Managed Security Services
Internal Post Incident Testing
Also commonly called internal penetration testing, red teaming or post-breach internal penetration testing.
What is Internal Post Incident Testing?
Internal Post Incident Testing (IPIT) starts with the premise that your network has been breached, is vulnerable to breach, or that someone in your organisation has:
- opened a malicious email attachment
- browsed to the wrong website and/or clicked the wrong link
- plugged in an infected or malicious USB or removable media device.
A post-breach internal penetration test assumes you will be breached at some point and need to strengthen your security posture.
This is one of the most effective and realistic ways to measure your overall operational cyber security posture – the people, processes and technologies protecting your environment. It tests your network visibility, focusing on network traffic and endpoint behaviour and the detection of potentially malicious operations. It can also measure the detection and response capability of your security team or Managed Security Service Provider (MSSP).
A properly executed IPIT is all about improving your operational cyber security posture. MIST delivers a comprehensive report that allows you to close the security gaps and maintain the confidentiality, integrity and availability of the critical assets in your environment.
Background of user-driven attacks
To combat today’s sophisticated cyber threat actors, complete situational awareness and network visibility are necessary. Traditional security infrastructure relies on logging security alerts to produce threat visibility – but alerts and visibility are not the same. Without the ability to “see” threats hiding in normal-looking activity, you cannot possibly stop them.
Security tools create and log alerts when they detect something they consider threatening. Capable attackers, however, don’t do threatening things that ring alarm bells. They rely on user-driven attacks and emulated insider behaviour that is silent, stealthy and very normal-looking – traversing the network, gaining access, establishing beachheads and ultimately stealing, sabotaging or damaging corporate infrastructure and digital assets.
Attackers have long known that the easiest way to breach a network is not by attacking the perimeter, but by socially engineering the users inside. If they succeed, a user will do something that leads to compromise – opening a malicious email, visiting a bad website, plugging in an unknown USB stick or downloading the wrong application. All it takes is a small foothold for an attacker to take over a user’s account and machine. The attacker becomes the insider, and everything they do looks like normal user behaviour that traditional tools won’t stop – or even see.
The MIST approach
Internal post-breach penetration testing starts with the premise that a trusted employee has clicked the wrong link, opened the wrong attachment or plugged in the wrong USB device. The adversary now has a foothold inside the network and you have been actively compromised. This testing exercises the security controls and detection and response capabilities of your organisation, simulating what an adversary can do once the perimeter has been breached.
To do this, MIST uses its managed security software to establish a beachhead on a normal domain workstation, or provides an “infectious device”, and launches all activities from that location using command-and-control techniques to communicate with the “compromised” system. The objectives are to evaluate internal security controls, security visibility, detection capabilities and your security team’s response to an adversarial threat, and to assess the overall security posture of the internal network. Specific objectives can also be set (for example, retrieving a file from a privileged file server) and discussed in detail before testing.
All testing by MIST is performed by a human using a blend of automated and manual procedures. We don’t simply “scan and patch”.
Reporting and deliverables
Penetration testing reports
Following any testing, a full detailed report is made available. It outlines the testing methods used, the findings, any proof-of-concept code for successful exploits, and remediation steps and suggestions.
Exploit proof-of-concept development
In the event of a successful exploit, breach or compromise, MIST documents the testing methodology used, records all gathered evidence, and develops proof-of-concept exploits for repeatable testing.
Targeted remediation retest
Testing may reveal areas of weakness that require reconfiguration, patching or replacement. MIST will retest these areas once remediation is complete. Retesting is included if executed within 90 days of initial testing.
Let’s talk
Ready to take the pressure off your IT?
Our Australian-based team is ready to help. Call 0488 687 777 or email sales@mist-integration.com.au and we’ll get back to you as quickly as possible.