How to be Kermit in a Gonzo World... by Kevin Johnson

BSides Tampa 2025
How to be Kermit in a Gonzo World: Improving Purple-Teaming by Understanding Tech and the Business by Kevin Johnson

Purple-teaming has been around for quite awhile, but sadly most organizations aren't getting the right results. When IT and security teams work with the red-team to determine where they are detecting correctly and where they can improve, everything seems awesome, but many times the results are Gonzo running around crazy. Basically we aren't moving the security needle. So instead, how do we become the Kermits, steady and solid in the face of the crazy world.

In this presentation, attendees will be walked through how purple teaming works, the methods used by penetration testers to determine and assess monitoring and alerting thresholds, while working for lateral movement through the network or application. Then we will explore why this often fails to be used correctly and how organizations fail to capitalize on the efforts.

Finally, the presentation will cover methods to improve your security testing efforts to ensure comprehensive coverage as well as effectively measuring the risks exposed within the systems. The presentation will then dig into a process and checklist to provide ways to use this information moving forward.