Make sure your network is secured against insider threats
Internal Penetration Testing will help identify flaws in your internal processes and data management.
Internal security breaches are often unexpected, yet they can prove extremely damaging and costly to businesses. An internal penetration test can offer a unique insight into your internal networks, and peace of mind that they are secure against insider threats.
organisations report insider attacks are more frequent
assessments found sensitive corporate data transfers
of cyber security breaches are caused by human error
Is an Internal Penetration test right for my business?
With a comprehensive internal penetration test, you’ll gain a unique insight into your internal networks, helping you pinpoint vulnerabilities, shore up security, and guard against threats from within the organisation itself.
An internal penetration test will:
- Detect vulnerabilities within your internal systems
- Test software and systems for vulnerabilities
- Demonstrate your commitment to security to stakeholders
- Meet compliance standards such as PCI DSS and ISO 27001
- Identify potential threats to the business and safeguard against them
A penetration of a network costs a business over £2M.
Can your business sustain such a significant spend?
Your clients stolen data may be sold on the dark web
Is your brand strong enough to withstand such a blow?
69% of customers said they would never return
Customers are less likely to buy from a breached organisation.
Perform information gathering/reconnaissance piece to identify what infrastructure can be found. In the reconnaissance phase of a penetration test, the tester will attempt to find out information regarding a target in a completely passive manner.
Perform fingerprinting to determine infrastructure device types, services (open ports or potential access points). This will include the use of active scanning techniques.
Commence Target Enumeration, the tester will determine or enumerate the threats facing an asset. For example, if the tester has performed reconnaissance for an engagement and identified a selection of servers as target assets, the tester will attempt to identify a list of services running on the hosts/s. This could be done via passive monitoring of the network in internal environments, or could be achieved with active scanning techniques such as port scanning.
Use a comprehensive list of the services/capabilities available to an attacker from any given asset, to determine if any of these vulnerabilities could compromise the data assets or services. Common techniques for this activity include manually probing applications, networks or devices in terms or identifying exact versions of software or hardware in use on the asset.
The goal of this test phase is to quickly identify which services would allow DigitalXRAID and therefore an attacker, to compromise the host in the most damaging way possible. It is important to distinguish though, that at this stage, all vulnerabilities identified are ‘potential’, and not guaranteed to exist until proven with suitable exploitation. However, on finding a critical vulnerability the customer should be informed and the test paused as detailed in the Alert Customer Process.
During this phase, we shall validate vulnerabilities mapped earlier and provide evidence they could be used to compromise the assets in question.
Complete all exploits in a controlled manner, avoiding disruption to service or assets. For this reason, attacks such as Denial of Service attacks are avoided or shall be tested very cautiously in dedicated time frames agreed with the customer. Exploits which may be unreliable or known to work in such a way that damage or cause disruption, are shall be completed in a simulated test environment rather than against the real asset; this is particularly true for sensitive production environments.
Upon identifying the vulnerabilities and successful exploitation as above, then see if it could take the attack further by escalating access privileges. This will prove if the asset can be exploited further or used to compromise further assets. For example, if the test is being performed against a web application, the application may segment certain functionality and permit access to it only for users with certain permissions. In an event where the attacker can obtain illegitimate, yet non-privileged, access to an account within the application using a vulnerability/exploit, they would likely attempt to discover a method of escalation onto a privileged access account, using another vulnerability/exploit. Another example of this is if the tested asset is a laptop running a Windows Operating System, and the tester can compromise an account on it and gain access, then the tester/attacker will both likely be looking for methods of compromising an account within the OS with SYSTEM-level privileges, which would allow them to perform any action within the OS, including removing security features.
Maintain Access and Lateral Movement
Assuming some level of compromise has already been achieved it might be prudent to ensure that for the duration of the test we are able to maintain the level of access, so as not to have to start the exploitation process from scratch. The tester may step in a maintaining access phase, whereby they use the level of compromise already gained to ensure that they are able to keep that level of compromise in the future, even if the vulnerability they originally used to get it, no longer exists. There are many ways to achieve this and it depends heavily on the type of test being performed. The maintain access activities could include ‘back-door’ to the system by creating additional user with administrative privileges or install a malicious piece of software which would give them access again. From there the tester can continue to compromise the asset further or use it to pivot their attacks deeper into the infrastructure. All this is evidenced within the report and clean up after the test is completed.
Perform a clean-up of any user accounts, text files or small benign changes removed before the testing is completed. During any test that actively exploits misconfigurations and vulnerabilities, it is often the case that small and benign changes are made to a Customer system such as creating a text file on a vulnerable SSH server or adding a new user to a Linux host etc. DigitalXRAID shall ensure that they are all removed before the test is completed. Where it is not possible to fully restore the system/application to the state it was in prior to commencing the test (such as changes to a database), any residual traces of the test will be communicated to the client contact daily and documented in the Penetration Test Report in sufficient detail to enable the Customer to remove them if required.
Maintain Access and Lateral Movement
Protect your business
A security partner you can trust
Make sure you’re truly protected by putting your networks, systems and applications to the test. As with all cyber security, external pen testing forms part of a robust security posture. We’ll work with you to identify and remedy weaknesses in your security before a malicious party exploits them.
“Rather than selling to us, DigitalXRAID educated us and let us make our own mind up, helping us to understand the importance of cyber security and what needs to be done in the future.”
– NELFT NHS Foundation
Cyber Security Experts
Our team comprises professionals selected for their industry expertise and outstanding work ethic, allowing us to provide you with market leading cyber security services.
Long term solutions
We deliver long term solutions to ensure your company is protected. A longstanding partnership with the right cyber security provider is invaluable.
Your business is unique. We will listen and work closely with you to understand your challenges, identify the vulnerabilities that are particular to your business, and put in place tailored countermeasures.
Our expertise, experience and knowledge base puts us in the ideal position to deliver industry leading protection against existing and emerging cyber threats.
No single test or report is ever going to be enough to secure an organisation against the complex cyber threat landscape. As your Managed Security Service Provider (MSSP) we will construct a developed, bespoke and reactive plan to take care of your entire cyber security requirements now and into the future.
- Your trusted partners, we’ll deliver guidance, support and recommendations based on real evidence and genuine assessment of your business needs.
- We’ll continually test your networks, identify exploitable factors, and upgrade your facilities to meet your evolving needs.
- We’ll make sure your cyber protection remains robust, comprehensive and cutting-edge.
Find out more about our managed service:Managed cyber security packages
Protect Your Business & Your Reputation.
With a continued focus on security, you can rest assured that breaches and exploits won't be holding you back.