Internal pentest

What is
internal pentest

The internal pentest consists in simulating the actions of an attacker who has access to the Company's internal network and is trying to gain access to protected information. In general, internal penetration testing is conducted using the Gray box model (the pentester has the rights of an ordinary employee).

When testing is needed

During the security check
IT infrastructure

Pentest will help you check how well your infrastructure is protected from the inside

After making significant changes to the IT infrastructure

Pentest can be used to identify new vulnerabilities that have arisen after the infrastructure upgrade

The result is a Report that consists of

Summary

A general description of the results of the pentest without using specialized terminology, but with an assessment of the criticality of ways to access protected information.

Technical Report

It contains information about the vulnerabilities found, how to reproduce them, and scenarios for their exploitation. The Report also contains detailed information on how to fix the vulnerabilities found.

Expert opinion

This section contains information on individual ways to increase the level of information security, taking into account the Client's business processes.

What to do with the Report

01

Analyze the results

Carefully review the report to understand the identified vulnerabilities, potential consequences and recommendations for their elimination.

02

Develop an action plan

Create an action plan to eliminate the identified vulnerabilities. Set deadlines and responsible persons to ensure an appropriate response to each problem.

03

Fix vulnerabilities

Take measures to eliminate the identified vulnerabilities in accordance with the developed action plan

04

Repeat testing

After fixing the vulnerabilities, repeat the pentest to make sure that the problems have been successfully fixed and the system is now protected.

05

Update policies and procedures

Based on the results of the pentest, update the security policies and procedures.

06

Train the staff

Conduct employee training to increase awareness of risks and best security practices

Advantages ITGLOBAL.COM Security

1/4

Certificates

The external pentest is performed by specialists who have international certificates: OSCP, OSCE, OSWE, CEH

2/4

Own testing methods

Availability of more than 40 proprietary techniques for conducting an internal pentest

3/4

Support after the service is provided

We continue to advise you after the pentest to help eliminate the vulnerabilities identified during the process.

4/4

Proven experience

10 years of practical experience, real cases of our clients and all the necessary licenses of the FSB and FSTEC

Frequently Asked Questions

What is a pentest?

Pentest is a method of assessing the security of IT infrastructure or information systems, using techniques and tools similar to those that can be used by attackers
Types of pentests

External pentest is a simulation of the actions of an attacker who has illegally penetrated the IT infrastructure from the external environment
Internal pentest is a simulation of the actions of an attacker, from the position of an internal user or employee who has access to the IT infrastructure or information systems
A web application pentest is a simulation of an attacker's actions aimed at identifying vulnerabilities that can be used to gain unauthorized access to data, functionality, or resources of a web application.
A mobile application pentest is a simulation of an attacker's actions aimed at identifying vulnerabilities that can be used to gain unauthorized access to data, functionality, or resources of a mobile application.

What are the methods of conducting pentests?

White Box — mimics the actions of an employee who holds a responsible position and has specialized skills.
Gray Box — simulates the actions of an employee with basic access to the company's infrastructure and services.
Black Box — an attack is simulated by an attacker who knows nothing about the company's infrastructure, only its name.

How does pentest differ from security analysis and information security audit?

Security analysis allows you to find all known and unknown vulnerabilities in your IT infrastructure. Information security audit allows you to assess the current state of the Client's information security processes and get an objective assessment of their maturity. Pentest allows you to find all known and unknown vulnerabilities in your IT infrastructure and carry out attacks using them.

Our clients