@claushoumann Hey, thanks for bringing this up, it’s definitely not provoking! In my organization, the DE tasks are handled by our SOC teams. When I mention the blue team in my talk, it's just a general term, we actually have six teams focused on defense and incident response.

You make a great point that CTI data might not always be useful for defenders, and this was something I was concerned about when I took over the CTI team. In our early rounds of purple teaming, we noticed that our defense success was getting worse. Collaboration wasn't great, and the defense teams ended up with a pile of reports that weren't helpful.

That's when we decided to switch things up and get all the teams directly involved in the purple teaming exercises. Now, DE is done by defenders within one of our SOC teams, working together with the other teams - CTI, incident response and red team - during these exercises. We only move to the next exercise when all the DE tasks are done, even if it means that the detection team says that they can't do anything with what we have now.

That's how we're trying to make all the data - from CTI insights to red team activities - actually meaningful and actionable for our defense and risk teams.

@thekileen thanks for the questions. Let's break it down.

Vectr is being used right now as a tool for managing the purple team campaigns. We ingest intel data, create the test cases and extract reports from there. The red team decides how to execute their part, whether it's with tools like Caldera, Cymulate, or even launching attacks manually.

Yes, we took an assumed breach approach. It doesn't mean that the organization is ignoring initial access, we have other initiatives focusing on that. But we think that this helps us focus on the real risk once someone gets in, and at the same time we're covering the insider threat. Also, the reason for this links with the third question.

We're using Mitre's Top ATT&CK Techniques (https://top-attack-techniques.mitre-engenuity.org/) to help us prioritize technique simulations. When applying this methodology, initial access and impact rarely rank as top priorities. With limited resources and time, we're heavily relying on the concepts of choke points and actionability from the methodology to select which techniques to simulate.

And, as I mentioned in the talk, it's important to reassess the top techniques regularly to make sure they align with your needs, especially as your defense capacity improves for certain tactics.

Oh, and I haven't even mentioned how the risk team joins the purple team exercise...