Most organisations structure their networks with strong boundaries, and a permissive interior. This is intended to block attackers who have no need to access, while at the same time allowing internal users access to all network resources. This trust model can be compromised if an attacker can penetrate the external boundary, either via the network, wireless or physical means.
The threat model for an internal penetration test is an unauthorised insider who has network access but has no authentication or authorisation for access to systems or is exceeding the level of authorisation they have been granted. Examples of this class of attacker include employees, contractors, cleaning staff, and visitors as well as attackers who have already completed a successful network or wireless penetration.
The goal of the simulated attacker performing an internal penetration test is user or administrator level access to servers or applications on the internal network. Attacks may be performed on all network connected devices and systems.
The testing follows a consistent and structured approach covering the following layers of the OSI network model:
- Network
- Transport
The methodology for the testing is as follows:
- Information gathering
- Scanning & enumeration
- Exploitation using appropriate tools
- Manual exploitation
- Password brute force
Upon identifying any weaknesses within your system DMA will provide you with a report detailing all the vulnerabilities which have been identified within your system, categorising them by their risk and offering suggested remediation activities which should occur. These remediation activities can be completed by your organisation or DMA’s services can be enlisted to assist.
For more in formation or a confidential discussion please email; enquiries@dmaust.com.au