48 min
Becoming a Purple Team Ambassador with SCYTHE’s Jorge Orchilles Hacker Valley Blue
-
- Technology
Jorge Orchilles, Chief Technology Officer at SCYTHE and Principal SANS Instructor, brings his expertise in purple teaming to the pod this week to talk about the uniquely human and the understandably technical parts of red and blue collaboration. As the Purple Team Ambassador at SANS, Jorge lives for all things purple team, pioneering the purple team framework used in different SANS courses. This week, Jorge talks about transitioning from tech to security and remembering we all are working for the same goal.
Timecoded Guide:
[00:00] Growing up in tech & discovering the cybersecurity world
[13:52] Moving from SOC & ethical hacking to pen testing
[26:25] Encountering the human side of a purple team engagement
[32:02] Proactive cybersecurity collaboration with PlexTrac & SCYTHE
[45:57] Transitioning from red vs purple to purple through knowing all sides
Sponsor Links:
Thank you to our friends at Axonius and Plex Trac for sponsoring this episode!
The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley
PlexTrac, the Proactive Cybersecurity Management Platform, brings red and blue teams together for better collaboration and communication. Check them out at plextrac.com/hackervalley
What was your experience writing a book as you got into working security?
As a system admin just starting to get into SOC, Jorge agreed to write a book on Windows 7. In the course of just a few months, Jorge ended up writing a book, finishing up his Master’s degree, and working the night shift for his new SOC job. This type of grind paid off for Jorge’s career, but he doesn’t miss the amount of stress and strain he felt by trying to get everything done at once--- a common feeling amongst overworked tech employees.
“It was a great experience [writing a book], but at the same time, I was finishing my Master's, and I just got the SOC job, so I had to work three months of night shift, and it was like 7pm to 7am. So, that night shift along with the Masters, along with writing a book was just a lot.”
What was the moment that the purple team idea clicked for you?
In 2016, Jorge encountered a purple team activity for the first time as an employee at Citigroup. Back then, Jorge explains that the term “purple team” didn’t even exist yet, and their exercises were instead referred to as collaborative red team engagements. Still, the concept of purple teaming immediately piqued Jorge’s interest, especially when he began to encounter the personal collaborative efforts of purple teaming within the rigid world of cyber and tech.
“A lot of people think purple teaming is just these collaborative, hands-on exercises, but there's a psychological part of purple teaming no one ever talks about and that is the understanding that we are all human, we all have different goals, we all work for the same company.”
What are things that we could do or exercises to perform to create a bonding experience in a purple team exercise?
Purple teaming is much more than seating your red team and blue team in the same room. Jorge explains that goals for purple team engagements have to be thoroughly defined and understood by members of the team before the engagement begins. Through his work with SCYTHE and SANS, Jorge often encounters practitioners and managers with the wrong perspective on purple teaming, thinking it's just a forced effort instead of an active collaboration.
“The overall goals need to be covered first. What is the goal? Is it to run an adversary emulation together so that the blue learns from the red and the red learns for the blue? Or, is it to foster a collaborative culture? Because those two goals are different.”
What advice do you have for a security practitioner making that transition from red and blue team to a purple tea
Jorge Orchilles, Chief Technology Officer at SCYTHE and Principal SANS Instructor, brings his expertise in purple teaming to the pod this week to talk about the uniquely human and the understandably technical parts of red and blue collaboration. As the Purple Team Ambassador at SANS, Jorge lives for all things purple team, pioneering the purple team framework used in different SANS courses. This week, Jorge talks about transitioning from tech to security and remembering we all are working for the same goal.
Timecoded Guide:
[00:00] Growing up in tech & discovering the cybersecurity world
[13:52] Moving from SOC & ethical hacking to pen testing
[26:25] Encountering the human side of a purple team engagement
[32:02] Proactive cybersecurity collaboration with PlexTrac & SCYTHE
[45:57] Transitioning from red vs purple to purple through knowing all sides
Sponsor Links:
Thank you to our friends at Axonius and Plex Trac for sponsoring this episode!
The Axonius solution correlates asset data from existing solutions to provide an always up-to-date inventory, uncover gaps, and automate action — giving IT and security teams the confidence to control complexity. Learn more at axonius.com/hackervalley
PlexTrac, the Proactive Cybersecurity Management Platform, brings red and blue teams together for better collaboration and communication. Check them out at plextrac.com/hackervalley
What was your experience writing a book as you got into working security?
As a system admin just starting to get into SOC, Jorge agreed to write a book on Windows 7. In the course of just a few months, Jorge ended up writing a book, finishing up his Master’s degree, and working the night shift for his new SOC job. This type of grind paid off for Jorge’s career, but he doesn’t miss the amount of stress and strain he felt by trying to get everything done at once--- a common feeling amongst overworked tech employees.
“It was a great experience [writing a book], but at the same time, I was finishing my Master's, and I just got the SOC job, so I had to work three months of night shift, and it was like 7pm to 7am. So, that night shift along with the Masters, along with writing a book was just a lot.”
What was the moment that the purple team idea clicked for you?
In 2016, Jorge encountered a purple team activity for the first time as an employee at Citigroup. Back then, Jorge explains that the term “purple team” didn’t even exist yet, and their exercises were instead referred to as collaborative red team engagements. Still, the concept of purple teaming immediately piqued Jorge’s interest, especially when he began to encounter the personal collaborative efforts of purple teaming within the rigid world of cyber and tech.
“A lot of people think purple teaming is just these collaborative, hands-on exercises, but there's a psychological part of purple teaming no one ever talks about and that is the understanding that we are all human, we all have different goals, we all work for the same company.”
What are things that we could do or exercises to perform to create a bonding experience in a purple team exercise?
Purple teaming is much more than seating your red team and blue team in the same room. Jorge explains that goals for purple team engagements have to be thoroughly defined and understood by members of the team before the engagement begins. Through his work with SCYTHE and SANS, Jorge often encounters practitioners and managers with the wrong perspective on purple teaming, thinking it's just a forced effort instead of an active collaboration.
“The overall goals need to be covered first. What is the goal? Is it to run an adversary emulation together so that the blue learns from the red and the red learns for the blue? Or, is it to foster a collaborative culture? Because those two goals are different.”
What advice do you have for a security practitioner making that transition from red and blue team to a purple tea
48 min