Purple teaming

The conventional red team versus blue team perspective of penetration testing involves red teams, who launch an attack, and blue teams, who defend against the attack. However, the two teams work in isolation with minimal collaboration. As a result, the gains from simulated attack exercises are not optimal as the red team only provides a report about the successful attacks to the blue team. There is usually no chance of exploration further into the alternative attack methods that could have been used. Thus, the whole process is not exhaustive and can exclude threats that could be initiated by actual attackers. This approach is becoming outdated, with the more collaborative purple teaming approach gaining prominence. Purple teaming focuses on collaboration between the attackers and defenders to optimize the end results of a penetration test exercise.

A comparison of these approaches is visualized in the following diagram:

Figure 12.11: Purple teaming compared...