Internal Penetration Testing

What Is Internal Penetration Testing?

An internal pen test is usually done after completing an external pen test. It imitates an insider threat and identifies how an attacker with internal access may compromise or damage the network, systems, or data.

Typically, the starting point of an internal network penetration test is a user with standard access privileges. The tester may work with these common scenarios:

• An unhappy rogue employee (malicious insider) who tries to compromise or damage the system
• An external malicious attacker who accesses the system via social engineering, phishing scam, or stolen credentials

Most organizations focus on external security threats. Yet internal threats — coming from malicious insiders, careless employees, insecure third-party vendors, and even clients or customers — are equally (if not more) serious than external threats.

Research shows that from 2018 to 2022, the number of insider incidents increased by 57 percent. Moreover, in 2022 the total average cost of insider threats was $14.45 million,  percent higher than the $8.76 million in 2018. In 2021, insider threat incidents are expected to grow by 11 percent, and one-third of data breaches are projected to result from insider threats. These threats can come from:

• Weak or shared passwords
• Weak access controls
• Insecure file sharing or unencrypted data
• Network misconfigurations
• Lack of awareness about social engineering and phishing
• Ransomware attacks
• Insecure remote networks and devices

It’s crucial to identify these threat vectors and address them on priority. And for this, internal penetration testing is critical.

How to Do an Internal Pen Test

In internal pen tests, the tester may test:

• Computer systems, workstations, and mobile devices
• Servers
• Wi-Fi networks
• Access points
• Firewalls
• Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)
• Internet-connected HVAC systems
• Cameras
• Employees (behaviors and procedures)

Once the tester identifies security vulnerabilities in these components, he or she will try to exploit them to understand the potential for unauthorized access and damage. The tester will also provide a detailed report, so the enterprise security team can take the necessary actions to close discovered vulnerabilities as soon as possible.

There are many ways to conduct internal pen tests. The tester may use privilege escalation, steal credentials, spread malware, leak information; or carry out other malicious activities like man in the middle (MitM) attacks. Other common internal pen testing methodologies include:

• Internal network scanning
• Port scanning
• System fingerprinting
• Firewall testing
• Manual vulnerability testing
• Password strength testing
• Database security controls testing
• Network equipment security controls testing

The tester may also carry out internal network scans to find known Trojans and check third-party security configurations to minimize the risk of supply chain attacks.