Also known as ‘Infrastructure PT’, or infrastructure resilience testing, and is divided into two categories:
Internal test: The process simulates a scenario where a hacker has already gained access to an internal network with malicious intent to attack the network infrastructure like servers, computer terminals, communications equipment, and cloud environments. The test is carried out in a Grey-Box configuration and includes attempts to penetrate systems, hop between networks, gain control, and check the feasibility of information leakage.
External test: The process simulates a scenario where a hacker tries to penetrate the internal network through the Internet. Within the framework of this test, the organization’s assets and services available through the Internet will first be mapped. Then, diverse techniques will be attempted aiming at breaking into the internal network and gaining access to these assets. Tests are performed in a Black-Box configuration.
Infrastructure Penetration Tests are carried out following the NIST 800-115 and MITRE Enterprise Tactics methodologies, which together constitute the international standard in this field, combined with designated techniques developed by Madsec.
Who could benefit from the Infrastructure Penetration Test?
- Companies interested in professionally checking whether hackers can infiltrate their internal networks through external infrastructure.
- Companies that have created a full cloud environment and are interested in testing the possibility of an intrusion and attack.
- Organizations that wish to ensure that an internal attack would not lead to significant harm.
- Information security managers who are interested in mapping out all risks and weaknesses in their internal networks.
What are the advantages of performing Infrastructure Penetration Tests?
- A professional Penetration Tester examines the system, and the client receives a formal list of findings and guidelines for dealing with the weaknesses that are discovered.
- The tests guarantee compliance with regulations such as privacy protection, GDPR, HIPPA, and cyber insurance requirements.
- The current computing environment is very complex. On top of systems in the On-Premises environment, companies also use VPC (Virtual Private Cloud), thus adding more potential attack surfaces to the organization and increasing the need to perform PT tests on all infrastructures.
- Testing enables proficient recommendations for hardening the networks from the viewpoint of a professional hacker.
What are the highlights of the test?
- Exposing vulnerabilities using diverse techniques.
- Exploiting vulnerable systems using existing exploits.
- Examining the feasibility by which the organization’s confidentiality, reliability, or availability of information can be violated.
- Accessing systems with Brute-Force.
- Exploiting known vulnerabilities in various internal services such as SMB, RDP, SSH.
- Hopping between different networks.
- Takeover of communications equipment, like firewalls and switches.
- Database intrusion.
- Examining the strength of encryption protocols.
- Privilege escalation.
An infrastructural penetration test requires a tester with more than five years of experience. Experience has a decisive impact on the quality of the findings and the ability to assess their severity. Don’t compromise, make sure that the pentester is experienced, is a company employee, has the necessary certifications, and has professional liability insurance.
