-
Book Overview & Buying
-
Table Of Contents
Agile Security Operations
By :
Active defense, which we discussed in Chapter 6, Active Defense, applies the principles of blue teaming. Many organizations, as part of the process of deploying new applications, as well as to provide ongoing assurance, perform red teaming to ensure that at least the obvious security vulnerabilities have been addressed before putting a new application or a new infrastructure out into the world. Purple teaming is a mix of the two.
In purple teaming, the defenders, or the blue team, perform monitoring and alerting, while the red team, the attackers, perform controlled attacks. During the process or afterward, the teams compare notes to evaluate how certain attacks appear on the network, whether detections need to be updated, and whether defenses need to be strengthened in certain areas. The business value of purple teaming is that it allows an organization to gradually move to threat-informed defense.
A purple team adds a certain amount...
Change the font size
Change margin width
Change background colour