Network Penetration Testing
Network penetration testing is the process of testing the security of your internal and external networks, including accounts, firewalls, routers, switches, and other network devices. This is done by assessing the network using the same tools and techniques that an attacker would use and evaluating the effectiveness of existing controls.
This is a great way to validate the security of your network, and identify any weaknesses that could be exploited by an attacker and can be adjusted to simulate a number of potential scenarios such:
An attacker has breached your external defences and has a foothold in your network. What can they do now and to what extent is your internal network exposed?
Lost or Stolen Devices
What happens if a device is lost or stolen? Can an attacker access your network and what can they do once they are in? Imagine if a laptop was stolen from a member of staff or a member of your development team, what could an attacker do with it?
This is a nightmare situation, internal users already have access to sensitive systems and data through legitimate and trusted user accounts. What could a malicious insider do and are controls segregating data effective?
Realize Security can offer a range of testing services, from a simple network Vulnerability Scan, to a full-blown penetration test.
- What systems are exposed or vulnerable to attack and to what degree are they exposed?
- The security posture of your servers and workstations is important. We will assess your assets and provide you with a report on any vulnerabilities that we find and the risk they pose to your business.
- The assessment will typically target all devices accessible on the target network including servers, workstation, IoT devices and user accounts. However this can be tailored to your requirements and the scope expanded or reduced as required.
- Active Directory (AD) is the backbone of many organizations, and is often the first target of an attacker. It is important to ensure that your AD environment is secure, and that you have the appropriate controls in place to prevent an attacker from taking over your domain.
- What could a malicious insider or an attacker do once they have breached your network?
- We will look for misconfigurations that could be exploited by an attacker.
- These issues are typical in large or even small estates where there is a lack of understanding as to the implication of security groups, permissions, and other AD settings.
- Password Auditing assessments are typically included within this service.
- Open Source Security Testing Methodology Manual (OSSTMM)
- Best Practices for Securing Active Directory