What is an External Penetration Test? External Pen testing explained

What is an External Penetration Test?

External Penetration Testing is a combination of manual and automated testing of a client’s public facing systems by simulating a malicious attacker on the internet. Public facing systems include servers that have public IP addresses which can be accessed by users on the internet – for example websites and email servers.

Tesserent has extensive experience in using external infrastructure testing methodologies to look for various security flaws. These methodologies include:

• identifying firewall misconfigurations,
• vulnerability identification and exploitation,
• locating and compromising administrative services and interfaces,
• other attack techniques.

The testing will determine potential attack vectors by which a system could be compromised remotely. Tesserent will present the findings with reproduction steps, along with recommendations around remediation.

We recommend External Pen tests be conducted annually, or at least after any major network changes to internet-facing systems and services.

Why do you need External Penetration Testing?

As you would regularly check your front door locks and office alarms to ensure they are working, security101 for networks is External Penetration Testing – to ensure that no threat actors can get into your environment via your network. Engaging in Tesserent's External Penetration testing services is the essential first step in your cybersecurity journey.

Reliance on next generation firewalls and trusted cloud security providers to host and protect companies’ infrastructure has led to a sometimes false sense of security in the protection provided. Vulnerabilities are not necessarily an issue with the product/service, but often human error around misconfiguration.

We recommend annual testing, but as your internal IT team matures, and if the network environment is mostly consistent year on year, testing on an ad hoc basis may be appropriate unless otherwise specified by compliance requirements.

Many companies are governed by compliance and regulatory obligations, for example, APRA, and are required to perform independent physical penetration testing on an annual basis. The objective is to identify vulnerabilities that could result in unauthorised disclosure, misuse, alteration or destruction of confidential information, including Non-Public Personal Information (NPPI).

What do you gain from External Penetration Testing?

• Visibility as to how a remote attacker could compromise your public-facing systems.
• Insight into how to prioritise your security spend based on actual risks.
• Understanding as to how an attack might occur providing an opportunity to formulate an incident response plan that is relative to your likely risks.
• Uplifting of the security capabilities of your IT team through our recommended remediation.
• Confidence that you are closer to achieving your business’s compliance and regulation requirements.

Our methodology

Tesserent has extensive experience with complex architecture designs gained through years of experience working with clients of all sizes, industries and structures. As we are watching threat activity on a daily basis, Tesserent is constantly learning about the latest attack techniques, exploits and security flaws. Our methodology covers:

• Reconnaissance – Tesserent will perform information gathering before any simulated attacks are actioned.
• Vulnerability Detection – Tesserent will perform vulnerability detection to discover flaws in systems, networks and applications which can then be leveraged by the consultant.
• Exploitation – Tesserent will try to actively exploit security weaknesses identified in the vulnerability detection phase. To achieve this Tesserenty may use publicly available, in-house developed or commercially available exploit kits.
• Privilege Escalation – After a target has been successfully compromised, Tesserent will try to gain a further foothold within the organisation, this may involve gaining higher privileges in the system or potentially gaining access to other systems on the internal network. The end goal is to gain complete control of the network.
• Data Exfiltration – Based on the scope of the project, Tesserent may be required to perform data extraction. To achieve this the consultant will use a set of tools and techniques in order to extract specific data from the organisation’s network.
• Reporting and Delivery – Tesserent will document, in priority order, the issues identified, along with recommendations for every issue identified. These are presented in a clear and meaningful way for both a technical and a business audience.

How do we scope and price a Penetration Test?

Each engagement is unique and tailored to your environment, and the agreed scope of works for testing. Our penetration testing services is largely priced based on the estimated number of days required to complete the engagement.

We have conducted tens of thousands of external penetration tests over the last two decades. Contact us today to find out how we can help.