Cybersecurity
The first 24 hours of a cyber incident: what to do, and what not to
Decisions made in the first hours of an incident decide how much is lost, how long recovery takes and whether you can later explain what happened.
Cybersecurity
External and internal penetration testing: what each one tells you
An external test shows what the internet can reach. An internal test shows what happens after the first laptop is compromised, which is where most serious incidents are decided.
Penetration tests are often bought as a yearly compliance item with a fixed scope: the public IP addresses and the website. That test has value, but on its own it answers only one question. Knowing what each type of test covers helps you spend the budget where the risk is.
External testing
An external test looks at everything reachable from the internet: websites, VPN gateways, email services, remote access portals, exposed management interfaces and cloud services. Testers look for unpatched software, weak authentication, misconfiguration and forgotten systems. The last category is common: a test server from an old project, still online, still using default credentials.
Internal testing
An internal test starts from inside the network, as if an employee's laptop had been taken over through a phishing email. From there, testers try to move sideways and gain higher privileges. In Windows environments, the usual path runs through Active Directory: weak service account passwords, excessive permissions, old protocols left enabled, and credentials cached on machines. A test often ends with domain administrator access, and the report shows the exact chain of steps that led there.
Segmentation testing
Where networks are separated for a reason, such as cardholder data, operational technology or a guest network, a test should confirm that the separation actually holds. PCI DSS requires this for payment environments, alongside internal and external tests at least once a year and after significant changes.
Getting value from the test
- agree rules of engagement in writing: scope, timing, contacts and what is off limits;
- tell the testers about recent changes, so they test what matters;
- ask for findings ranked by real risk, with steps to reproduce them;
- book a retest, so you know the fixes worked.
When to go further
If your controls are mature, a red team exercise tests detection and response as well as prevention, by pursuing a set objective over weeks rather than listing vulnerabilities over days.
Our offensive security team carries out external, internal, web, mobile and segmentation testing, and red team exercises, with retesting included.
