Internal Infrastructure Penetration Testing

Identifying security vulnerabilities within your most sensitive and critical environments.

What is Internal Infrastructure Penetration Testing?

An internal infrastructure penetration test will assess your critical internal networks to identify security vulnerabilities and weaknesses.

These are the environments that may be used on a daily basis to: transmit sensitive data, connect to business critical services and to store highly confidential information.

How Can Your Business Benefit From Internal Infrastructure Penetration Testing?

Internal networks and environments are often where a companies most critical assets are located. Within these internal environments, there is often a large plethora of technologies, operating systems and services – all of which will be assessed within an internal infrastructure penetration test.

Although these environments are usually segregated from the internet through various controls and network devices, they often are riddled with security vulnerabilities that could potentially allow an attacker to compromise your entire organisation.

Our CREST approved internal infrastructure penetration testing service can provide you with insight into security vulnerabilities within what could be your most critical assets. We can:

Identify security vulnerabilities relating to insecure network configurations.
Identify critical flaws within critical services and network devices.
Highlight attack paths, once an attacker has a foothold within the internal environment.
Provide assurance that an expert team has reviewed the internal infrastructure for security vulnerabilities and advised accordingly.

Commonly Asked Questions About Internal Infrastructure Penetration Testing...

What is Internal Infrastructure Penetration Testing?

An internal infrastructure penetration test will assess your critical internal networks to identify security vulnerabilities and weaknesses. It is aimed at assessing internal networks from the position of a compromised employee or even a malicious insider.

My Environment Is Internal, Why Does This Need Testing?

Even if your organisation has no publicly facing infrastructure, you may find that end user devices such as laptops have access to email / internet and outbound communications.

If an attacker is able to successfully compromise an end user device through one of these vectors, they may subsequently have full access to the internal environment.

What is Assessed?

An internal infrastructure penetration test will cover the following areas at the very least:

Patching
Secure Configurations
Active Directory / SSO
Password Management
Permissions
Network Segmentation

How Do You Connect to the Internal Network?

Ruptura InfoSecurity have a variety of options to perform an internal infrastructure penetration test. This can be performed physically onsite, utilise an existing VPN solution or deploy a ‘jumpbox’ into the environment. This all depends on the exact architecture of the network and specific requirements.

How Often Should a Penetration Test Take Place?

Ruptura InfoSecurity recommends that internal infrastructure penetration testing takes place at least every 6 months, or when key new systems are added.

Our Internal Infrastructure Penetration Testing Lifecycle

Our team of infrastructure testers specialise in assessing corporate networks of all sizes and complexity. Ruptura InfoSecurity use both industry approved tools and custom built ‘in-house’ tools to assess your internal infrastructure, ensuring you have security visibility of your most critical environments.

This is our second most popular service offering with our testers holding some of the highest qualifications and accolades available.

Your organisation can rest assured that from start to finish, the process is as simple as can be – whilst still receiving an exceptional penetration testing service.

Scoping

Ruptura InfoSecurity will learn about the key features of your target environments through a scoping call or technical demo. Questions will be asked between all involved parties.

Approval

A proposal will be issued detailing the items in scope, terms and conditions, cost and duration of the project. Once this contract is mutually signed, the project will be scheduled and will shortly commence.

Discovery

Your dedicated penetration tester will begin enumerating the internal network to identify potential attack paths and security vulnerabilities.

Assessment

The penetration tester will perform the penetration test and will identify and safely exploit any identified security vulnerabilities. Safe proof-of-concepts will be demonstrated.

Remediation

Where previously agreed, Ruptura InfoSecurity will assist your organisation in fully mitigating any identified risks. This will include working with existing development teams.

Debrief

A high level de-brief session will take place between Ruptura InfoSecurity and your key stakeholders. This will be tailored for both executive and technical members of staff.

Keeping Your Stakeholders Happy.

Security Auditors
Almost all businesses have at least some internal infrastructure. As an absolute minimum, an information security auditor would expect this to be included within a penetration testing scope for various compliance requirements.

CISO / CTO / Heads of IT / IT Security Managers
Senior staff members will have a clear picture of the internal environments and therefore make plans to introduce new policies, tooling and remediation activities.

Engineering Teams
Network engineering and architect teams will have a clear set of defined remediatory actions that can be applied and learned from in future deployments. These can be as simple as stricter firewall rules and/or better network segmentation.

Your Trusted Cyber Security Provider.

We are a UK-based cyber security provider with a global reach, including a dedicated company based in Dubai. Our services are provided entirely in-house and are fully accredited by industry standard qualifications and standards. We work with some of the largest global organisations to single person organisations, with them all receiving the same high level of service.