Go Purple! Adopt purple team strategy to augment Application Security Programs

No ratings

Presented at lascon 2016 by

Trupti Shiralkar

Lately, monolithic applications have been replaced by more complex and evolving micro-service oriented architecture. Moreover, with the rise of CI/CD, DevOps, and agile SDLC, the need for building security as a core line of business has become an indispensable requirement. Within this framework, the traditional security evaluation approach, or the new secure DevOps approach implemented using small security teams (blue team, red team, DevOps security team, etc.) present both limitations and advantages. Specifically, the checkpoint approach slows down deployments, and not all types of security assessments can be automated in CI/CD. In this presentation, I suggest that a purple team strategy is the best way to weave security across business units in an organization. Purple teams are security teams that consolidate the defensive security controls prominently learnt from blue teams with the vulnerabilities and exploitation techniques utilized by red teams, into a single score. A purple team approach can break artificial boundaries and transform security from a checkpoint to a semi-mystical function. Successful collaboration between purple team members and developers/devOps engineers will bridge the operational gap between implementation and verification of defensive controls, while using exploitation techniques will reduce the issue identification and remediation time significantly. Adopting a purple team approach can also break the negative stereotype associated with security professionals and security testing. In this talk, the audience will learn the traits and methodology of purple teams and how they are used to influence security among various groups, while augmenting the effectiveness and influence of application security programs.