Walmart Transforms Security Teams With Purple Teaming
While many organizations struggle with the inherent tension between red and blue teams — where offensive security testers and defensive operators often work in silos or even develop adversarial relationships — Walmart has entirely reimagined this dynamic. Jason O’Dell, the retailer’s Global VP of Security Operations, recognizes that the traditional model of rigidly separate teams conducting exercises in isolation delivers limited value and can actually damage team morale and organizational learning.
O’Dell addresses this challenge by focusing on building trust and psychological safety within security operations, transforming purple teaming from a competitive win-lose scenario into a collaborative learning environment. By physically co-locating teams, implementing a «trusted agent» observation model, and emphasizing organizational improvement over individual victories, Walmart has created a security operations culture where both offensive and defensive practitioners continuously elevate their skills — and the company’s overall security posture benefits from their combined growth. Here’s how they do it.
Building Learning and Trust Within Operations.
Human relationships within the organization are fundamental to O’Dell’s success. A sense of togetherness plays out in the way he constructs purple teaming in security operations, which spans tabletop exercises, attack simulation and adversary emulation.
Some companies maintain rigidly separate defensive (blue) and offensive (red) teams, and some build a «purple team» to focus on both; O’Dell’s approach is more nuanced and more founded in how his teams feel about the exercise. It’s important to build trust that rises above the «innate friction» that’s a natural by-product of pitting team against team. The culture needs to stress that it is not about winning or losing the exercise, he explains.
«I think you have to change that perception,» says O’Dell. «You have to make it a safe environment for them to understand that it’s about ‘Did we drive the best value to the organization in becoming better as a by-product of the campaign and the work we did?'»
O’Dell has moved both red and blue teams into the same business unit and physical location and adopted a «trusted agent» model for purple teaming. When doing full-on adversarial emulation, observers are watching that campaign. For example, two members of the blue team will sit with the red team as they conduct their offensive activity and check whether telemetry, logs and detections are in place in real time. They will also protect the red team by ensuring they don’t cause any harm to the business during the exercise.
«As long as you have great blue team members that won’t throw a hint over to their brothers and sisters on the blue team, it works really well,» says O’Dell.
If the red team only attacks and then delivers a report, «you get a little value out of that,» he says. But if the red team representatives tell the blue team what they could do to make things difficult, it changes the dynamic of the exercise, says O’Dell.
«What does that cause the red team to do? It causes them to pivot,» says O’Dell. «What happens over time is you get this incremental increase in both your red team and blue team that drives value to your organization, ‘cause they’re both getting better.»
This is great for staff retention, too; both teams feel that they always have something to learn.
Walmart Leaders Transform Security Operations Without Going Bananas is the complete story of how Walmart has transformed its entire security operations strategy — including O’Dell’s approach to executive communication, his framework for balancing security value against operational friction, and his philosophy on positioning security as a business enabler.
Hemos recibido este contenido de ciberseguridad de: DarkReading
Puedes encontrar la noticia original en el siguiente enlace: https://www.darkreading.com/cybersecurity-operations/walmart-trusted-agent-approach-purple-teaming
