The colors of cybersecurity
Leverage managed services to continually improve your security posture
Using Red and Purple teaming to go beyond traditional pen testing
The frequency of penetration tests and an effective remediation program often correlate with a reduction in identified vulnerabilities. Typically, organizations will perform annual testing based on industry leading practices and regulatory requirements. This approach can be effective, but it can also cause a false sense of security. An annual testing approach is often point-in-time, and only leverages traditional network and application testing techniques. Many organizations have faced major incidents from attack vectors that simply cannot be accounted for in traditional testing. For example, consider these real-world scenarios in which bad actors have:
- Compromised a cloud or on-premise web app, discovering privileged credentials that then allowed lateral movement across the network.
- Compromised operator credentials via social engineering, gaining access to the internal network through the VPN.
- Compromised servers by deploying remote access—and maintaining it through C2 persistence.
- Mapped the internal network, exploiting systems and escalating privileges to domain administrator role.
- Conducted activities on financial systems, exfiltrating sensitive information.
Traditional testing attempts to capture some of these activities, but threat actors are not constrained to vulnerability scans, scope limitations, testing windows, or rules of engagement. Is there a more effective approach? KPMG believes so!
Red Teaming
One way to take a more effective stances against bad actors is with “Red Team” testing, in which teams of cybersecurity professionals pose as hackers to test an organization’s defenses by any means necessary. These Red Team tests take a “gloves off” approach and perform scenario-based testing to emulate abstract attack vectors that attackers use in the wild. This can be useful but is still point in time testing and often results in a similar outcome to traditional penetration testing; namely, an after-action report. To overcome this, leading cybersecurity providers are building on these practices with a more collaborative approach called “Purple Team”.
Purple Team
The Purple Team moniker arises from the two teams who partner to make this approach possible: the offensive Red Team, and the defensive Blue Team. While the Red team launches attacks, the Blue Team learns from the Red Team in real time to bolster their ability to detect and respond to attack. This approach involves active collaboration between the Red and Blue teams, with the Red Team constantly feeding successful attack methods to the Blue Team, which makes on-the-fly adjustments to improve the security posture. The goal of this type of engagement is real-time improvement of the Blue Teams’ security operations across people, processes, and technology. A successful Purple Team will result in significant improvements to Blue Team processes and is best suited for organizations seeking to improve their defensive operations. Threats addressed could range from weak passwords and protocols to unpatched systems, man-in-the-middle attacks, privilege escalation, flaws in personnel security training, and/or holes in detection mechanisms.
Continually improving the security posture
Advanced persistent threats and nation-state actors do not stick to traditional offensive security methods, and they certainly don’t restrict themselves to expected tactics, techniques and procedures. That’s why progressive companies are increasingly engaging offensive security managed services providers to emulate these adversaries through ongoing testing, while continually honing defenses.
How KPMG can help
KPMG offers extensive security testing as an outcome-based managed service, helping organizations consistently validate controls while minimizing remediation efforts. That’s because business transformation is not a fixed destination; it’s an ongoing journey. With Managed Services, we help to continually evolve your business functions to keep up with ever-changing targets, while driving outcomes like cost reduction, resilience, and stakeholder trust.
Meet our team
