GoKawiilWhile many organizations struggle with the inherent tension between red and blue teams — where offensive security testers and defensive operators often work in silos or even develop adversarial relationships — Walmart has entirely reimagined this dynamic. Jason O'Dell, the retailer's Global VP of Security Operations, recognizes that the traditional model of rigidly separate teams conducting exercises in isolation delivers limited value and can actually damage team morale and organizational learning.
O'Dell addresses this challenge by focusing on building trust and psychological safety within security operations, transforming purple teaming from a competitive win-lose scenario into a collaborative learning environment. By physically co-locating teams, implementing a "trusted agent" observation model, and emphasizing organizational improvement over individual victories, Walmart has created a security operations culture where both offensive and defensive practitioners continuously elevate their skills — and the company's overall security posture benefits from their combined growth. Here's how they do it.
Related:Walmart Leaders Transform Security Operations Without Going Bananas
Building Learning and Trust Within Operations.
Human relationships within the organization are fundamental to O'Dell's success. A sense of togetherness plays out in the way he constructs purple teaming in security operations, which spans tabletop exercises, attack simulation and adversary emulation.
Some companies maintain rigidly separate defensive (blue) and offensive (red) teams, and some build a "purple team" to focus on both; O'Dell's approach is more nuanced and more founded in how his teams feel about the exercise. It's important to build trust that rises above the "innate friction" that's a natural by-product of pitting team against team. The culture needs to stress that it is not about winning or losing the exercise, he explains.
"I think you have to change that perception," says O'Dell. "You have to make it a safe environment for them to understand that it's about 'Did we drive the best value to the organization in becoming better as a by-product of the campaign and the work we did?'"
O'Dell has moved both red and blue teams into the same business unit and physical location and adopted a "trusted agent" model for purple teaming. When doing full-on adversarial emulation, observers are watching that campaign. For example, two members of the blue team will sit with the red team as they conduct their offensive activity and check whether telemetry, logs and detections are in place in real time. They will also protect the red team by ensuring they don't cause any harm to the business during the exercise.
Related:From Bobmojis to Bobbleheads: How the Democratic Party Built a Security-First Culture
"As long as you have great blue team members that won't throw a hint over to their brothers and sisters on the blue team, it works really well," says O'Dell.
... continue reading