Internal Penetration Testing 101: Where to Start

This blog is a summary of the SecurityMetrics Internal Penetration Testing Webinar by James Farnsworth (Senior Penetration Tester) and Garrett Adler (Senior Penetration tester).

Introduction

What if you could get the bad guys on your side? All the insights of the hackers and intel of the bad actors, with all kinds of unique expertise and exploitation skills in your corner, working for you.

Well, maybe you can.

At least, sort of. That’s where penetration testing comes in.

Think of penetration testers as ethical hackers working to intentionally find weaknesses or exploitable areas in your business system that the bad guys normally would, before they ever can. Pen testing is a huge help and crucial prevention method so you can find, fix, and fortify your organization before the real attackers ever get the chance.

Let’s explore what pen testing is, how it can be a massive boon to your business, and how you can stay one step ahead of hackers.

See also: Penetration Testing 101 Webinar

What is Internal Penetration Testing?

While there are various types of penetration tests like external, web application, or mobile, this blog will focus on internal tests and why they matter. Internal penetration testing helps reveal potential vulnerabilities, like exposed sensitive information, that could lead to a data breach.

We've found issues like unprotected credentials or misconfigured systems in the past that posed significant risks to businesses, demonstrating that even when following best practices, potential threats may exist.

Additionally, these tests are not limited to Windows environments; they are applicable to various settings, including Linux and development environments, as lateral movement and privilege escalation are relevant in these scenarios too.

In addition to knowing why we do internal penetration tests, it’s important to know how to prepare for them. Here are five tips that can help you with your penetration tests:

1. Communication: Collaborate with the team managing your internal network to ensure everyone's on the same page regarding security.
2. Asset Inventory: Maintain a comprehensive list of assets in your network, including their purpose and any sensitive data they hold.
3. Network Topology: Understand how systems communicate with each other, what should be segmented, and the location of critical assets.
4. Access Control: Define user roles, establish an access control matrix, and enforce the principle of least privilege.
5. Verification and Testing: Continuously verify and test your network's configuration to prevent overexposure or over privilege.
   

Why You Should Perform a Pen Test

The primary goal of internal penetration testing is to validate these security measures. Success doesn't necessarily mean finding vulnerabilities; it can also be confirming that your network is well-protected and your strategies work.

Ultimately, the value we provide through penetration testing varies depending on your specific network and objectives.

When it comes to objectives in internal testing, having clear objectives is crucial. One approach we take is to ask our customers, “What keeps you up at night? What are your primary concerns?” This information provides a starting point for our testing. While we have a standardized methodology, understanding the customer's specific worries helps us tailor our focus.

For example, if a customer is deeply concerned about an attacker moving from the corporate network to the operational technology network, potentially causing an ecological disaster, that becomes our focal point. Our objective becomes confirming or denying the feasibility of this specific scenario, rather than simply identifying vulnerabilities. It adds a real-world context to our testing, aligning it with the customer's pressing concerns.

Having clear objectives is particularly helpful for those who are new to penetration testing and may not have specific goals in mind. Defining objectives provides direction and narrows down the scope. If you're new to this and your primary motivation is, for example, compliance or security improvement, objectives can help shape the test. Even in the context of compliance like PCI, which has specific standards, objectives can still refine the focus.

For instance, we can look for vulnerabilities related to PCI Data Security Standards (PCI DSS), ensuring the protection of credit card information and personally identifiable information (PII). Ultimately, the effectiveness of a penetration test is often a reflection of the client's level of engagement, open communication, and their willingness to act on the findings. Setting clear objectives is a step toward a more fruitful and informative testing process.

Internal Penetration Testing Process

So what does the process of a penetration test look like? Here's a general overview:

• Initial Consultation: You'll have an initial conversation with a representative from our organization. During this discussion, you'll talk about your concerns, what you want to achieve with the test, and provide information about your network infrastructure.
• Scope Definition: We'll work together to define the scope of the penetration test. This involves identifying the size of your network, the number of hosts, the services you're using, and the architecture (e.g., Windows Active Directory, Linux-based systems). Our approach is tailored to your specific needs and infrastructure.
• Questionnaires: After defining the scope, we'll send you questionnaires to gather more detailed information. These questionnaires help us understand your specific environment, your objectives, and any particular concerns you have.
• Testing Phase: Once we have the necessary information and have set up the testing environment, we'll proceed with the penetration test. To do this, we'll securely deploy a testing 'beacon' inside your network. Throughout this phase, you may receive queries from us, and we'll designate a point of contact within your organization for effective communication.
• Report Delivery: After completing the test, we'll generate a comprehensive report outlining our findings, including any vulnerabilities or weaknesses we discovered.
• Remediation and Re-Testing: Following the report delivery, you'll have the opportunity to address the identified issues. Once you've made the necessary fixes, we'll re-test to ensure the vulnerabilities have been resolved.

These steps ensure a structured and collaborative process, aligning our efforts with your specific objectives and providing a clear path to enhancing your network's security.

Security is an ongoing process, and we're here to assist you in that journey. Remember that you can always contact our support department or call us to discuss your questions or concerns. Our team is dedicated to addressing your security needs and helping you achieve a more secure environment.

Internal Penetration Testing Q&A

1: Why would I get a pen test compared to a vulnerability scan, and don't they provide similar information?

A vulnerability scan is a passive enumeration of your network, focusing on known vulnerabilities. It doesn't actively look for unknown vulnerabilities or flaws in custom in-house code. It mainly checks software versions and identifies associated vulnerabilities.

2: Will performing a penetration test open us to more security risks, or will your testing impact our day-to-day business operations?

Our goal is never to degrade your security. We don't open additional ports or modify your rules or firewalls in ways that could make you more vulnerable. We ensure minimal impact on your daily operations, striving not to disrupt your services or networks.

3: What is your favorite or unique discovery made during a pen test?

One notable discovery was a vulnerability in a printer that disclosed a list of logged-in users and their clear text passwords. This seemingly harmless printer had a domain administrator's password, which led to an interesting 30-minute re-login scenario. Unexpected vulnerabilities like this are what make pen testing so intriguing.

4: Why test different assets other than what our objective points towards?

Focusing only on assets directly related to your objectives may lead to incomplete testing.

Often, the crown jewels of your network, the assets you're most concerned about, are the best protected. By testing various accessible devices within your network environment, we create a more realistic scenario an attacker might exploit, ensuring thorough testing and providing the most value.

5: How quickly can we get someone to perform a penetration test?

The timeline for scheduling a pen test depends on factors such as the size of your environment and the scope of the test.

On average, a kickoff call can be scheduled within 7 to 10 days after signing the contract. If you have time constraints or deadlines, we can expedite this process with after-hours testing.

Ideally, allow 4 to 8 weeks of lead time for the full testing cycle.

6: How much do internal penetration tests actually cost?

The cost of a penetration test varies based on many factors.

On average, a typical test for an average-sized network falls between $5,000 and $15,000.

However, this price can change based on specific needs. We offer personalized pricing to tailor our services to your requirements and budget constraints.

Conclusion

It’s vital to protect your business and as you’ve seen, one of the best ways to do so is with a penetration test.

These tests offer a comprehensive approach to discovering weaknesses and identifying vulnerabilities in your business system. Without a complete penetration test, you may be opening yourself up to hackers who can exploit your organization in ways you never even considered or realized.

Staying ahead of bad actors with a pen test allows you to rest assured that you’ve done your due diligence in protecting your team, your customers, and your sensitive information.

To see if your business needs a pen test, contact the experts at SecurityMetrics.

Our team of penetration testers will work with you to uncover all potentially vulnerable data. You can also start with our pricing calculator to determine the best ways to budget and plan for your pen test. Getting started is easy!