Internal Penetration Testing: An Audit from the Ransomware Perspective

Internal penetration testing, or internal pentesting, is a critical evaluation of computer systems’ security from within the organization. Unlike external pentesting, which simulates attacks from outside, internal pentesting considers scenarios where an attacker already has access to the internal network, either through physical access or an initial compromise, such as a successful phishing attack.

Objective of Internal Pentesting

The main objective of internal pentesting is to identify and evaluate vulnerabilities and weaknesses within the internal network that could be exploited by an attacker with network access. This includes evaluating access controls, network segmentation, security policies, and how sensitive information is protected.

The Ransomware Perspective

In the context of ransomware, internal pentesting becomes even more relevant. Ransomware attackers aim to embed themselves deeply within the network before launching the attack to maximize their impact. Internal pentesting can simulate this approach to identify how ransomware could spread through the network, which data could be encrypted, and how incident response mechanisms can be improved.

Key Steps of Internal Pentesting

• Information Gathering: Understand the network structure, critical assets, and potential entry points.
• Control Evaluation: Test the robustness of access controls, network segmentation mechanisms, and security policies.
• Attack Simulation: Conduct controlled attacks to identify access paths and vulnerabilities exploited by ransomware.
• Post-Exploitation Analysis: Assess the potential impact of a successful compromise and identify data at risk.
• Reporting and Improvement: Provide a detailed report of findings and recommend improvements to strengthen security.

Importance of Internal Pentesting

In an evolving threat landscape where ransomware attacks are becoming increasingly sophisticated with the advent of RAAS (Ransomware as a Service) platforms, internal pentesting is essential for preparing and fortifying an organization’s internal defenses. By proactively identifying weaknesses and testing defense mechanisms, organizations can improve their security posture and reduce the risk posed by ransomware.

What we actually look at in an Active Directory

In most companies, Active Directory is the heart of the IT environment: it decides who can log in where, with which rights. That makes it the attacker’s priority target once inside. An internal pentest looks in particular at:

• Rights relationships. Over time, a directory piles up nested groups, delegations and exceptions. Tools such as BloodHound, used by attackers and defenders alike, visualise these relationships and reveal paths from an ordinary account to administrative accounts.
• Service accounts. Often created years ago, with passwords that never change and more rights than they need.
• Legacy protocols. Some old authentication mechanisms stay enabled for compatibility even though they make lateral movement easier.
• Local administrator passwords. When they are identical on every machine, compromising one opens access to all the others.
• Directory-related services, such as an internal certificate authority, whose configuration is rarely reviewed after installation.

The fixes that matter most

An internal pentest report can contain dozens of findings. In practice, a handful of measures greatly reduce the risk of ransomware spreading:

• Separate administrative accounts. An administrator should never read email or browse the web with an account that has domain rights. The tiering model recommended by Microsoft and ANSSI formalises this separation.
• Make local administrator passwords unique, for example with Windows LAPS.
• Disable legacy protocols you no longer need, after checking no application still relies on them.
• Reduce service account rights and give them long passwords, or use managed service accounts.
• Segment the network so a user workstation cannot reach administration servers directly.
• Protect backups: at least one offline or immutable copy, out of reach of domain accounts.

Not all of these require a big budget. The pentest’s job is to tell you which ones apply to your environment, and in what order.