Why Purple Teams?
The concept of purple teaming is not new. We’ve been doing it for years; it was just disjointed and we didn’t call it “purple” or “red and blue”. Instead, the red team “broke in” (usually walked in), perused the aisles, took what they wanted, and then wrote up a scathing report with lots of items for the blue team to “fix”. The end result was the red team left with a “mission accomplished” feeling and the blue team was left feeling dejected or confused or angry and then tasked with digging through log sources to find out what went wrong with all the defensive controls they painstakingly put in place but still “didn’t see anything”. We aim to identify: