Testing Perspectives

Internal testing and assessment design and validation are intended to "work from the internal network and assume the identity of a trusted insider or an attacker who has penetrated the perimeter defenses," as NIST SP800-115 describes it.

The trusted insider could be a disgruntled employee whose authorization level provides the potential for damaging results if they decide to exploit a vulnerability.

An internal view of testing would reflect a system-level focus that is specified in NIST SP 800-115 to include, "application and service configuration, authentication, access control, and system hardening." An attacker that has "penetrated the perimeter defenses" may be masquerading as an internal user or may have otherwise attained access and is perceived as an insider.

Depending on test goals and objectives, the test assessor may be given access rights to a system or network that spans basic users to administrators.

Internal testing may include the assessor attempting to gain access that is additional to what is provisioned to network or system resources through privilege escalation.

Insider threats remain a significant source of compromise. In 2012, Carnegie Mellon University- Software Engineering (CMUSEI) published a seminal research paper on insider threats entitled, "Insider Threat Study: Illicit Cyber Activity Involving Fraud in the U.S. Financial Sector" The research was funded by the Department of Homeland Security (DHS), Science and Technology Directorate (S&T) in collaboration with the U.S. Secret Service (USSS). The empirical research done during 2005-2012 established that in 80 major cases of financial fraud, 67 were internal actors (employees) and 13 were external (non-employees). The subsequent work by the Insider Threat Center at CMUSEI has documented more than a thousand case studies of insider compromise.

External testing is performed with the perspective of an untrusted individual outside the perimeter. The activities performed from this perspective are designed to identify weakness, which could be exploited from outside the organization's control environment. Generally, if both external and internal testing is to be performed, the test plan should require the external testing be performed first, as the information available to support insider testing would generally be greater than would be available from an external perspective.

The distinction between internal and external testing is becoming increasingly difficult to establish. The adoption of zero-trust security models and deperimeterization practices are moving to erase the concept of insiders versus outsiders - and applying security controls solely based on the privileges necessary for an individual to perform a task under specific circumstances.