Book Image

Purple Team Strategies

By : David Routin, Simon Thoores, Samuel Rossier
Book Image

Purple Team Strategies

By: David Routin, Simon Thoores, Samuel Rossier

Overview of this book

With small to large companies focusing on hardening their security systems, the term "purple team" has gained a lot of traction over the last couple of years. Purple teams represent a group of individuals responsible for securing an organization’s environment using both red team and blue team testing and integration – if you’re ready to join or advance their ranks, then this book is for you. Purple Team Strategies will get you up and running with the exact strategies and techniques used by purple teamers to implement and then maintain a robust environment. You’ll start with planning and prioritizing adversary emulation, and explore concepts around building a purple team infrastructure as well as simulating and defending against the most trendy ATT&CK tactics. You’ll also dive into performing assessments and continuous testing with breach and attack simulations. Once you’ve covered the fundamentals, you'll also learn tips and tricks to improve the overall maturity of your purple teaming capabilities along with measuring success with KPIs and reporting. With the help of real-world use cases and examples, by the end of this book, you'll be able to integrate the best of both sides: red team tactics and blue team security measures.
Table of Contents (20 chapters)
Part 1: Concept, Model, and Methodology
Part 2: Building a Purple Infrastructure
Part 3: The Most Common Tactics, Techniques, and Procedures (TTPs) and Defenses
Part 4: Assessing and Improving

What this book covers

Chapter 1, Contextualizing Threats and Today's Challenges, defines the overall threat landscape and explains why we must adopt a proactive approach to cybersecurity. It also identifies the current issues with Red and Blue Teaming and defines the requirements for purple teaming.

Chapter 2, Purple Teaming – a Generic Approach and a New Model, defines purple teaming, including the core process and its different types of exercises and objectives. The chapter also introduces a new model for effectively applying purple teaming within your organization.

Chapter 3, Carrying Out Adversary Emulation with CTI, introduces the process of CTI and how it must be leveraged for effective and relevant purple teaming exercises.

Chapter 4, Threat Management – Detecting, Hunting, and Preventing, introduces the processes of managing threats by using threat hunting capability, detection engineering, and prevention mechanisms.

Chapter 5, Red Team Infrastructure, defines the red team infrastructure components used by both attackers and red teams. In particular, we will learn about the most common offensive frameworks and efficient phishing techniques, as well as how to leverage automation and cloud environments.

Chapter 6, Blue Team – Collect, describes the required architecture to perform an efficient event collection. We also introduce the Windows Event Forwarding protocol and provide real-life experience tips.

Chapter 7, Blue Team – Detect, details data sources and solutions that can be used by a blue team for detection. The chapter also introduces the concept of deception through practical examples.

Chapter 8, Blue Team – Correlate, introduces the theory of correlation and describes how detections should be performed within a centralized place, such as Security Information Event Management (SIEM). The chapter also introduces common query languages that can be leveraged to ease investigation and incident response.

Chapter 9, Purple Team Infrastructure, describes the technology available to ease and automate the process of purple teaming. It introduces adversary emulation frameworks as well as breach and attack simulation tools. The chapter also introduces the theory behind DevOps and how it can be used to facilitate the process of purple teaming.

Chapter 10, Purple Teaming the ATT&CK Tactics, describes the most commonly used techniques for each tactic of the MITRE ATT&CK framework. For each technique, the chapter defines how to perform the activity from a Red Team point of view, as well as how to defend against such a technique.

Chapter 11, Purple Teaming with BAS and Adversary Emulation, puts into practice the theory learned throughout the book by leveraging different frameworks and solutions, while also highlighting the various maturity levels of purple teaming.

Chapter 12, PTX – Purple Teaming eXtended, puts into practice the new concept of PTX introduced in Chapter 2, Purple Teaming – a Generic Approach and a New Model, with concrete examples, leveraging a diffing technique.

Chapter 13, PTX – Automation and DevOps Approach, puts into practice the theory of DevOps introduced in Chapter 9, Purple Team Infrastructure, with concrete examples of how to implement it, especially the diffing approach.

Chapter 14, Exercise Wrap-Up and KPIs, concludes the book by presenting Key Performance Indicators (KPIs) and reporting ideas. This chapter also presents the authors' view on the future of purple teaming.