Blurple Teaming: Open Source Continuous Security Testing in the SOC
6SANS Blue Team Summit 2023
Blurple Teaming: Open Source Continuous Security Testing in the SOC
Speaker: David Hunt, Co-Founder & CTO, Prelude
We'll begin this talk with a brief history of purple teaming, TTPs, and security testing, and the technical and organizational pitfalls that hinder scalability. We'll then immediately dive into an introduction of open source Verified Security Tests (VSTs)(https://github.com/preludeorg/test) - a more structured, scale ready format of the TTP. VSTs have characteristics that encourage scale and safety. In the context of this presentation, we'll focus on VSTs that are designed to test the efficacy of defensive technologies. Verified Security Tests can be mapped to classification systems, such as MITRE ATTACK, CVE or NIST controls. Mapping tests provides a natural grouping so you can analyze results through a lens you're familiar with. The second component to introduce are open source probes (https://github.com/preludeorg/libraries) - temporary processes that requires no special privileges and no installation to run. A probe can just be started. Probes are designed to be very lightweight - measuring between 1-50KB on disk - and to run anywhere you have code. As such, probes can deploy out on devices ranging from laptops to servers to cloud environments and OT infrastructure. Combining probes and VSTs provides a foundation for continuous security testing of production endpoints. This presentation will then dive into a brand new concept, Blurple Teaming: deploying continuous security testing at scale, integrating defensive controls, and embedding the process within the SOC to better improve defenses. By attaching an EDR control, users are able to send all missed detections to a vendor in real time. Every time a VST should have been caught - but wasn't the event can be sent to a vendor for analysis. By running VSTs continuously, you can validate whether or not a fix is deployed in a reasonable time period. After outlining the technology/process, we'll begin an interactive session where attendees can follow along a quick start tutorial for deploying probes and running verified security tests. By the end of the session, attendees will have been able to deploy multiple probes, create a schedule of VSTs, and begin collecting results.
View upcoming Summits: http://www.sans.org/u/DuS