Executive Summary
It is placed at the beginning of the Report and it is no longer than one page. It consists in a non-technical overview, destined to Management.
Network Penetration Test (NPT)
Specialist services to protect your business
Network Penetration Test (NPT)
Finding vulnerabilities in your own systems before somebody else does it is an important process for your own infrastructure security. A Network Penetration Test has the purpose of identifying the vulnerabilities, focusing on the major impact areas for the business.
A Network Penetration Test is oriented to the evaluation of network and systems security and configurations. It can be executed from the inside (Internal PT), from the outside (External PT) and with different levels of knowledge and access to the client's infrastructure and resources (Black Box, Grey Box e White Box).
So it's possible to simulate different sets of attacks. A Black Box external PT, for instance, aims to identify which damage can be caused by a casual attacker external from the organization, whereas a Grey Box Internal PT simulates an ill-intentioned employee.
ISGroup ISGroup is the ideal provider for your Network Penetration Test needs and acts with seriousness according to internationally recognized standards at the highest quality levels thanks to a steady commitment in the research area. Contact us to request a personalized preventivo.
Description
Electronic trading, on-line B2B (Business-to-Business) and global connectivity, fundamental components of any successful business strategies, require that corporates adopt security processes and practices.
Most companies operate diligently in order to maintain an efficient and effective security policy that implements the most recent products and services to prevent frauds, vandalism, sabotage and DoS (Denial of Service).
Despite this fact, several companies don't put the right emphasis to a key ingredient for the success of a security policy: to verify that networks and security systems function as planned.
Network Penetration Test activities, using tools and methods to scan the network infrastructure in search of vulnerabilities, helps putting the finishing touches to a corporate security policy, identifying vulnerabilities and assuring that the security implementation really provides the protection that the company demands and needs.
Performing regularly Penetration Test helps companies to discover their network security weak points, that may lead to compromised or destroyed data and equipment by Exploit, Virus, Trojan, Denial of Services attacks and other intrusions. The analysis can exhibit other vulnerabilities that can be introduced from patch and updates or from errors on Server, Router and Firewall.
Network Penetration Test briefly:
- Mostly exposed systems are analyzed for vulnerabilities from the outside or the inside of the network.
- Identified vulnerabilities are then exploited in order to violate the network perimeter.
- Internal systems are inspected for additional vulnerabilities that allow to obtain further access to data and infrastructures.
- This process is repeated as long as it carries results.
Specifications of the Network Penetration Test service
The Network Penetration Test service is performed by skilled professionals according to internationally recognized methodologies, such as OSSTMM (Open Source Security Testing Methodology Manual, an Open Source guideline for the execution of security tests for infrastructures and cyber assets), suitable for the client's specific needs and for the attack area.
Each ISGroup service is personalized according to client's needs and can be integrated with our other services and products. A NPT can focus on purely technical items but can even be extended to people, processes (Social Engineering) and physical security aspects. The client will decide which are the most important aspects of the activity and where to direct the effort of the attack team.
The most critical and technical tasks are carried out by senior researchers with the utmost professionalism and experience, in order to avoid damage to the infrastructure and the data. Due to the very nature of testing activities, a residual risk that cannot be eliminated nevertheless remains.
Testing activity results are summarized and presented in the Report, a simple and detailed document formed by three main sections.
From the outside (External PT) or the inside (Internal PT) of the network and with the desired level of information chosen by the client (Black Box, Grey Box and White Box) to simulate different attack scenarios.
Internal PT
Tests are performed from inside the corporate network.
External PT
Tests are performed from outside the corporate network.
Black Box
The tester receives no information or credentials about the infrastructure.
Grey Box
The tester receives partial information and access.
White Box
The tester receives complete information and privileged access.
The Report
You will receive a clear, detailed document divided into three areas.
Vulnerability Details
It consists in a technical part describing the discovered vulnerabilities and their impact in detail. It is dedicated to the Security Manager.
Remediation Plan
A technical section with detailed and precise instructions on how to resolve the identified problems. Dedicated to the System Administrator.
Scenarios for
Network Penetration Testing
External PT Black Box
Simulates an opportunistic or external attacker, such as a competitor, without company information or access credentials.
Internal PT Black Box
Simulates an attacker with physical access, such as a consultant or meeting-room visitor, or remote access through a compromised workstation.
External PT White Box
Simulates the compromise of an externally exposed component to determine how far an attacker can move into the corporate infrastructure.
Internal PT Grey Box
Simulates an internal attacker with information and access to parts of the infrastructure to determine the level of access that can be obtained to critical components.
Wireless Penetration Test
Attempts to compromise the wireless infrastructure by simulating an attacker physically close to a company building.
Assumed Breach
Starts from a standard domain account or a compromised workstation and tests whether an attacker can escalate privileges, move laterally and access critical Active Directory systems.
Show your commitment
At the end of the Network Penetration Test, you receive a signed document in Italian and English stating the activity, period and scope. Unlike the report, it contains no vulnerabilities or technical details, so you can give it to anyone who requests it without exposing sensitive information. It is included in the service.
Certificate of execution
IT / EN
- Client
- Activity
- Period
- Scope
ISGroup
Network Penetration Test
and compliance
NIS2
Assesses the effectiveness of cybersecurity measures in practice and identifies exposures, providing evidence for the procedures required by NIS2 Article 21(2)(f).
PCI DSS
Tests the external perimeter, internal network and segmentation of systems protecting payment data, as required by PCI DSS 4.0.1 Requirement 11.4.
DORA
Tests ICT networks and systems and documents the results for the digital operational resilience testing programme under DORA Articles 24-25.
ISO/IEC 27001
Identifies exploitable technical vulnerabilities and documents remediation priorities in support of ISO/IEC 27001:2022 control A.8.8.
Public-sector cloud
Assesses the exposure and resilience of cloud infrastructures and services for public administrations and documents the technical results.
GDPR
Tests security measures for networks processing personal data and produces technical results supporting GDPR Article 32(1)(d).
Frequently asked questions about
Network Penetration Testing
What is a Network Penetration Test?
A Network Penetration Test assesses the security of a network by simulating a controlled attack: it looks for vulnerabilities in exposed systems, tries to break through the perimeter and checks which internal systems can then be reached within the agreed scope.
What is the difference between internal and external testing, Black Box, Grey Box and White Box?
External testing starts from the Internet, internal testing from the corporate network; Black Box, Grey Box and White Box indicate how much information and access the tester receives. For example, an external Black Box test simulates an attacker with no information or credentials, an internal Grey Box test a malicious employee, while an external White Box test starts from the agreed compromise of an exposed component to measure access to the rest of the infrastructure. The combination is chosen according to the scenario to be verified.
How is it different from a Vulnerability Assessment or an application test?
A Network Penetration Test exploits network vulnerabilities to check how far an attacker can get. A Vulnerability Assessment identifies and evaluates vulnerabilities without the same exploitation; for websites, portals and APIs the dedicated service is the Web Application Penetration Test.
Can the test include the wireless network, people and physical security?
A Network Penetration Test can include the wireless network, people and processes through Social Engineering, and physical security, when these aspects are included in the agreed scope and in the proposal.
What does the Network Penetration Test report contain?
The report describes the vulnerabilities found, their impact and instructions to fix them. On request you can see an anonymised sample report.
How much does a Network Penetration Test cost and how long does it take?
The cost and duration of a Network Penetration Test are stated in the proposal once the scope is defined: systems and networks included, internal or external testing, level of information provided and any wireless, Social Engineering or physical security components.
Shape your security priorities into a tailored proposal