PenTest Mag: Can you speak to your experiences starting/developing a small company in a market as competitive as IT security?
Pwnie Express:
Pwnie Express CEO Paul Paget joined founder (and current CTO) Dave Porcello because they shared a vision for how remote penetration testing tools could be used in a much more substantial way. Dave created the first Pwn Plug, which has since become the industry standard for remote penetration testing around the world. The success of the Pwn Plug led to the bigger idea of distributed pentesting, which caused Dave to seek venture funding and a CEO to help build the business. With more than 30 years experience bringing information security products to market, Paget had built the first company to establish penetration testing as a product, and had experience with highly secure hosted security systems. For the past 15 years, he has specialized in leading early stage companies and bringing new, innovative security products to market.
In all cases, Paul sees the primary challenge – and opportunity – as this: find a way to connect the technology to the right people who will help you with the initial phases of the product’s lifecycle. Together you shape the product into something that can be successful in the marketplace. You HAVE to be able to connect your idea to the market and find a seam where you can enter. In Pwnie Express’ case, the team leveraged the original Pwn Plug to create automated pentesting on a distributed basis. As the market shifted toward BYOD, the marketplace presented a larger problem for Pwnie to solve: the lack of visibility into devices within an organization.
PenTest Mag: Your products make heavy use of open source projects, would it be safe to say that you wouldn’t have been able to bring them to market if you had to develop all of this software in house, or pay licensing fees to include them?
Pwnie Express:
No, we would not have been able to bring this rich of an offering to market without the use of open source technology. By leveraging the open source technology in the Pwn Pulse system we were able to make a collection of powerful products scalable, and at a price point that makes the solution readily available for customers. Ultimately, we have contributed to the further development of open source tools and shared them back with the community.
PenTest Mag: Could you tell us more about the Pwnie Express training, the skills and tools?
Pwnie Express:
Pwnie Express offers live training for users of the mobile line of products, i.e. Pwn Pad and Pwn Phone and for users of the fixed sensor line of products, i.e. Pwn Plug R3 and Pwn Pro. The training session for the mobile and fixed line of products provides new or infrequent users of the Pwn Pad and Pwn Phone, or Pwn Plug R3 and Pwn Pro respectively, with an introduction to the hardware, the Kali based Operating System, and product usage, configuration, updating, installation of additional software, remote access, and advanced functionality (such as NAC Bypass with the Pwn Plug R3). The training session for the "fixed" line of products provides new or infrequent users with an introduction to the hardware, the Pwnix operating system, and product usage. Including the subjects of the Pwnie UI, configuration, deployment, updating the device, installation of additional software, enabling remote access, enabling Stealth Mode and NAC Bypass (R3 only), hints & tips, troubleshooting, etc.
Both training classes are interactive, delivered online via WebEx and attendees are encouraged to ask questions of the instructor. Training sessions usually last three hours. Afterwards attendees are provided with a recording of the session for later reference.
PenTest Mag: In terms of the OSI (Open Source Interconnection) 7 layer model, at which layers do your products and solutions operate at?
Pwnie Express:
Out of the box, Pwn Pulse primarily operates at Layers 2 and 3 due to our focus on device discovery. If the advanced features -- such as a custom script to leverage Nmap’s Heartbleed checker-- are utilized, Pwn Pulse is able to operate at layers 2 through 7.
PenTest Mag: For branch offices are distributed servers an option? Or does each sensor communicate back to the Central Pwn Pulse system?
Pwnie Express:
Each sensor is essentially a server that communicates back to the central Pwn Pulse system. The beauty of the system is that it can be shipped to remote locations, plugged in by any employee, and it will start collecting date without any special configuration.
PenTest Mag: Is the communication between remote sensors and the central Pwn Pulse system encrypted? What protocols are used?
Pwnie Express:
The communication between the sensors and Pwn Pulse is encrypted. Specifically, we utilize an encrypted TLS tunnel to transmit Sensor data back to Pwn Pulse.
PenTest Mag: How is the Pwnie Express experience and intelligence translated down into the customer organization for those who do not specialize in Information Security; Risk Assessment and Security Planning?
Pwnie Express:
Our solution does not require IT to put agents on employee-owned devices, the threat detection and added visibility preserves privacy and ownership so that IT does not have to interfere with the employee’s personal devices. At the same time the Pwn Pulse provides the enterprise with the ability to identify devices that do not belong in the workplace. The ability to track and know which devices are employee-owned enables them to say “these devices belong.” Pwn Pulse also provides a “safety net” for IT where they can track and monitor all employee-owned devices on an ongoing basis. For example, an employee could bring in a device that helps them do their job more effectively, i.e a printer that connects to wifi. Employees may not realize that this printer in its default state provides a gateway into the network for an attacker. The Pwn Pulse would alert IT that the device has been added to the network and is a potential threat.
PenTest Mag: How is the pricing model structured?
Pwnie Express:
Pwnie Express offers a subscription service based on the number of sensors required. Pricing starts at ~$180 per month per sensor and includes access to the Pwn Pulse system.
Al la carte device prices are available at www.pwnieexpress,com or by contacting sales via phone at (855) 793-1337 or email sales@pwnieexpress.com.
PenTest Mag: Is there support for the hardware appliances, in terms of warranty; RMA; Support Care; etc?
Pwnie Express:
Pwnie Express provides free technical support via email/telephone/web for the first thirty days. After which users are encouraged to obtain Pwnie Care, which continues the availability of receiving support via email/telephone/web for a period of one year. All users of Pwnie Express products regardless of having a subscription to Pwnie Care are able to access on an online support forum and knowledgebase.
Pwnie Express provides a limited warranty for all commercial products, providing coverage against manufacturer defects, etc. For products not tied to Pwn Pulse, each device comes with a 30 warranty. You also have the option to add on Pwnie Care, which covers everything from hardware replacement to live support. With Pwn Pulse, hardware replacement, support, and training are included automatically.