Automated static and black box vulnerability scanners have come a long way over the years. But as the technologies developers use continues to change, these tools are forever playing catchup. Without the ability to reason about how your application behaves, such as what the primary use cases are and what information you most need to protect, automated tools will always be limited in many respects. Manual security testing is a hallmark of any mature secure development life-cycle. Blindspot's testing process always includes, at a minimum, an informal threat modeling phase where an understanding of your application is developed and key risks are enumerated. In addition to testing for well known classes of flaws (such as the OWASP Top Ten) and items typically picked up by automated scanners, Blindspot's analysts often spend a significant amount of effort searching for flaws that are most relevant to the application, including in-depth authorization testing and issues related to business logic.

You are a software vendor. Between never-ending feature requests and bug reports, the last thing you need is a customer calling you to ask about a "tweet" they read regarding a newly published vulnerability in your software. Or perhaps your IT department is deploying a new mission-critical application throughout the organization. How do you know the product vendor performed their due diligence to ensure their software is safe and secure? Product developers are under just as much pressure as any other tech-oriented organization to deliver new functionality and performance at minimal cost. It is rare for product companies, small or large, to invest resources on internal security experts to ensure their products do not have flaws that could impact confidentiality and integrity of deployment environments. Conducting direct penetration assessments of product deployments can be a cost effective way to help ensure that the product is deployed in a safe configuration for a particular customer, in addition to verifying a product's overall quality with respect to security.

The line between "internal" and "external" networks is blurring more everyday. Your desktops and mobile devices are now part of the security perimeter, as these are the primary ways in which modern attackers gain a foothold inside your IT infrastructure. It is critical to take a holistic view of network and system security by trying to ensure every system is patched and configured safely, regardless of where it resides in you infrastructure. Network vulnerability assessments and penetration tests are the most classic form of technical security audit. Network-oriented assessments are designed to validate that patch management and device hardening processes are in place. While many organizations perform their own internal scanning using off-the-shelf tools, it is often worthwhile to leverage external resources to validate that internal scanning approaches are effective and to illustrate how an attacker might leverage certain common issues in realistic attacks.

Breach simulations attempt to emulate the behavior of at typical digital intruder within an organization's network. Unlike traditional penetration tests, which attempt to identify every possible avenue of attack and validate those, breach simulations focus on the most likely avenues of attack. Consultants work to exploit the flaws that require the least effort and subsequently identify more flaws based on that elevated access. The goal of each simulation is typically to obtain access to high-value business targets as quickly as possible. Breach simulations are excellent for helping an organization understand what an attacker is likely to do upon gaining a foothold in the environment and are effective for organizations who wish to:

• Better understand the risk of an initial, low-level digital intrusion
• Illustrate to business stakeholders how attackers can quickly move "laterally" through an internal network
• Identify and mitigate the "low-hanging fruit" from an attacker's perspective
• Identify gaps in system and network logging
• Test the efficacy of intrusion detection/prevention and honeypots
• Drill incident response procedures

With extensive experience with incident response and digital forensics, Blindspot is well-positioned to provide realistic simulations that challenge preconceived notions about how breaches play out.

Cryptography is hard. Most software developers realize this. Security dogma of "don't invent your own crypto; use standard algorithms" has been a "best practice" for some time. But what does this mean? Use AES? As cryptographers know, and history has shown, this alone is insufficient. Using otherwise safe cryptographic primitives in custom protocols and message formats requires an understanding of cryptography that most programmers lack. As a result, many implementations are sorely insecure due to the way cryptographic primitives are combined and applied in real world contexts.

Blindspot's analysts have long held an interest in cryptography and have experience delivering training courses on secure implementation, developing black box exploit tools which test for cryptography, and also in designing systems that leverage cryptography to make development tasks easier.

IPv6 is here, whether we like it or not. Every major operating system supports the alternative Internet protocol, and while it is slow to be implemented by network operators, the technical aspects of IPv6 often introduce significant security impacts. For instance, IPv6 comes with dizzying array of transition technologies (Teredo, 6to4, and NAT64, to name a few) and often administrators are unaware of how these features could expose their systems to external attack. Whether your goal is to simply limit unintended IPv6 exposures or to deploy a next generation network securely, Blindspot can help you navigate the complex landscape introduced by this monumental Internet migration.

Few people enjoy planning for the worst. But the discovery that an adversary has penetrated your perimeter defenses almost always makes you wish you had done it better. Most organizations have a strong understanding of their own infrastructure: the data and systems that are critical for their success. However, it is rare for IT staff to understand just exactly what attacks could be performed internally to target those systems after an initial breach, or maintain a long-term, covert presence. In order to best defend against intruders, it makes sense to develop controls and response plans that are oriented around what the primary risks of intrusion and what an attacker is most likely to do once inside.

Blindspot's extensive experience in penetration testing, incident response, and forensics research place us in a unique position to see the bigger picture in these situations. Whether it be helping improve incident response plans or helping improve key technical controls, Blindspot's practical approach can greatly enhance an organizations resiliency to attack without disrupting normal business operations.