keep patch levels up to date, and use a “least privilege” model. Similarly, organizations must ensure their people are educated and upskilled in security with the understanding of how their actions impact the business. And finally, it’s important that security processes are exercised so they suit the organization and its people, and are familiar to all team members.

Cyber crisis exercising is the key to security, as it helps build the muscle memory of what to do in any given situation. With the pace of the industry today, to be successful in the red, blue, and purple team arena, security leaders have to continuously learn and adapt the approach as techniques, tactics, and procedures have a limited shelf life. If all teams are continuously upleveled, individuals and teams will be confident in all skills offered by all security teams.