Purple team engagements identify vulnerabilities within processes such as misconfigurations with log aggregation and AV/EDR configurations.
This type of assessment includes logging and categorizing specific tactics, techniques, and procedures (TTPs) used in the test, providing your team with valuable data in their continued work.
To execute a purple team engagement, our team will employ various methodologies (outlined below) as well as cutting-edge techniques to simulate the same type of breach attacks that a real-world attacker might use.
These will be reproducible processes to ensure that the results are consistent and can be repeated for security operation center analysis. To enhance the repeatability, the MITRE ATT&CK framework will be leveraged, a globally accessible knowledge base of adversary tactics and techniques for exploitation activities.
Schellman does perform purple team assessments—our Penetration Testing Team continues to grow and is currently comprised of individuals from different backgrounds including former developers, system administrators, and lifelong security professionals. Our team is incredibly experienced, and collectively holds the following professional certifications, among others
Typically, this takes one to two weeks.
The engagement kicks off with a meeting reviewing your current digital footprint and potential attack scenarios.
Over the next few days, we conduct loud and quiet attack simulations and share the results with the your Blue Team during scheduled collaboration meetings that last for a few hours each day.
The duration of the meetings is adjusted to fit your team's work schedule to ensure seamless cooperation between us both.
You can expect to pay no less than $45,000 for a purple team assessment though your final price will vary based on your overall goal.
A purple team assessment focuses on collaboration between our team and yours. You have insight into each action we, as attackers, take to identify vulnerabilities and then exploit them.
A penetration test is performed by allowing testers into your environment with the goal being to identify and exploit vulnerabilities, whereas a red team assessment is performed with no “assumed” access and with a targeted goal of reaching high-value targets or systems such as executive workstations, code repositories, or financial information.
Red teaming and penetration testing also vary primarily in depth and scope. If you're already performing penetration tests and want to know how your people, network, and applications will withstand an unannounced attack, it may be worth it to invest in a red team assessment as well.
Ultimately, any organization that wants to improve its security posture and discover vulnerabilities that only a third-party assessor can identify, will gain from a purple team engagement. Those with a mature security program will be able to test the effectiveness of their technical control implementation efforts and identify any remaining gaps in their attack detection / response capabilities.