Internal Network Penetration Test
Tier3’s Internal Network Penetration Test will share the same methodology and approach with the External Network Penetration Test. The service is designed to critically assess the Internal Network surface against security best practice.
The Internal Network Penetration Test will typically test from the perspective of both an authenticated and non authenticated user to ensure that the network is critically assessed for both the potential exploit of a rogue internal user, and an unauthorised attack. An internal, or internal infrastructure, penetration test assesses what an insider attack could accomplish. An insider refers to anyone that has access to organisational applications, systems and data. This can include employees, contractors or partners.
The target is typically the same as external penetration testing, but the major differentiator is the attacker either has some sort of authorised access or is starting from a point within the internal network.
Internal network test generally:
- Tests from the perspective of both an authenticated and non-authenticated user to assess potential exploits;
- Assesses the vulnerabilities that exist for systems that are accessible to authorised login IDs and that reside within the network; and
- Checks for misconfigurations that would allow employees to access information and inadvertently leak it online.
Insider threats are among the most difficult for enterprises to detect and stop. One of the main reasons for this is the sheer scope for attacks. It include everything from staff accidentally losing or damaging data, to malicious actors stealing information or compromising systems.
Internal users often bypass physical controls designed to protect computer resources. For most organisations, this means the internal network is where they are most vulnerable.
Once identified, the vulnerabilities are presented in a format that allows an organisation to assess their relative business risk and the cost of remediation. These can then be resolved in line with the network owner’s budget and risk appetite, inducing a proportionate response to cyber risks.
Tier3 uses a blend of methodologies taken from industry best practice standards such as the Open Source Security Testing Methodology Manual (OSSTMM), the Open Web Application Security Project (OWASP) and the Council of Registered Ethical Security Testers (CREST).
Tier3 provides consultation and resources to build a Zero Trust Network.
Zero Trust is an information security framework which states that organizations should not trust any entity inside or outside of their perimeter at any time. It provides the visibility and IT controls needed to secure, manage and monitor every device, user, app and network being used to access business data.
The service provides the client with a report that is comprehensive, clear and concise. The report is designed to provide information for a diverse audience of readers. The report delivers;
Executive Summary – The opening section of the report provides, in plain English a executive summary overview of the entire assessment including recommendations to improve the security posture of the in scope environment.
Graphical Summary – Key findings are ranked, split into three impact categories and positioned in a graphical table according to the relative risk or likelihood of exploit.
Security Evaluation by Category – The evaluation ratings compare information gathered during the course of the engagement to “best in class” criteria for security standards. An evaluation of “Excellent”, “Satisfactory”, “Fair” or “Improvement Required” is provided. Each category includes a best practice statement, evaluation result and recommendation to achieve best practice.
Vulnerability Analysis – The vulnerability analysis section provides a detailed description of each discovered flaw including any necessary technical information and corrective recommendations.
Exploitation Vulnerability – Each listed vulnerability is assigned a “Probability” rating based upon how likely the vulnerability is to be exploited.
• Test delivered under industry best practice methodologies by qualified consultants • Determines the security level of your externally facing infrastructure • Provides clear instruction on how to further secure your externally facing infrastructure
Find out about complete range of Penetration Testing Services in Pakistan as provided by Tier3.
