PULSE By Prism Infosec: Bridging Pen Testing & Red Teaming

Prism Infosec, the independent cybersecurity consultancy, has announced the launch of its innovative PULSE testing service to enable organizations that may not have the bandwidth or resources to dedicate to a full-scale red team exercise to assess their defense capabilities against real-world threats.

PULSE addresses the gap that currently exists between penetration testing and red teaming which can prevent organizations from gaining an accurate understanding of their security posture and provides an agile alternative that utilizes an intensive testing approach.

Threat actor simulation

Penetration Tests contain evaluations that assess security boundaries and controls of distinct systems that excel at the analysis of specific vulnerabilities contained in specific control planes of individual systems.

In contrast, red teaming is a real-world test of the organization’s defenses against threat actor activities and capabilities which sees the tester adopt a more opportunistic approach that more closely mirrors the attacks the business could expect to be subjected to. PULSE has been devised to bridge the gap between the two different approaches using threat actor simulation.

MITRE ATT&CK framework

PULSE evaluates the security of an organization’s perimeter, endpoint security, and environment

PULSE evaluates the security of an organization’s perimeter, endpoint security, and environment, from the point of view of a time-limited opportunistic threat actor.

Conducted over five days using techniques aligned with the MITRE ATT&CK framework, tests are carried out that are flexible, repeatable, and measurable. Suitable for organizations that have invested in security tooling but lack a full-time dedicated Security Operations Centre (SOC) and staff, the timeframe and methods used ensure PULSE tests are not disruptive while still subjecting systems to rigorous assault.

Red Teaming

“Red Teaming is a fantastic tool for exercising security tooling, staff, policies, and procedures in a realistic, secure, and safe manner,” explains David Viola, Head of Red Team at Prism Infosec. 

"It does this by taking the Tactics, Techniques, and Procedures (TTPs) of genuine cyber threat actors and applying them in intelligence-led scenarios that can span multiple weeks. However, not every organization is ready for the cost, time, and effort that a full red team engagement requires to deliver value for the business."

Real-world test

“It’s here where PULSE comes in, allowing the organization to real-world test its systems but without the commitment or disruption associated with red teaming."

"The PULSE tests emulate the approach an opportunistic cyber threat actor would take when seeking to breach the perimeter, establish a foothold, and compromise the environment all within the space of a working week.”

PULSE methodology

The PULSE methodology is designed to rapidly test multiple different payloads and delivery mechanisms similar in approach to purple teaming which combines offensive and defensive tactics and involves the following steps:

• Scoping – Red Team consultants capture the information needed for a successful engagement.
• PULSE Test Plan – A tailored test plan is devised based on the PULSE methodology and the findings from the scoping questionnaire.
• PULSE Preparation – The client provides the prerequisites while the consultant prepares payloads, infrastructure, and tooling.
• PULSE Perimeter Assessment – Testing begins with an assessment of the perimeter using different payload delivery techniques.
• PULSE Attack Surface Assessment – Successful payloads are tested against installed security solutions to establish which triggers an alert, which ones are blocked, and which penetrate the business.
• PULSE Environment Assessment – Using a successful payload, an assessment is made of how far a threat actor would be able to penetrate the environment.
• PULSE Report – The outcomes of all three phases are then documented, along with recommendations to harden the environment and suggestions and advice for follow-up testing to improve security posture.

Customized approach and testing

PULSE can also be customized to enable testing specific to the customer environment

PULSE can also be customized to enable testing specific to the customer environment, such as through the addition of physical testing using social engineering and physical breach techniques.

Phil Robinson, CEO at Prism Infosec, adds, “Our commitment to advancing our technical capabilities has led us to create a service that effectively bridges the gap between Penetration Testing and Red Teaming. With PULSE, we’re making this high level of technical expertise accessible to organizations of all sizes."

First agile Red Team service

"I’m thrilled to introduce PULSE to our clients and look forward to seeing the impact it will have on their security posture.”

PULSE is the first agile red team service Prism Infosec is announcing as part of a strategic reinvigoration of its red team service offerings. Plans include a redefined Purple Teaming service and an integrated IR and Red Team service.