Purple Team Assessments: How to evaluate it

Author: Mike Manzotti – Principal Consultant at Dionach

Changes in the threat landscape combined with the needs of the modern enterprise often come with the requirement for IT staff to be able to respond to cyber security incidents 24/7. These changes have forced many organisations to outsource the detection and response to these incidents to third-party Security Operation Centre (SOC) providers, which offer round-the-clock services to multiple organisations.

However, how can you evaluate a SOC? How can you be confident that that an external SOC or your internal Blue Team is detecting well-known cyber-attacks, let alone sophisticated campaigns directly targeting your company and its employees? Many SOCs provide a trial period whereby you can try their services but how do you know if your investment is worth the money?

Purple Team assessments are arguably the best method of evaluating SOCs or Blue Teams. Below, we’ll take a look at what a Purple Team assessment is, the process for how they are carried out, and how they compare to other assessment frameworks.

What is a Purple Team Assessment?

A Purple Team assessment will measure your detection and response capabilities by executing pre-defined attacks that are designed to mimic real cyber threats. These attacks, agreed prior the engagement, allow the organisation to have an assessment completely tailored to their environment, goals, and playbooks, as well as allowing a comparison against desired outcomes and stated aims.

Since several attacks scenarios can be played out as part of the exercise, it can often be more efficient to exclude those are not relevant to the organisation, and only to include popular and common attacks that match with the risk profile of the organisation. The pre-defined attacks are a simulation of adversary Tactics, Techniques and Procedures (TTPs) used by Advanced Persistent Threats (APTs). TTPs are mapped by an internationally recognised framework, known as MITRE ATT&CK.

The Process

The number and category of TTPs will vary depending upon the agreed scope; however, Purple Team Assessments will typically include the following steps:

One big advantage of performing a Purple Team assessment is that they can easily be repeated over a short period of time by executing the same TTPs. The results will provide a clear indication of any improvements in detection and response capabilities over a period of time.

Additionally, multiple, consistent Purple Team assessments performed over a period of time will ensure that actioned TTPs are correctly detected and responded to accordingly and in-line with the organisation’s policies and procedures.

Red Team Assessments Vs Purple Team Assessments

At first glance, Red Team and Purple Team assessments might look very similar but there are significant differences between the two services. The following table highlights the main ones:

Red Team AssessmentPurple Team Assessment
ApproachOpportunistic approach.Red Team will take advantage of vulnerabilities that would allow an adversary to compromise systems and resources.Collaborative approach.TTPs are pre-defined by the Purple Team and Blue Team.
VisibilityOnly a small number of individuals are aware of the Red Team, or sometimes just the CTO. Blue Team or SOC are not aware of the assessment.Results are shared across Blue Team and Red Team only when the assessment is complete.Blue Team or SOC are aware of the assessment.Results are shared across Blue Team and Red Team during and when the assessment is complete.
GoalProve that sensitive data and systems can be compromised, and test detection and response capabilities.Test detection and response capabilities measured in a controlled manner, allowing improvements to be measured over a given time period.
ScopeEntire organisation. All possible attack vectors are permitted.Pre-defined TTPs. Usually these are tailored to the business model of the organisation.
DurationUsually spanned over a period of 3 months, subject to agreed objectives.Dependent on the number of TTPs selected and any custom objectives.
OutputDetailed report on how the organisation has been compromised. Feedback on detection and response capabilities based solely on the discovered vulnerabilities exploited during the exercise.Detailed report on all pre-defined TTPs indicating whether they have been detected, blocked, or investigated.The repeatable model of Purple Team exercises also allows an organisation to see measured improvement over time.
Main BenefitsMimic a realistic cyber security attack. Best tool to evaluate current overall cyber security posture.Provide an accurate metric to measure improvements on detection and response capabilities. Best tool to evaluate SOC and Blue teams.

Traditional Penetration Tests Vs Purple Team Assessments

It is also worth comparing traditional penetration testing with purple team assessments.

Penetration TestPurple Team
ApproachWhite or black box approach.
When a white boxpen test is performed, all information is shared with the tester. Conversely, when a black box test is carried out, only details of the target scope are provided.
Collaborative approach.
TTPs are pre-defined by the Purple Team and Blue Team.
VisibilityIT Team and developers are aware of the test.
Results are shared with the IT team and developers when the test is complete.
Blue Team or SOC are aware of the assessment.
Results are shared across Blue Team and Red Team during and when the assessment is complete.
GoalIdentify as many vulnerabilities as possible within a given scope, and within an agreed time frame.Test detection and response capabilities measured in a controlled manner, allowing improvements to be measured over a given time period.
ScopeThe scope is defined by the organization requesting the penetration test and can be as small as a single external IP address.Pre-defined TTPs. Usually these are tailored to the business model of the organisation.
DurationDepending on the size of the scope.Dependent on the number of TTPs selected and any custom objectives.
OutputDetailed report on the vulnerabilities identified within the given scope. There is no testing of detection and response capabilities.Detailed report on all pre-defined TTPs indicating whether they have been detected, blocked, or investigated.
The repeatable model of Purple Team exercises also allows an organisation to see measured improvement over time.
Main BenefitsGood tool for evaluating the security of a single application or network.Provide an accurate metric to measure improvements on detection and response capabilities. Best tool to evaluate SOC and Blue teams.

A summary of Purple Teams Assessments

In Summary, a Purple Team Assessment does the following:

  • Identifies gaps in existing detection and response capabilities;
  • Emulates real word attacks through TTPs;
  • Evaluates the performance of SOCs and Blue Teams;
  • Provides an accurate way to measure improvements in response and detection capabilities using industry standard frameworks.

How do I Book a Purple Team Assessment?

If you would like to discuss Purple Team assessments in more detail, or if you would be interested in a quote, please contact us here. 

Find out how we can help with your cyber challenge

Please enter your contact details using the form below for a free, no obligation, quote and we will get back to you as soon as possible. Alternatively, you can email us directly at [email protected]

Related Posts

AdobeStock_186430869

Dionach Achieves JOSCAR Registration

A Milestone in Aerospace, Defence, and Security Compliance We are thrilled to announce that Dionach is now a registered supplier on the defence portal JOSCAR, managed by Hellios. This significant achievement underscores our commitment to excellence and compliance in the aerospace, defence, and security sectors. Being JOSCAR registered not only reflects our dedication to maintaining […]
AdobeStock_211643639

Dionach Joins the ADS Group

A New Chapter in Aerospace, Defence, and Space Innovation We are thrilled to announce that Dionach has been officially approved as a member of ADS, the UK’s premier Aerospace, Defence, and Space industry trade association! This prestigious certification underscores our commitment to excellence and innovation within these critical sectors. As an ADS member, we look […]
cyber-security

Dynamic Cybersecurity: Latest Trends and Updates

In today’s interconnected digital world, the field of cybersecurity is constantly evolving to keep up with emerging threats and vulnerabilities. Staying updated with the latest developments is crucial for individuals and organisations alike to protect their sensitive information from malicious actors. In this blog post, we will explore some of the most significant updates and […]
Contact Us

Contact Us React out to one of our cyber experts and we will arrange a call