Network-Layer Penetration Test

External Infrastructure Testing (Also called External penetration testing, Perimeter penetration testing, Network penetration testing, External Network-Layer Penetration testing) is a method of actively evaluating the security of a network by simulating an attack from a malicious source in public (cyber attacks). The intent of a penetration test is to simulate a real-world attack situation with a goal of identifying how far an attacker would be able to penetrate into an environment.

A penetration test differs from a vulnerability scan, as a penetration test is an active process that may include exploiting identified cyber vulnerabilities. Conducting a vulnerability scan may be one of the first steps a penetration tester will perform in order to plan the testing strategy, although it is not the only step. Even if a vulnerability scan does not detect known cyber vulnerabilities, the penetration tester will often gain enough knowledge about the system to identify possible cyber security gaps.

Whilst we take care of our clients network / applications and do it in a safe manner, it still might create a risk that by exploiting vulnerabilities found this can affect the availability of the systems. For Clients having sensitive systems, we sometimes advise to do a proper penetration testing, but when it comes to system hacking phase, then we would suggest to do a validation of vulnerabilities found rather than trying to exploit these. From our experience, we can confirm that vulnerabilities, such as a missing patch/update, are easily to be exploited via tools, such as Metasploit, however where there is more advanced vulnerabilities found, it takes time / resources to actually exploit which my also might create a greater risk of systems unavailability. 

Router penetration testing (router ethical hacking), firewall penetration testing (firewall ethical hacking), IPS penetration testing (IPS ethical hacking), IDS penetration testing (IDS ethical hacking) are the key testing phases in overall External Infrastructure Testing.   

Sometimes Organizations spent and invest enormous resources in implementing the defense in depth strategy (such as policies, procedures, physical security, network and host security, application and data protection), but miss to actually test network security against cyber attacks. This may result that Company’s network is compromised and the reason for this could be only a single vulnerability missed to be unprotected. Why not make sure that your Organization’s network is properly protected against these attacks and undertake an external infrastructure testing (penetration testing)?

CyberAudit offers professional External infrastructure testing services worldwide.  Our penetration techniques depend on organizations type, depth and complexity and specific environment. The following are the key phases followed in our penetration testing:

  • Footprinting and Reconaissance;
  • Scanning Networks;
  • System hacking;
  • Reporting.
For Senior Management and Security Professionals within the organization, we would like to recommend considering to undertake one of the following types of penetration testing:
  • Black-box Penetration Testing  – it simulates the process of a real cyber criminal where the only initial information given is an Organization name. Whilst no prior knowledge of the infrastructure is given, the penetration testing involves extensive information gathering and research. This test can be very risky to not disrupt the actual services if not undertaken with a great care by both the client and the penetration tester.
  • In a Grey-Box Testing, the penetration tester has a limited knowledge of Organization’s network, applications and / or hosts. This type of testing also could be undertaken if no results are identified as part of black-box testing for well protected systems.
  • In a White-box Testing, the penetration tester has a complete knowledge of the infrastructure (i.e. network type, topology, current security implementations, IP address, firewalls and IPS/IDS details, policies etc.) that needs to be tested. This simulates the process of Organization’s employees trying to attack the Organization’s network from cyber environment.
Feel free to contact us to discuss your Organization’s penetration testing requirements and get a quote.