Network Penetration Testing
A network penetration test provides organizations with a view of your security system’s effectiveness. Some companies may not have a handle on their network security. More mature and established companies often have larger, multi-tiered networks that are easily overlooked, as more organizations are moving to cloud-based systems, which can increase the chances for breaches.
In either scenario, you will be made aware of security flaws identified before attackers can exploit them. This will help provide foresight for the business leaders to be prepared to make informed decisions about their organization’s security. Hardening your security posture further lets your clients and partners feel more confident in your ability to protect their assets
Manual vs. Automated Network Testing
Automated scanners often miss subtle security risks so it takes an experienced individual to understand the application and how logic can be abused. Numerous vulnerabilities simply are not found with automated vulnerability scanners.
We employ the help of vulnerability scanners in the early stages of an assessment. With additional understanding of the application and its context, we provide assessments that are more relevant to the client and their individual security needs
Network Pentest Methodology
Solid Rock Innovations utilizes a detailed and repeatable methodology. We ensure this process is used during each engagement to ensure our assessment is reliable and reproducible. To get these results, we utilize the following steps listed below:
1. Network Scope
Before a network assessment can take place, a clear scope is defined with the client. Communication is encouraged with Solid Rock and the client organization during this stage to establish a firm foundation in which to assess from.
- Identify which assets will be in scope to be tested
- Make note of any exclusions from the assessment (IP address and/or services)
- Decide on the official testing window
2. Information Gathering
Collect as much information as possible on the target, leveraging OSINT (Open Source Intelligence) tools and techniques. The information gathered will help Solid Rock to understand the operations of the organization, which allows risk to be accurately assessed through the engagement process. Some of the intelligence may include:
- Network IP address and hosting providers
- Ownership and validation of assets
- Information leaked from breaches
- Leaked information or misconfigured systems
3. Vulnerability Identification & Enumeration
Automated scripts and tools are used during this stage, along with more advanced information gathering techniques. Solid Rock will further examine any potential attack vectors. The information gathered here will be the basis for exploitation in the next phase.
- Determine open ports and services
- Misconfigured cloud services
- Leverage known vulnerabilities of the applications and associated services
We begin to attack the vulnerabilities discovered within the network. This is done with care and caution to protect the network systems and its data, while still working to verify the existence of attack vectors. The following attacks, and others, will be performed during this stage:
- Compromising servers, workstations, databases, and web servers
- Leverage any known breached credentials and use for brute forcing against authentication measures
- Leverage known public vulnerabilities of the systems software/firmware
Reporting is the final phase of the assessment. All of the information gathered is combined and used to provide the client with a comprehensive detailing of the findings. The report contains a breakdown of the overall risk, highlighting strengths and weaknesses in the network. Recommendations are included to help the business to make informed decisions regarding the network and their systems. Each vulnerability is further broken down into technical details, along with remediation steps for the technical team to follow. An executive summary is also included to help provide information for strategic planning.
6. Remediation Testing (Optional)
Upon the request of the client, a retest can be performed after the client has addressed vulnerabilities identified in the assessment. We validate to see if the vulnerability still exists to ensure the changes were implemented properly. The prior assessment will be updated to reflect the results of the retest.