DEF CON 33 - Letthemin: Facilitating High Value Purple Teams Using Assumed Compromise - Sarah Hume

Purple teaming uses an "assume compromise approach" to create high-value security evaluations by testing detection capabilities rather than vulnerabilities 0:31.

Key Takeaways:
• Purple teaming is a collaborative workshop where red and blue teams execute together in an open-book format, bringing all security departments together 4:08
• Unlike automated breach and attack simulation, purple teaming focuses on attack authenticity and shouldn't be replaced by BAS solutions 8:07
• The assume compromise approach gives testers access at multiple levels to fully simulate adversary activities, like testing DC sync attacks to evaluate underlying activities rather than specific procedures 10:11
• Purple team scoring focuses on successful outcomes without penalizing "failures," creating a blame-free environment that fosters collaboration 15:49

The goal of this approach is to flip the burden of perfection, recognizing that defenders can't prevent everything but can break the attack chain through strategic detection and prevention controls 21:01.

Sources:

• 0:31 Introduction to assume compromise approach for purple teams
• 4:08 Definition of purple teaming as collaborative workshop
• 8:07 Distinction between purple teaming and breach and attack simulation
• 10:11 Example of DC sync attack testing
• 15:49 Purple team scoring methodology
• 21:01(https://www.youtube.com/watch?v=xM8nodIw1_E&t=126