LiveFire can help organizations in assessing their security posture

Aug 29, 2013 21:01 GMT  ·  By

Vulnerability and exploit research company Exodus Intelligence and Icelandic information security think-tank Syndis have joined forces for a new zero-day service offering called LiveFire.

LiveFire brings together Exodus’ Exploit Pack (EXP) service and Syndis’ goal-oriented attack methodology to provide an attack technology service that realistically replicates the techniques and capabilities employed by sophisticated cybercriminals.

“The penetration testing space today has become a race to the bottom where the industry players compete with each other on price and not quality or depth. The sophistication level of the practitioners in the space varies widely and most offerings are more about compliance than security,” said Syndis CEO Rich Smith.

“These brittle assessments offer very limited, compartmentalized value and they are woefully inadequate when it comes to conveying the impact an organization would suffer were they to be targeted by a real-world sophisticated attack team.”

The new service is designed to help organizations test their resilience and security posture when faced with zero-day and N-day exploits.

“There are a lot of excellent pen-testers out there, but the number of pen-test companies that can also do advanced vulnerability research and code a weaponized exploit in the volumes we do is zero,” noted Exodus CTO Aaron Portnoy.

“LiveFire allows us to provide the operators at Syndis with the resources they need in a timely manner and in a fashion that does not add time overheads or excessive cost to engagements.”

After a LiveFire assessment of their organization, security leaders can understand the impact of a zero-day attack against their systems, and they can determine the effectiveness of existing zero-day exploit protection solutions.

LiveFire also gives C-level security leaders the ability to assess what cybercriminals would need to do in order to breach their defenses, and the ability to test security architectures and courses of action for the eventuality of an incident.