Internal and external penetration testing exercises are discussed separately due to the threat profiles associated with Internet-facing (external) and inside environments (internal).

An internal network security test, the same as an internal penetration test, is aimed at the internal network from an insider attacker perspective, i.e. an employee, contractor or partner.

External pen testing is aimed at internet-exposed devices, external IPs and/or systems only simulating a threat actor on the internet (unauthenticated). External penetration test measures your internet-facing assets attack surface (external tests) and will never tell you the real story of your internal security culture.

Internal pen tests and external penetration tests should be performed once annually to check network equipment, perimeter security controls and other database controls. Other asset categories include cloud penetration testing, wireless penetration testing and application and APIs.

Internal penetration tests can be scoped based on the requirements and threats related to the target system or network. For instance, if an organisation has never opted for network-wide assessment and is aiming to improve security, it makes business sense to assess the gaps for the entire estate and perform risk remediation to set internal benchmarks. If an organisation holds maturity in its security processes, targeted assignments are scoped such as network segmentation, specific internal security testing projects. See different types of penetration testing article for more details.

A thorough internal pen testing measures the information security culture at ground level. This includes password security (cracking & analysis), patching audit, group policy security, active directory design and architecture risks, insecure device and web application interfaces, encryption configuration, authentication, authorisation, secure information storage practices and network device hardening. Some prospects confuse this with vulnerability assessment, which is not because internal pen test includes exploitation of weaknesses. See this blog on the difference between the two. Don’t mistake this with red teaming, read a detailed article on this topic here.

Internal pen test in an internal environment involves considering threat scenarios based on the architecture and external threats. For instance, a company’s internal layout could be segmented with corporate, staging, production environments. For a medium-size company, it may be all in one and their production environment may be just a website hosted at a third-party site. Therefore, carrying out black-box penetration tests is justified in this scenario to assess the extent of an attack and it would mimic a complete outsider in your environment.

For the insider attack simulation test, we will ask standard staff privileges and start our internal network assessment from there to figure out various ways with the objective of compromising underlying workstations/laptops and then infiltrating servers and domain controllers.

Where multiple physical sites and network segregations are a challenge remotely, onsite assessment is preferred. With post covid19 measures, we utilise a number of methods (SSL VPN, VM deployment or shipping hardware to client site) to carry out remote penetration testing of internal networks.

Communication plays an important role during security assessments. We explicitly request a list of fragile components during proposal and project initiation meetings. Low-level attacks such as man-in-the-middle attacks, Denial of Service attacks are explicitly deemed out of scope for all assessments. This ensures the client that the pen testing methodology includes careful assessment in line with business assets and not a blind scanning approach.

Cyphere’s internal pen testing reports are world class deliverables containing raw data to support proof of concept and risk remediation measures.

Risk remediation is sometimes a complex process due to the specialist security skill-set needed for IT teams. As part of our aftercare support, we provide help in preparing remediation plans for all our customers.

Optionally, we provide remediation consultancy services with an internal penetration test to ensure all agreed findings are mitigated in line with best network security practices.