Positive Technologies today issued a new research report analyzing results of the company’s penetration testing¹ projects caried out in the second half of 2020 and first half of 2021. In 93% of cases, an external attacker can breach an organization’s network perimeter and gain access to local network resources, and it takes an average of two days to penetrate a company's internal network. In 100% of companies analyzed, an insider can gain full control over the infrastructure. 

The study was conducted among financial organizations (29%), fuel and energy organizations (18%), government (16%), industrial (16%), IT companies (13%), and other sectors.

During the assessment of protection against external attacks, Positive Technologies experts managed to breach the network perimeter in 93% of cases. According to the company's researchers, this figure has remained high for many years, confirming that criminals are able to breach almost any corporate infrastructure.

Ekaterina Kilyusheva, Head of Research and Analytics, Positive Technologies, says: "In 20% of our pentesting projects, clients asked us to check what unacceptable events might be feasible as a result of a cyberattack. These organizations identified an average of six unacceptable events each, and our pentesters set out to trigger those. According to our customers, events related to the disruption of technological processes and the provision of services, as well as the theft of funds and important information pose the greatest danger. In total, Positive Technologies pentesters confirmed the feasibility of 71% of these unacceptable events.² Our researchers also found that a criminal would need no more than a month to conduct an attack which would lead to the triggering of an unacceptable event. And attacks on some systems can be developed in a matter of days."

Despite the fact that financial organizations are considered to be among the most protected companies, as part of the verification of unacceptable events in each of the banks we tested, our specialists managed to perform actions that could let criminals disrupt the bank's business processes and affect the quality of the services provided. For example, they obtained access to an ATM management system, which could allow attackers to steal funds.

An attacker's path from external networks to target systems begins with breaching the network perimeter. According to our research, on average, it takes two days to penetrate a company's internal network. Credential compromise is the main way criminals can penetrate a corporate network (71% of companies), primarily because of simple passwords used, including for accounts used for system administration.

An attacker who has the credentials with domain administrator privileges can obtain many other credentials for lateral movement across the corporate network and access to key computers and servers. Administration, virtualization, protection, or monitoring tools often help an intruder gain access to isolated network segments. According to the study, most organizations have no segmentation of the network by business processes, and this allows attackers to develop several attack vectors simultaneously, and trigger several of a company’s unacceptable events.

Ekaterina Kilyusheva added that: "In order to build an effective protection system, it is necessary to understand what unacceptable events are relevant for a particular company. Going down the path of the business process from unacceptable events to target and key systems, it is possible to track their relationships and determine the sequence of protection measures in use. To make it more difficult for an attacker to advance inside the corporate network toward the target systems, there are a number of interchangeable and complementary measures organizations can take, including separation of business processes, configuration of security control, enhanced monitoring, and lengthening of the attack chain. The choice of which technology solutions to use should be based on the company's capabilities and infrastructure."

Access a full copy of the report at https://www.ptsecurity.com/ww-en/analytics/pentests-2021-attack-scenarios/

1. The scope of the study included 45 projects for which clients consented to use of results and publication of depersonalized data. The projects were carried out in the second half of 2020 and the first half of 2021.
2. Verification of unacceptable events is performed according to predefined criteria. The testing is carried out in real corporate infrastructure and is terminated one step before the occurrence of an unacceptable event without harming business processes.