SURFconext passes purple team exercise with flying colours

Purple team exercise, what is it?

In a purple team exercise, a red team and a blue team work together to carry out an attack on an online environment. This exercise specifically involved SURFconext's infrastructure and the systems and networks of the underlying platform (SVP). In the red team are the attackers, in this case the external party, Chapter8. In the blue team are the defenders, the SURFconext team and someone from Chapter8. Red and blue together are purple; purple, in other words.

Special coin

After the two full weeks of 'hacking' by the red team, they failed to penetrate SURFconext' s systems and obtain the crown jewels, such as key material and personal data. The SURFconext team therefore received a special coin from Chapter8 as a token of this exceptionally good security. In the past five years, this coin has only been awarded once before.

In this blog, you can read more about the purple team exercise with SURFconext.

Keep striving for improvement

The exercise did reveal some areas of concern for the service. One of them is that security is particularly designed to keep attackers out. Once they are in, it is not easy to see. This is therefore something the SURFconext team will work on. It is important to keep striving to improve. Every year, a risk inventory is therefore also carried out and the team tackles the points that score highest on the combination of probability and impact.