The terms "Red Team" and "Blue Team" are used to describe the roles of attackers and defenders during planned security exercises. At GitLab, where collaboration and transparency are two of our core values, we like to join forces and conduct what is commonly referred to as "Purple Teaming".
To us, a Purple Team operation is a planned exercise that involves team members from multiple security sub-departments in every aspect of the operation. This includes planning, attacking, detecting, and responding. We find that having more people involved from the very beginning ensures that we are all working towards a common goal.
You can contribute, comment, view, or interact with us on Slack in the #purple-team-ops channel where we discuss ongoing purple-team operations.
We also conduct more traditional Red Team operations, where only certain team members are aware of the details. These types of operations follow roughly the same workflow outlined below, only with less active participants.
Purple Team operations are not penetration tests. They are not meant to deliver a list of vulnerabilities in a specific application or service. Instead, they are meant to better understand our organization's ability to detect and respond to real-world attacks. Given this deeper understanding, we can continue to strengthen these defenses based on the hands-on experience gained during emulated attacks, as opposed to the real thing.
At a high level, the goals of an operation generally fall into one of the following categories:
The diagram below shows our basic workflow for planning, executing, and completing an operation. Everyone is welcome to participate actively in all stages, but some stages are owned specifically by one group or another.
Operations will be tracked using GitLab epics. Each of the unique stages has a corresponding issue template that provides further detail on exactly what needs to be done. These templates are shared publicly here.
As much as possible, our Purple Team operations should be performed asynchronously. However, a few stages work best when done with live participants over a video conference with screen sharing. To include team members in all time zones, these stages can be conducted more than once. This is particularly beneficial when conducting the actual attacks and practicing detection. We will automate this work whenever possible, which makes repeating them easy.
