Discover how red teaming and purple teaming can strengthen your cybersecurity defenses by simulating real-world attacks and fostering collaboration between offense and defense teams.
Red Teaming
Red teaming is usually understood to be a form of testing in which the scope of the test is not limited to one application, but tests whether, for example, access to certain data can be obtained. The application through which the tester gains access to the data isn’t specified further so that the entire security concept is tested instead of individual applications. In most cases, the red team assessment is also regarded directly as blue team training.
In this context, the blue team is the team for the tested party that is responsible for protecting the systems. This also means that, compared to many penetration tests, the red team tries to hide its activities to avoid detection. Common activities include the following:
- Searching for as many access points as possible to the desired asset or information
- Quickly analyzing which of the identified access points has the least security and would mean the quickest possible success
- Manually searching for mostly new, not yet known vulnerabilities in the respective applications
- Potentially compromising multiple servers and users on the network to get to the target asset
Conducting red team assessments may be appropriate, for example, when:
- security measures have already been taken and a realistic picture of the security of the entire network against targeted attacks is to be determined;
- your company has critical corporate data that needs special protection and you want to check whether existing security measures protect it effectively enough; or
- the internal team is to be trained practically in as realistic a manner as possible and in its own environment.
Red team assessments are a special form of testing in which several specialists from different areas may work together to achieve the previously defined goal. The assessment gives you the most realistic view of an attacker’s most likely attack path but will not evaluate all identified attack paths in detail unless otherwise agreed. Also, there is no detailed assessment of individual applications as the tester looks for the most promising attack opportunities across all applications.
The red team is also intended to train the response and knowledge of your blue team. In the best case scenario, a collaboration between the two teams is achieved, constantly improving your organization’s security and response to attacks.
Clarify the common understanding of the test type! Even if the client and the contractor use the same words, they might not mean the same thing by them. Because vulnerability scans are often also sold as penetration tests, this can lead to both misunderstandings during meetings and unusable project results. You should therefore clarify the intent right at the beginning of the first meeting to prevent misunderstandings.
Purple Teaming
The term purple teaming is interpreted in different ways. In general, the goal of purple teaming is to promote cooperation between the red team and blue team in order to constantly improve the blue team’s capabilities and be better protected from real attacks in the future. In contrast to pure red teaming, purple teaming focuses primarily on the development of the blue team.
To make the development of the blue team as structured as possible, the first step is to define the type of attacker for which the blue team should be trained and the technical means available to the blue team. Derived from this, information from the MITRE ATT&CK framework can be used to determine the usual steps taken by these groups of offenders and, based on this, a test plan can be derived.
Based on this test plan, individual attack steps are specifically recreated by the red team. A subsequent analysis then determines whether existing tools and the blue team were able to detect these activities. If not, the blue team will receive all the necessary information to detect such actions in the future. In this way, the blue team is gradually introduced to the possible attack steps over several iterations and trained to recognize them and initiate appropriate countermeasures.
Common activities include the following:
- Joint derivation of typical attacker types against which the company primarily wants to protect itself
- Researching common attack techniques from actual incidents, in many cases based on the MITRE ATT&CK framework
- Manual or automated execution of targeted test cases to test and train the blue team’s detection capabilities and response in a structured manner
- Disclosure of the red team’s attack techniques used to the blue team
- Examination of which attacks could have been detected and what changes are necessary to be able to detect these attacks in the future
- Regular repetition of training activities
An implementation of purple teaming can be useful, for example, if:
- the blue team is to be trained on new attacks or new offender groups;
- you want to examine in a structured way which attacks your existing security operations center (SOC) can detect, and this should be accompanied by targeted training and an improvement in detection capabilities; or
- you don’t yet have an existing SOC but want to build up the know-how and tools to detect attacks in a step-by-step and targeted manner.
MITRE ATT&CK Framework: The MITRE ATT&CK framework is a knowledge base of so-called attacker tactics and techniques. The database is constantly being expanded and adapted to the findings from actual incidents and the research of IT security companies. For more information, visit https://attack.mitre.org.
Editor’s note: This post has been adapted from a section of the book Hacking and Security: The Comprehensive Guide to Penetration Testing and Cybersecurity by Michael Kofler, Klaus Gebeshuber, Peter Kloep, Frank Neugebauer, André Zingsheim, Thomas Hackner, Markus Widl, Roland Aigner, Stefan Kania, Tobias Scheible, and Matthias Wübbeling.
Comments