Purple Teaming in the Enterprise: Adobe's Approach to Security Collaboration

Understanding Purple Teaming

• 🎯 Purple teaming is an industry-embraced strategy that strengthens the blue team by making them aware of attack simulations, often with their direct input.
• 💡 It differs from traditional red teaming by fostering immediate feedback and shared details between offensive and defensive teams, building stronger defensive muscles.
• 🤝 The core idea is to use the red team as a practice squad for real-time adversaries, enhancing preparedness and response effectiveness.

Daily Collaboration at Adobe

• 🔄 Purple teaming at Adobe is a continual partnership, blending ongoing engagements with planned exercises.
• 📈 Red and blue teams collaborate to track emulation effectiveness, refine detection, and adjust operations based on red team findings.
• 🤝 Regular meetings and open communication channels ensure both teams are aligned and informed.
• 🏈 The analogy of a practice squad in sports is used to emphasize learning and strengthening plays before game day (real incidents).

Real-World Purple Team Scenario

• 🎯 A specific asset is chosen for protection, and an attack path is planned and discussed with the blue team.
• 🔍 The red team executes the attack path using real-world adversary techniques, step-by-step.
• 🛠️ This process identifies areas to harden defenses and where new detections are needed for early alarms.
• 📊 From the blue team's perspective, they look for detections firing during operations and perform deconflictions to capture red team activity, noting lessons learned to improve future detection.

Tools and Overcoming Challenges

• ⚙️ Adobe utilizes a custom toolchain including custom exploits, a proprietary command and control framework, and developed post-exploitation modules for safe and ethical emulation.
• ⚖️ Conflicting priorities are managed through a maturation process and a developed model for prioritizing emulation efforts based on defined parameters.
• 🤝 The relationship is framed as a **