Internal Penetration Testing of IT Infrastructure

Penetration testing methodology involves simulating the actions of real computer criminals attempting to gain unauthorized access to an organization’s resources using all possible access channels and penetration techniques. Penetration testing methodology is characterized by high flexibility by adapting penetration techniques to attack scenarios corresponding to the greatest threats from the point of view of the tested organization.

Service Description:

The author’s penetration testing methodology is consistent with best practices in the field, including:

• Open Source Security Testing Methodology Manual (OSSTMM),
• NIST 800-42, Guideline on Network Security Testing,
• Information System Security Assessment Framework (ISSAF),
• Recommendations from the SANS Institute, Offensive Security, and EC-Council organizations.

Regardless of the attack scenario pursued, the methodology assumes the implementation of penetration testing in the following stages:

• Recognition,
• Testing,
• Exploitation (with permission).

The methodology involves iterative repetition of steps within new penetration testing scenarios related to privilege escalation or access channel change.
Sample penetration testing scenarios can simulate, for example:

• Attempts to access the organization’s internal network by an
  outsider,
• Attempts to take control of an organization’s user station through malware infection,
• Attempts to implement activities using the lost computer of an employee of the organization,
• Attempts by an employee of the organization to bypass security measures,
• Attempts by a guest of the organization (or a contractor) to gain access to the organization.

Customer benefits:

Customers who use our services gain confidence that their IT infrastructure is protected against complex and advanced threats, increasing their resilience to attacks and improving their overall security posture.

Features and Specifications:

The service covers the stages of reconnaissance, testing and exploitation (after approval), offering a detailed vulnerability analysis and recommendations for strengthening security.

For whom it is intended:

The service is aimed at organizations of all sizes that want to test their resilience to cyber attacks and secure their IT environment.

Application examples:

Test scenarios can include simulated attacks from inside and outside the organization, malware infection, operations using lost equipment, or attempts by employees and visitors to bypass security.