Red and Blue Make Purple: How Collaboration Safeguards CMS Cybersecurity

You may remember the classic strategy game Battleship: A player secretly arranges their fleet on a grid, with the objective of defending against potential attacks from an opponent. The opponent, in turn, carefully assesses where a ship is located, sniffing out vulnerabilities with targeted “hits” until they sink each ship, one by one.

In the simplest terms, the Battleship analogy describes the crucial role the Red and Blue teams play in the CMS Cybersecurity Integration Center (CCIC). Situated within ISPG, the Red Team and the Blue Team function respectively as offensive and defensive security experts. In a controlled environment, the teams conduct mock cyber attacks, called engagements, designed to test the effectiveness of CMS security.

At the heart of these tests lies the Purple Team. A distinctly collaborative initiative, the Purple Team drives CMS’s cybersecurity strategies. The team consists of members from Red and Blue that, together, share knowledge and insight from the engagements. 

An engagement begins with the Red Team: Taking on the role of the attacker, the Red Team simulates a month-long virtual offensive in a mock attempt to penetrate CMS systems. Using real-life adversarial techniques, the simulations expose security gaps and vulnerabilities.

Enter the Blue Team. As CMS’s risk mitigators, the Blue Team works to identify threats before they occur. During an engagement, they must investigate the digital landscape for evidence of a breach and respond accordingly. While the Red Team ramps up tactics, the Blue Team’s detection skills are continuously put to the test.

After each simulation, the Purple Team conducts debriefings to analyze what worked and what didn't. They document lessons learned and use them to refine CMS’s security approach.

By working together, a unified Red and Blue Team is able to:

• Gain a deeper understanding of attack strategies and defense mechanisms
• Map out security gaps and vulnerabilities more effectively
• Combine offensive and defensive insights to mitigate risk 
• Prioritize remediation based on the potential impact to sensitive data

The Purple Team’s critical work shapes security policies and procedures, enabling OIT to respond effectively to emerging threats and ensure CMS is ahead of the game.