Contact Us

Contact Us

Please get in touch using the form below

I prefer to be contacted by:
View our privacy policy
Book a CREST penetration test today. Get a quote.

Overview

What is network penetration testing?

Secure and robust infrastructure is fundamental to your organisation’s cyber security. Given the financial costs of suffering a breach, it is advisable to perform regular internal and external penetration testing to identify and help address vulnerabilities.

Redscan’s CREST-accredited team, including Certified Infrastructure Testers (CCT INF), have extensive network penetration testing experience, helping organisations to identify exposures across on-premises and cloud environments.

Testing types

Types of network penetration testing

Network penetration testing, also known as Infrastructure penetration testing, can be performed from two perspectives: inside and outside your organisation’s network perimeter.

Internal network penetration testing

An internal network pen test is performed to help gauge what an attacker could achieve with initial access to a network. An internal network pen test can mirror insider threats, such as employees intentionally or unintentionally performing malicious actions.

External network penetration testing

An external network pen test is designed to test the effectiveness of perimeter security controls to prevent and detect attacks as well as identifying weaknesses in internet-facing assets such as web, mail and FTP servers.

Approach

Our approach to infrastructure pen testing

A Redscan network pen test follows a tried and tested methodology to identify, exploit and help address vulnerabilities. Here’s how we approach an external network assessment:

01. Scoping
02. Reconnaissance and intelligence gathering
03. Active scanning and vulnerability analysis
04. Exploitation
05. Reporting
01.

Scoping

Redscan’s network and infrastructure testing experts work with you to define any networks and assets in scope and devise an appropriate assessment strategy.

02.

Reconnaissance and intelligence gathering

Our network penetration testers use the latest intelligence gathering techniques to uncover security and technical information that could be used to help them access your network.

03.

Active scanning and vulnerability analysis

Using a combination of manual and automated tools, out testers identify security weaknesses and develop a strategy to exploit them.

04.

Exploitation

To obtain initial access to your network, our experienced network penetration testers exploit all identified vulnerabilities, but in a safe way that avoids damage and disruption.

05.

Reporting

Once a network assessment is complete, our testers document key findings and supply prioritised remediation guidance to help address any identified exposures.

Vulnerabilities

Vulnerabilities detected by our network penetration testing service

Insecure configuration parameters
Ineffective firewall rules
Unpatched systems
Software flaws
Weak encryption protocols
Inadequate security controls

FAQ

Frequently asked questions about infrastructure pen testing

What is the purpose of a network penetration test?

A network penetration test is a type of ethical hacking assessment designed to identify cyber security vulnerabilities that could be used to compromise on-premises and cloud environments. Network pen testing can include assessment of perimeter security controls as well as devices such as routers and switches.

Can an internal pen test be performed remotely?

In many scenarios, internal penetration tests can be performed remotely via a VPN connection, but it’s generally recommended that an internal pen test is performed on-premises. If your organisation’s network is segmented, you may need help to decide upon the best physical location for internal pen testing to be conducted.

How are pen test findings reported?

To help ensure that infrastructure pen test results are clearly communicated to technical and non-technical stakeholders, every Redscan penetration test includes a written report detailing all vulnerabilities discovered, the level of risk each vulnerability posed, the difficulty of exploitation and recommendations to assist swift remediation.

What is the difference between internal pen testing and external pen testing?

An internal pen test is performed within an organisation’s network, looking for vulnerabilities from the inside. An external pen test is conducted remotely, with an ethical hacker searching for security vulnerabilities in internet-facing assets such as web, mail and FTP servers.

What information is required to scope a network penetration test?

The information needed to scope an infrastructure penetration test is dependent upon whether an internal pen test or an external pen test is required. Information typically sought by a network pen test provider includes the total quantity of internal IPs and external IPs to be tested, subnets, and the number of physical locations.

Get an infrastructure pen test quote

Get in touch
A range of security assessment services

About

About our penetration testing services

Redscan’s CREST-accredited penetration testing services are designed to identify and safely exploit security vulnerabilities in infrastructure, systems and applications. As with Internal & External Penetration Testing, all our assessments are designed to pinpoint hidden security risks and provide the support and guidance needed to address them.

Expertise

Our security qualifications

Types of penetration test

Network infrastructure testing

Network infrastructure testing

Redscan rigorously investigates your network to identify and exploit a wide range of security vulnerabilities. This enables us to establish if assets such as data can be compromised, classify the risks posed to your overall cyber security, prioritise vulnerabilities to be addressed, and recommend actions to mitigate risks identified.

Wireless testing

Wireless testing

Unsecured wireless networks can enable attackers to enter your network and steal valuable data. Wireless penetration testing identifies vulnerabilities, quantifies the damage these could cause and determines how they should be remediated.

Application and API security review

Application and API security review

Vulnerabilities contained within software are commonly exploited by cybercriminals and are easily introduced by under-pressure programmers. Redscan’s ethical hackers conduct automated and manual penetration tests to assess backend application logic and software and API source code.

Remote working assessment

Remote working assessment

If your organisation is embracing mass remote working for the first time, it’s important to ensure that it is doing so securely. Ensure your networks, applications and devices are protected and fully secured with a custom remote working security assessment.

Web application security testing

Web application security testing

Web applications play a vital role in business success and are an attractive target for cybercriminals. Redscan’s ethical hacking services include website and web app penetration testing to identify vulnerabilities including SQL injection and cross-site scripting problems plus flaws in application logic and session management flows.

Social engineering

Social engineering

People continue to be one of the weakest links in an organisation’s cyber security. Redscan’s social engineering pen test service includes a range of email phishing engagements designed to assess the ability of your systems and personnel to detect and respond to a simulated attack exercise.

Mobile security testing

Mobile security testing

Mobile app usage is on the rise, with more and more companies enabling customers to conveniently access their services via tablets and smartphones. Redscan carries out in-depth mobile application assessments based on the latest development frameworks and security testing tools.

Firewall configuration review

Firewall configuration review

Firewall rule sets can quickly become outdated. Redscan’s penetration testers can detect unsafe configurations and recommend changes to optimise security and throughput.

Meet some of our team

“When choosing a pen test provider, you need to be confident they will deliver what they promise. At Redscan, as a CREST-accredited company, we always maintain the highest technical, legal and ethical standards. Transparency and integrity are key to everything we do.”
Jed
Head of pentesting
“Our remit is to think creatively to find solutions that will help keep your organisation more secure. We’re continually improving our knowledge of how adversaries think so that we can better identify security weaknesses and enhance detection of new and emerging threats.”
Faisal
Security Consultant
“We aim to make sure that your organisation gets the best possible value from a penetration test. We'll talk you through the assessment at every stage and answer any questions you might have along the way.”  

 

Philip
Security Consultant
“We’re focused on delivering the best pen testing security outcomes for our clients. That’s why we’ll work with your organisation every step of the way – from initial scoping of requirements through to remediating vulnerabilities. Communication is a vital part of our approach and we’ll work hard to help you achieve the results you need.”
Nima
Security Consultant

Why choose Redscan?

A trusted partner for pen testing

  • One of the highest accredited UK pentesting companies
  • A deep understanding of how hackers operate
  • In-depth threat analysis and advice you can trust
  • Complete post-test care for effective risk remediation
  • Multi award-winning offensive security services
  • Avg. >9/10 customer satisfaction, 95% retention rate

            

Get a quick quote

Complete the form for a prompt response from our team.

I prefer to be contacted by:
View our privacy policy

Resources

Discover our latest content and resources

From the blog
From the blog Case studies Latest news
30th September 2020
Redscan named in Gartner MDR Market Guide
Redscan is one of only two UK-based providers recognised in Gartner’s 2020 Market Guide for Managed Detection and Response. Read more in our press release.
30th September 2020
A fifth of government and enterprise users have unnecessary privileged access
New research suggests that over a third of government and enterprise users in the UK and the US have privileged access despite not needing it. An access policy of “least privilege” is best practice in cyber security and reduces the risk of insider threats.
28th September 2020
Redscan services now available via G-Cloud 12
To help public sector organisations reduce cyber security risk, Redscan's MDR and penetration testing services are now available on G-Cloud 12, the latest iteration of the UK government's digital marketplace, which went live today.  Read more
25th September 2020
Zerologon now being exploited in the wild
Microsoft has warned that attackers are now actively exploiting ‘Zerologon’, a critical vulnerability in the Windows Server Netlogon authentication process. Read Redscan’s Security Advisory to learn how to protect your organisation.