Infrastructure Penetration Testing

Know your unknowns to assess, quantify the vulnerabilities and prepare a risk mitigation approach meant to reduce attack surface.

Get In Touch

We will not share your details with third parties.

Shall we keep you informed on the threat reports & useful guidance? No salesy newsletters. View our privacy policy.

What is Infrastructure Penetration Testing?

A simulated attack exercise aimed at finding weaknesses in a company’s infrastructure. This exercise is aimed at internal (corporate, production environments) and/or external (internet facing) networks.
Cyphere offer consultant-led Infrastructure Penetration Testing to identify software and network security vulnerabilities and explain in relation to the underlying asset’s risk profile. Generally, two types of infrastructure penetration testing is carried out, divided into external and internal assessments. With cloud computing, any assets within the private cloud accessible to staff are considered as an internal network. Should you wish to read further about pen testing , our in-depth blog article on penetration testing is an excellent source. 
Penetration Testing

Benefits of Infrastructure Penetration Testing

A free 15 mins consultation with security experts

Common Security Vulnerabilities

Secure hardening vulnerabilities across networking, security, telecommunications & other internal equipment, OS and endpoint vulnerabilities.
Effective patch management plays critical role in closing window of opportunity for attackers, thats between the vulnerability disclosure and patch release.
Domain controllers design and configuration issues, group policy security review including audit policy, account lockout policy, user rights and security settings.

Logging and monitoring controls are reviewed to identify flaws in event collection, analysis and threat identification.

Network segregation checks with attempts to subvert restrictions in place.
We check against the configuration and use of encryption methods used for data at rest and transit.This includes checks against internal root certificate authority configuration and trust established with systems and devices under the domain.
Authentication vulnerabilities are one of the most critical and important attack vectors. This area includes multiple test cases i.e. transmission channels, nature of input, insecure configurations, weak credentials & bypass attempts.
Our internal network penetration test methodology involves password cracking and statistical analysis to show how passwords affect the general health of security of the domain.
Searches are performed on local and network shares for interesting files, contents that would contain credentials and/or any sensitive information.
Network equipment such as switch, routers, peripherals such as printers, imaging and scanning devices, are checked against security vulnerabilities and secure hardening weaknesses.

Infrastructure Penetration Testing Services

Our security assessment services cover a broad spectrum of domains such as cloud, wireless, mobile, stealth campaigns, phishing, IoT, external & internal networks and solutions.

Internal Penetration Test

A consultant led exercise performed on the internal (or corporate environments) network. This starts with an unauthenticated attacker test case aimed to identify, exploit and infiltrate across the entire network. This exercise is used to assess internal information security culture covering patch management, password cracking analysis, information storage, configuration, encryption, group policy, and authentication checks.

External Penetration Test

This exercise is aimed at internet facing infrastructure, performed remotely from our labs. This assessment checks against firewall loopholes, VPN endpoints, web servers, email servers and other assets exposed on the internet that when compromised could lead to loss of data. External network penetration testing is performed with zero privileges, that is same level access as internet based user.

IT Health Check

Whether you are a council, NHS trust or a corporate business assessing cyber security first time, Cyphere offers organisation-wide cyber health checks to help you validate your technical security controls across the perimeter firewall, wireless, build reviews, internal and external environments. 

Firewall Review

Our firewall security assessment service ensures that the firewall implementation is with checks on both configuration and traffic/rulebase.
The device in scope could be any of the perimeter firewalls, cloud based NSGs, small business based all in one firewall, switch and wireless devices.

Active Directory Security Review

Active Directory security is one of the strong pillars against data breaches.
Domain controllers are the heartbeat of your network. Remote compromises could directly impact your business operations, including but not limited to data breach, brand position loss or other reputational and/or legal implications.

Wireless Security Assessment

We simulate various threat scenarios that an attacker may use against your wireless network that could lead to an organisation wide breach.
Assessment test cases include WiFi authentication, encryption, deauth attacks, segregation, access point configuration, signal leakage issues.

Secure Hardening Reviews

A default or out of box server can be a big mistake on the network. A secure hardening review ensures no weaknesses are introduced in the security posture of your company keeping exposed services with minimal attack surface.
Default passwords, OS configuration, services, anti-malware controls are assessed in this review.

Device Security Reviews

Whether it is your device operator, manufacturer or service provider, secure device configuration is an important element in ensuring the security of components responsible for data transport. 
Data loss or network intrusions are directly linked to insecure devices within a corporate network.

Network Segregation Reviews

Network segregation process ensures restrictions are in place to avoid unnecessary exposure of systems within particular networks.
Test cases involving segregation checks at user, network, environment level ensure defence in depth approach is followed at all times.

Import data, not malware

Frequently Asked Questions about Infrastructure Penetration Testing

An external network pen test is aimed at internet exposed devices and/or systems only simulating a threat actor on the internet (unauthenticated). Threat actors vary in attack vectors aimed at people, processes and technology, therefore, internal network security is assessed differently with both unauthenticated and authenticated approaches.
At network level, internal and external network penetration tests are the main attack surfaces. At device and systems level, various security reviews can be conducted to assess the risk exposure.
A thorough internal network penetration test measures the information security culture at ground level. This includes nature, type and strength of passwords in use, security settings of domain, encryption, authentication, authorisation, patch management and network devices hardening.
Based on network architecture, onsite or offsite suggestion is made accordingly. For instance, where multiple physical sites and network segregations are a challenge remotely, onsite assessment is preferred. With post covid19 measures, we utilise a number of methods (SSL VPN, VM deployment or shipping hardware to client site) to carry out remote penetration testing of internal networks.
Communication plays an important role during security assessments. We always prompt customers to inform us about fragile components during project initiation meetings. With customer business operations as the highest priority, our consultants follow mix of consulting and technical approach to avoid every chance of risk of disruption (such as blind scanning, automated approaches, other low level Layer 2 activities). Low level attacks, Denial of Service attacks are explicitly deemed out of scope for all assessments.
Network Pen test remediation is sometimes a complex process due to the specialist security skill-set needed for IT teams. As part of our aftercare support, we provide help in preparing remediation plan to all our customers. Optionally, we provide remediation consultancy to ensure all agreed findings are mitigated in line with best network security practices.

A secure infrastructure provides safe, secure environment

Infrastructure Penetration Testing Methodology

In order to perform an infrastructure security assessment, it is important to understand the context of assets in scope for the engagement. Our proven approach to network security assessments is based on more than a decade of experience, industry practices and effective ways to exceed customer expectations. 

Cyphere’s pentesting engagement lifecycle methodology is broken down into five phases as demonstrated in the penetration testing methodology diagram. 

  1. Initial Scoping & Objectives Agreement
  2. Reconnaissance
  3. Scanning
  4. Exploitation
  5. Reporting 
  6. Remediation (Optional remediation consultancy to help mitigate risks identified during penetration testing)
Penetration Testing Lifecycle

Infrastructure Pen Test Approach

Customer Business Insight

The very first step remains our quest to gain insight into drivers, business, pain points and relevant nuances. As part of this process, we understand the assets that are part of the scope.

Services Proposal

It is important to gain grips with the reality, therefore, we always stress on walkthroughs or technical documentation of the assets. After asset walkthroughs, a tailored proposal is designed to meet your business’ specific requirements.

Execution and Delivery

Cyphere’s approach to all work involves excellent communication before and during the execution phase. Customer communication medium and frequency are mutually agreed, and relevant parties are kept updated throughout the engagement duration.

Data Analysis & Reporting

Execution phase is followed by data analysis and reporting phase. Cyphere performs analysis on the testing output, evaluates the risk impact and likelihood of exploitation in realistic scenarios before providing action plans to remediate the identified risks. All our reports address business as well as the technical audience with supporting raw data, including mitigation measures at strategic and tactical levels

Debrief & Support

As part of our engagement process, customers schedule a free of charge debrief with management and technical teams. This session involves remediation plan, assessment QA to ensure that customer contacts are up to date in the language they understand.

Recent Blog Entries

Cyber Security Glossary | Security Terms in Simple English

Cyphere, a penetration testing and managed security services provider, offers a detailed article on what is penetration testing and when, why, how it should be done. A good cyber security assessment is a business enabler for growth.

Securing Remote Workers – Advice for Individuals and Businesses

Secure remote worker advice for individuals and businesses to stand against today’s cyber security attacks. Cyphere shares tips straight from our experience consulting small businesses to big retailers and financial institutions.

Malware and Ransomware Attacks : Should You Pay The Ransom? What To Do If Your Business Is Hacked?

Learn about Malware and Ransomware Attacks, their differences. Should you pay ransom to cyber criminals? How to prevent malware incidents and what to do if your business is hacked?

Insider Threats : Types, Examples, Impact, Detection & Mitigation

Cyphere , a cyber security services provider specialising in technical risk offers insights into insider threats. This article covers types of attacks, examples, attack indicators, detection and mitigations.

Cyphere Awarded G-Cloud 12 Framework Agreement

Cyphere , a cyber security service provider, have been awarded G-Cloud 12 framework. Cyphere , as a supplier on G-Cloud 12, aim to help public sector organisations prevent cyber attacks on their most prized assets.

Small Business Cybersecurity Tips

Cyphere , a penetration testing and managed security provider, provides top ten cybersecurity tips for small businesses to protect against the most common cyber attacks. Learn how these tips help you towards an efficient cybersecurity strategy sure to enable business growth.

What is Penetration Testing?

Cyphere, a penetration testing and managed security services provider, offers a detailed article on what is penetration testing and when, why, how it should be done. A good cyber security assessment is a business enabler for growth.

CONTACT US