How much do you know about vulnerabilities within your company? If you’re like most business people, you either think you’re covered or you know there’s a problem but don’t know what to do about it. Almost no one is in denial about the fact that risks are everywhere. Unfortunately, even those that believe their security is airtight are usually one cup of coffee away from a total meltdown.
It’s Not Just About External Threats
Most businesses that perform penetration or vulnerability testing tend to focus on external testing. External threats are serious, and they can compromise an entire network. But, they aren’t the only threats a company needs to be concerned with.
You can see here what all facets of a penetration test look like. The first step often is an external test. But, the second phase or step is an internal test. The internal test looks at what vulnerabilities exist inside the company or how a company can be compromise from within.
This type of testing is sometimes referred to as “internal security penetration testing.”
Setting Up The Testing
Setting up an internal test takes time. Often, an internal test is a combination of typical software and hardware testing and social engineering.
Social engineering is something that many businesses neglect because they aren’t prepared for it or they don’t fully understand it. All reputable security analysts that perform social engineering do so with the full and explicit permission of the company.
Doing so without consent, and without making the proper individuals within the company aware, is illegal.
Internal penetration testing may also focus on hybrid social engineering and technology-based attacks – phishing, for example. A pen tester may send an email attempting to get employees to click on it. Testers will then collect clickthrough rates on those emails. They will not exploit the user directly through the phishing email.
However, they will work with insiders at the company to compromise the system using laptops or desktop machines that have been specially configured.
The reason the phishing attempt is done in two steps is to contain the scope of the testing. Since a tester can’t let the target employee know that this is a test, the target may end up forwarding the email to someone outside the company or outside the testing range.
When this happens, an exploit that is delivered via email ends up affecting individuals or companies outside of the scope of the project, creating a liability.
Security companies that are experienced in penetration testing know this, and always work to make these types of tests 2-step or multi-stage. In this way, the analyst can infer what would have happened in a single-step exploit without putting anyone outside the company at risk.
In non-technical attacks, pen testers may use a variety of tactics, including making threatening phone calls or intimidating employees into handing over security credentials. They may also pose as fictitious staff or delivery personnel in order to gain access to secured buildings.
They may use other disguises or fake credentials to gain access to restricted areas. Sometimes, the attack is nothing more than a simple phone call to an employee to ask for a password reset. When the employee hands over their password, the security is breached.
Finding a Security Analyst
Finding an analyst is easy. Finding a good analyst can be rather difficult. That’s because good analysts have years of experience and, like any other professional at the top of their game, are in high demand.
A good security analyst will be able to generate reports, but also solutions for vulnerabilities. They should be able to explain what they’re doing, before they do it, in clear and concise language. They should also be able to show you references that you can call (other businesses).
They should hold numerous security credentials and certifications, have both basic and advanced knowledge of network security, and have strong communication skills.
Security analysts should perform internal testing and be able to communicate vulnerabilities discreetly. Reports should never be emailed or send over unsecured channels. Finally, the security analyst should have salient pricing.
Planning for Fixes
Once everything is done, once you’ve decided what you can fix, it’s time to patch up your system. Based on what’s in the report, you may have a lot or a little work to do. Fortunately, most penetration testing that’s done internally will uncover easily fixable security vulnerabilities.
For example, most employees should be able to resist phishing attempts or unauthorized entry. Training staff to be more mindful of security practices is a simple matter. The difficulty often lies in ongoing compliance. In that sense, the solutions tend to be simple, but the long-term fixes are difficult because of the sustained effort and mindfulness required.
Conclusion
While external threats are often the focus of cybersecurity efforts, internal vulnerabilities pose a significant risk that requires equal attention. A comprehensive approach involving regular internal penetration testing, staff training, and a culture of security awareness is essential for safeguarding against the complex landscape of cybersecurity threats.
