Internal pentest

What is an internal pentest

Internal pentest consists in simulating the actions of an intruder who has access to the Company's internal network and tries to gain access to protected information. In general, internal penetration testing is conducted according to the Gray box model (pentester has the rights of an ordinary employee).

When you need testing

When reviewing the security of
IT infrastructure

Pentest can help you check how secure your infrastructure is from the inside out

After making significant changes to the IT infrastructure

The pentest can be used to identify new vulnerabilities that have arisen since the infrastructure upgrade

The result is the Report, which consists of

Summary

General description of the pentest results without using specialized terminology, but with an assessment of the criticality of the methods of gaining access to protected information.

Technical report

Contains information about the vulnerabilities found, how they are reproduced and scenarios of their exploitation. The Report also contains detailed information on how to remediate the found vulnerabilities.

Expert opinion

This section contains information on individual ways to improve the level of information security taking into account the Client's business processes. Client's business processes.

What to do with the Report

01

Analyze the results

Carefully review the report to understand the vulnerabilities identified, potential impacts, and recommendations for remediation.

02

Develop an action plan

Create an action plan to address identified vulnerabilities. Establish timelines and responsible parties to ensure an appropriate response to each issue.

03

Fix the vulnerabilities

Take measures to address identified vulnerabilities in accordance with the developed action plan

04

Repeat the test

After the vulnerabilities have been fixed, repeat the pentest to ensure that the issues have been successfully fixed and the system is now secure.

05

Update policies and procedures

Based on the results of the pentest, update security policies and procedures.

06

Train staff

Conduct employee training to raise awareness of risks and security best practices

Benefits of ITGLOBAL.COM Security

1/5

Certificates

External pentest is performed by specialists who have international certificates: OSCP, OSCE, OSWE, CEH

.

2/5

Adherence to standards

PCI DSS, 719-P, 683-P, 757-P, 742-P, 802-P and GOST R 57580

3/5

Proprietary testing methods

Having more than 40 proprietary internal pentesting methodologies

4/5

Post-service support

We continue to advise you after the pentest to help address vulnerabilities identified in the process

.

5/5

Proven experience

10 years of practical experience, real cases of our clients and all necessary FSB and FSTEC licenses

Frequently Asked Questions

What is a pentest?

A pentest is a method of assessing the security of IT infrastructure or information systems using techniques and tools similar to those that attackers might use
Types of pentests

External pentest is a simulation of the actions of an attacker who has illegally penetrated the IT infrastructure from the external environment
Internal pentest is a simulation of the actions of an attacker, from the perspective of an internal user or employee who has access to the IT infrastructure or information systems
Web application pentest is a simulation of the attacker's actions aimed at identifying vulnerabilities that can be exploited to gain unauthorized access to data, functionality or resources of a web application.
Pentest of a mobile application is a simulation of an attacker's actions aimed at identifying vulnerabilities that can be exploited to gain unauthorized access to data, functionality or resources of a mobile application.

What are the techniques for conducting pentests?

White Box - simulates the actions of an employee who holds a responsible position and has specialized skills.
Gray Box - simulates the actions of an employee with basic access to the company's infrastructure and services.
Black Box - simulates an attack by an attacker who knows nothing about the company's infrastructure, only its name.

How does pentest differ from security analysis and IS audits?

Security analysis allows you to find all known and unknown vulnerabilities in your IT infrastructure IS audit allows you to assess the current state of the Client's information security processes and get an objective assessment of their maturity Pentest allows you to find all known and unknown vulnerabilities in your IT infrastructure and perform attacks using them.

Our clients