Question 1

What is external versus internal network penetration?

Accepted Answer

What to test on the External Network? External network penetration testing simulates attacks from the perspective of an Internet attacker. We recommend that an organization includes their entire public IP address space in the scope. Using this information, the penetration tester can perform a discovery scan to identify all active systems connected to the Internet, even ones you may not be aware of. We often see significant risks related to systems that the organization did not know were active on the Internet.

Should I Also Test the Internal Network? If you are only pen testing your external network, you are not getting a complete picture of risk. Many breaches begin with a compromised workstation, a rogue network device, or an infected USB drive. These threat vectors completely bypass your external firewall, so you need to be testing from within your internal network. Internal network penetration testing helps you answer the question, “So what could an attacker do with internal network access?” Networks are often just like M&Ms; once you get past the hard candy shell, they are soft and gooey on the inside. In two recent penetration tests we found an insecure printer on the internal network that gave us domain administrator access to a network. How would you identify this risk if you only test your Internet perimeter? Security is all about layered defense. Yes, we need a hardened perimeter, but once inside it should be difficult for an attacker to escalate privileges and move around the network. A penetration test should be used to help harden the internal network.

Question 2

What is authenticated versus unauthenticated penetration testing?

Accepted Answer

Most penetration tests are conducted from an unauthenticated perspective. The scenario being tested is, “Don’t give me any access, and I’ll see if I can break into your network or application.” What this scenario fails to recognize is that authenticated users often present a significant threat to your organization.

Consider the user who falls for a phishing scam and tells the bad guy their credentials. Consider the user who clicks on a malicious link and malware is able to execute with the privilege of the victim user. Consider a malicious insider who uses their account to attempt to gain unauthorized access to data.

Organizations should evaluate the risk that authenticated users pose to their organization. Organizations should be able to answer the question, “What could happen if a malicious individual is able to gain access to a valid account?”

Penetration testing can be conducted from both an authenticated and an unauthenticated perspective. Typically, unauthenticated testing will be conducted first, followed by authenticated testing. Testing from both perspectives will give your organization a more complete picture of its vulnerability to attack.

Question 3

How often should I conduct a penetration test?

Accepted Answer

A penetration test report represents the state of security at a given point in time. Networks and applications are constantly changing. New vulnerabilities are discovered every day, and the threat landscape changes rapidly. By the time you receive your penetration test report, it could already be out of date. There is no one-size-fits-all answer to how often a penetration test should be conducted, but you should plan for periodic penetration testing.

Organizations should assess their unique environment and their risk tolerance to determine pen testing frequency. An organization with a high rate of change in its network and applications should conduct more frequent penetration tests than an organization with a mostly static network. An organization with strong centralized system configurations can generally conduct penetration tests less frequently than an organization that lacks centralized control. An organization that is a higher-profile target should test its networks more often.

The PCI DSS requires penetration testing annually and upon significant change. Even for organizations that are not bound to the PCI DSS, we often see penetration testing performed at least on an annual basis.

Areas We Serve

Areas We Serve

Bentonville

Dallas

Edmond

Fayetteville

Fort Lauderdale

Kansas City

Long Island

Miami

New York City

Norman

Oklahoma City

Orlando

Tampa

Tulsa

West Palm Beach

Austin

Houston

San Antonio

San Diego

San Francisco

Atlanta

Kansas City

Cincinnati

Cleveland

Seattle

Portland

Memphis

Philadelphia

Albuquerque

Chicago

Contact Us Today!

Contact Information