How a hacker will access your network

It has become rather cliché to say that data is now more valuable than oil, but for many organisations, it’s absolutely true. Whether it’s customer data or intellectual property, that information is a business asset and, like any other asset, keeping it secure should be a high priority.

Why would a hacker want to access your network?

There are usually five main motives for why hackers attempt to break into computers and networks:

Financial gain – Some hackers will be focusing on criminal financial gain, specifically stealing credit card numbers or manipulating banking systems.

Reputation – Many hackers thrive on increasing their reputation within the hacker community. That’s why some will leave their ‘handles’ or some other evidence as proof that they were involved in a specific hack. Occasionally, they will do it just for fun.

Corporate espionage – Competition can be tough and sometimes companies try to get leverage over their competitors in illegal ways. Hackers can be hired to access information on products or services that can be stolen or used as leverage.

State-sponsored attacks – Like corporate espionage, nation states use hackers as a mean to access information about other countries.

Revenge – An insider threat is the hardest to predict and the hardest to defend against, which is why 43% of data breaches (according to McAfee) are committed by someone known to a business or person.

Read more:Are you prepared for a cyber attack?
Read more:To hack back or not to hack back

How do hackers access a network/web application?

Part of a Penetration Tester’s job is to keep up-to-date with current techniques and tools, particularly as threat actors are always updating their approaches. However, when a Penetration Tester is conducting a test, they go through specific process, which we have simplified into five phases:

1. Reconnaissance – Gathering important information on a target system that can be used to better attack the target. For example, search engines can be used to find data that can be used in a social engineering attack.
2. Scanning – Using technical tools to increase knowledge of the system. For example, Nmap (an industry standard tool) can be used to scan for open ports.
3. Gaining access – Using the data gathered in the reconnaissance and scanning phases, so the attacker can use a payload—usually infecting the network with malware—to exploit the targeted system.
4. Maintaining access – Gaining access is one thing, but maintaining access is just as important in order to gather as much data as possible. Many organisations won’t find the compromise for an extended period of time.
5. Covering tracks – The attacker must clear any trace of compromising the victim system, any type of data gathered, log events, in order to remain anonymous and avoid prosecution.

Once an attacker has found their way in, they will ‘pivot’ and try to gain access to other machines throughout the network.

Read more: Red team activities
Read more:Cyber Incident Response and response recovery

How does a penetration test help mitigate the risk?

A penetration test is an authorised simulated cyber-attack on a computer system, performed to evaluate the security of the system.

The test is performed to identify both weaknesses (also referred to as vulnerabilities), including the potential for unauthorised parties to gain access to the system’s features and data, as well as strengths, enabling a full risk assessment to be completed.

If you know what your network weaknesses are, they can be patched or monitored, making it much harder for an intruder to find their way in through a gap.

PGI’s Penetration Testing team understand how hackers operate and have worked with organisations across a range of industries to help them identify exploitable vulnerabilities. If you’re ready to improve your security posture talk to us today.