What is an External Network Penetration Test?

If you’re seeking a penetration test (pen test), the first question you’ll need to answer is, what kind?

Just like cybersecurity threats can come in many different forms, so do pen tests. But which form do you need? Do you need more than one?

If you’re not sure, don’t worry. Schellman performs 200+ pen tests a year of varying types, so we’re proficient in administering a diverse suite of these services.

But in this article, we’re going to focus on one, specific kind—the external network pen test. We’ll detail what it does and how to get started, among other things.

For those of you considering a pen test, you’ll understand whether this type is right for your organization, or if you should keep browsing to find your fit.

What is the Purpose of an External Network Penetration Test?

When contemplating the definition of “penetration test,” the external variety might come closest to a direct translation.

An external network pen test is designed to discover and exploit vulnerabilities in hosts accessible via the Internet. Your pen test team acts as an attacker on the open Internet and attempts to breach those web-facing assets you have by identifying vulnerabilities and misconfigurations.

Using different techniques like port scans, vulnerability scans, reviews of weak or default configurations, and manual attempts to exploit any vulnerability identified on all in-scope hosts, your pen test team will work to push through where they can in order to gain access to your supporting infrastructure or service.

But that’s the extent of it. If a high-risk issue has been identified, your pen test team should document the steps to reproduce the issue with supporting screenshots when they provide you with a status update. If they do happen to gain access to the internal network, no further action is taken to pivot deeper. You’re left with a list of findings that need remediation.

Where to Start for Your External Network Penetration Test

Knowing all that, it’s possible you’re interested in understanding where your outward defenses may need shoring up. But where would you start? With the scope of what you’d like tested. Two different assessment types are commonly requested:

• Shared Knowledge (Grey Box) Assessment:
  • You would provide a list of hosts (public IP addresses or domains) and your tester will only test against those approved in-scope hosts.
  • This is Schellman’s recommended approach.
• Zero Knowledge (Black Box) Assessment
  • Rather than you provide a list, your tester would perform their own recon to discover all Internet-facing assets. They would then give you a list of their discovered hosts that you would need to approve before the start of any testing.
  • This method takes more time, as you’ll still need to verify that the hosts identified belong to your company before active testing can begin. 

Again, it’s our opinion that a Grey Box assessment provides better value in time and overall results, but you should understand both options just in case.

Though approved hosts for testing are ultimately up to you, we do not suggest you restrict your scope or exclude hosts from any type of pen test. 

While you may opt to engage in this testing just for the sake of your cybersecurity, if it’s for a greater compliance initiative, a wider scope is better than a narrower one. Limitations could lead to you needing another assessment so that previously excluded hosts can be included.

How Long Will Your External Network Penetration Test Take?

While there are many intricacies in pen test timing, typically, external network pen tests are completed within 1 week if less than 50 hosts are in scope.

From there, the timeline is extended as more hosts are added.

Additional Matters Concerning Your External Network Penetration Test

Despite their typical brevity in comparison with some of our other services, pen tests are still complicated. Here are two tips to maximize your experience during an external network pen test:

• Don’t keep it a secret.
  • Your pen test team is there to help. Let your internal security team(s) (Security Operations Center (SOC) or Network Operations Center (NOC)) know that an external network pen test will be happening and provide them with the public IP addresses the team will be using so your people know who’s poking around.
    • If you work with Schellman, these will be listed in the authorization letter.
  • (For transparency’s sake, there are other kinds of pen tests where your personnel are kept in the dark. External network pen testing is just not one of them.)
• Prepare your Web Application Firewall (WAF) or Intrusion Prevention Device (IPS).
  • If you have technical security controls in place that could block your tester’s traffic during testing, you should preemptively allow that traffic to pass these controls.
  • While real world attackers have unlimited time to identify issues and come up with WAF bypasses, a pen test is limited to a specific timeframe. Help your testers help you and temporarily clear these obstacles so that they can identify the most issues possible within the time they have. 

You’ll of course have options when choosing a pen test team. But if you’re considering Schellman to do your external network pen test, here are some things you should know:

• Schellman does not perform Distributed Denial of Service (DDoS) attacks. When we find vulnerabilities that result in likely Denial of Service (DoS) conditions, we typically just verify them without exploiting them.
• Only manually verified findings will be included in our final report. With us, there will be no false positives. 

Regardless of who you work with, remember—the goal of this kind of engagement is not for your tester to be stealthy or stay undetected. Rather, it’s to highlight as many of your issues as possible and provide actionable feedback within the limited timeframe available.

Next Steps for Your External Network Penetration Test

An external network pen test can prove hugely beneficial when assessing your current cybersecurity defenses. Acting as a malicious attacker would be, approaching from the outside, your pen test team can help you determine where you’re vulnerable so that you can plug any discovered gaps.

Now that you know exactly what an external test is meant to do, you may be seriously considering it. As you mull over the decision, make sure you consume our other content that can help clarify different facets of pen testing:

• What Is Schellman’s Penetration Test Project Process?
• What Does a Pen Test Cost?

If you have more specific questions, please feel free to contact us. Our team would be happy to speak with you regarding all the different kinds of pen test services we provide and answer any questions regarding your environment that you may have (as detailed through our scoping questionnaire that we would provide you to complete).