Pen & Purple Team Assessments

• Vuln & Pen Testing Problem

  You’ve got your network configured, things are patched, and everything should be sure, right? But are they? What assurances do you have that they are secured, properly?

  • Configurations change – constantly! Is RDP or Telnet open to the world for you to hack?
  • Are your credentials on the DarkWeb, now being used to hack your organization? 
  • Have you performed a digital transformation, now using new hardware, software, architecture or all of the above? How confident are you that your staff is trained, competent, and skilled to have configured and hardened it properly against attack?
  • SecOps is a great concept but HARD to achieve. We patch but did you validate that the patch took? Perhaps it requires a restart and you didn’t restart the device? Maybe there wasn’t enough disk space for the patch to be applied? Lots of root causes might exist for a patch to not take, and it only takes one non-compliant device to leave a hole to be exploited through which an adversary enters to take over the entire network.

• Vuln & Pen Testing Solution

  4D5A Security offers three types of vulnerability penetration and purple team assessment services:

  • Blackbox – emulates an adversary with no inside knowledge
  • Graybox – some knowledge shared prior to evaluation
  • Whitebox – full sharing prior to testing

  A vulnerability assessment provides a full summary of all assets discovered within an approved netblock that is scanned for devices, and opened ports, and what is potentially vulnerability and prioritized within that, based upon findings and architecture identified. This is where hacking-101 beings and where most worms, bots, and automated attacks also being their attacks once they land and expand inside of a compromised or network or when automating attacks from the outside.

  Penetration testing involves attempting to penetrate, or intrude, services, accounts, and assets to emulate that of a threat actor or threat (e.g. ransomware).   4D5A creates a rules of engagement (RoE) with a client to clarify exactly what is and is out of scope, how to handle situations that may arise, etc, to carefully manage penetration testing with a client according to black/gray/whitebox engagement conditions and criteria. Penetration testing is often paired with evaluation of MSSP or SOC operation evaluations (blackbox for them) to see how well such staffs or shifts and/or tooling identify and respond (MTTD/R) to specific emulated threats and TTPs performed by 4D5A Security during the penetration test (e.g. password spray attack upon credentials of a C-suite executive).

  Purple Team assessments involve both blue team (client IT/security) and red team (4D5A penetration testing) working together in demonstrated exercises and workshops to work through specific emulated threats, configurations, hardening, and remediation, to lower risk for a company, improve awareness, and unify leadership and engineers.

• 4D5A Security - How We Are Different

  Affordable excellence is achieved within readiness assessments through the following summarized strategies:

  • Experienced Staff without the Certified Cost
    Experienced staff, even if they are certified, are not charging prices not spending the time to perform audit services, when performing a readiness assessment. We are focused on operational assessment and management outcomes to move the needle forward.
  • Experienced Level of Effort (LoE) for Best ROI
    Why perform an entire NIST 800-53 if you’ve never done a framework ‘anything’ before? Why go with NIST at all? Do you know why or why not? What are you compliant for or possibly responsible for and don’t realize? 4D5A Security takes the guess work out of this, recommends the best return on investment (ROI), so you can make an informed decision for the best value for your company (not our bottom line but yours).
  • Assessments Lower Costs and Improve Operations
    Studies show that framework driven organizations are more cost effective with lower risk, over time, as they mature. 4D5A Security has globally recognized staff on board with experience at all levels of F100, all sectors, and organizational size of a few people to thousands of employees in dozens of countries, to advise and guide you according to your specific needs and readiness.