Many firms think they’re ready for anything, but the fact is that until faced with an actual attack it is hard to know for sure. This is why today in the world of cybersecurity “Red Team Exercises” are becoming more commonplace as a way to determine that systems are truly hardened. In such cases, a third party takes the role of a would-be adversary in an all-out attempt to gain access to a system by any means necessary.
Such attacks involved cyber penetration testing, physical breach, testing phone lines for modem access, testing wireless and RF systems for access and even testing employees through social engineering.
Arlington, VA-based Kfivefour has stepped up to be such an adversary. The private sector-focused cybersecurity affiliate of Millennium Corporation provides a full range of products, services and solutions to the Department of Defense (DoD) and other federal agencies. The company has utilized Millennium’s specialized technical experience to execute hundreds of cybersecurity assessments for two of the nine National Security Agency (NSA) certified and U.S. Cyber Command (USCYBERCOM) accredited Full Spectrum Red Teams.
This month the company, which was founded in 2016, announced the availability of its Red Team assessments, training and testing services.
“Having professionals who have developed their unique skills emulating the most sophisticated nation-state cyber adversaries has allowed Kfivefour to deliver an unprecedented level of cybersecurity solutions and training services to our clients,” said Keith Peer, chief commercial officer.
“Kfivefour assimilates the most current knowledge on the latest advanced cyber threats and maintains a deep understanding of adversarial tactics and techniques,” added Peer. “Leveraging the extensive experience in the DoD space, Kfivefour brings an unparalleled level of ability to assess an organizations’ security posture and help defend against cyber-attacks.”
Red Team Assessment and Training
Kfivefour offers Red Team Assessment that concentrates on delivering a real-world experience to internal security teams and this includes combating a controlled cyber-attack to the organization. The Red Team Assessment can be used to examine all aspects of organizational cybersecurity – ranging from technologies to human factors.
This helps clients see the need to challenge preconceived notions, and helps clarify problems that planners may attempt to mitigate. That can provide a more accurate understanding of how sensitive information is externalized and help detect exploitable patterns.
“Red Teams are a critical component to ensure that people, processes, and technologies cannot be exploited to gain access to an organization’s buildings, networks, data, accounts, or workstations,” Peer told ClearanceJobs.
“The goal of the Red Team is to penetrate the target but not to expose every vulnerability,” he added. “The Red Team will emulate an adversary and try to get in and access sensitive information in any way possible, as covertly as possible.”
This is important because Blue Teams, the defenders, can all too easily become complacent over time and make assumptions on how well they are protecting assets.
“The Red Team tests these assumptions and exposes weaknesses before actual threat actors gain a foothold,” explained Peer. “The goal of a Red Team is to help identify the deficiency and to report the finds to leadership who then can work with the Blue Team to remediate any security gap and ultimately improve an organization’s cybersecurity readiness.”
Penetration Testing
The other service that Kfivefour provides is penetration testing, where it applies a systematic and comprehensive approach to assess an organization’s security posture to uncover the vulnerabilities. These assessments utilize a unique “offensive infused” four-step process that includes target reconnaissance, vulnerability enumeration, vulnerability exploitation, and mission accomplishment to deliver a more comprehensive and meaningful evaluation.
Kfivefour currently offers three courses: the Red Team Apprentice Course, Red Team Journeyman Course, and its Red Team Master Course. Each course completes with a practical exam where the required skills for graduation are demonstrated.
“We have taken this knowledge and developed a training curriculum to address the Red Team skills gap by teaching and evaluating students in a realistic proprietary environment where they can learn new skills, gain new experiences and test their abilities,” Peer told ClearanceJobs. “Many Blue Teams also take our courses to learn the tools, tactics, techniques, and protocols used by modern cyber adversaries.”
