Firewalls Penetration Testing for a US Consumer Reporting Agency

Summary

A US licensed consumer reporting agency — a nationwide provider of pre-employment screening services — had two IP addresses with outward-facing hardware firewalls and wanted their configuration security level checked for potential vulnerabilities. INNERLUXES performed black-box penetration testing, bypassed the firewalls, found no vulnerabilities, and rated the firewalls' security as high.

About the Customer

The Customer is a US licensed consumer reporting agency — a nationwide provider of pre-employment screening services, including criminal-records and credit-history checks.

The Challenge

The Customer had two IP addresses with outward-facing hardware firewalls. It turned to INNERLUXES as a penetration testing provider to check the security level of the firewalls' configuration and find all potential vulnerabilities.

The Solution

INNERLUXES performed penetration testing of the Customer's firewalls using the black-box model (simulating a real attacker with limited knowledge of the network), based on the OWASP Top 10 methodology. The security engineers' main tasks were:

• Bypassing the firewalls.
• Attempting to identify the services running behind the firewalls.

INNERLUXES identified the types of firewall hardware with about 90% accuracy and managed to bypass them. No vulnerabilities were revealed during the penetration testing. The engineers detected several Transmission Control Protocol (TCP) ports; nevertheless, the Customer's firewalls provided a sufficient level of security to prevent the engineers from accurately identifying the particular types of services running behind them. The report INNERLUXES provided contained the list of detected TCP ports and a characterization of how the firewalls behaved during penetration testing.

The Results

• INNERLUXES evaluated the security level of the Customer's hardware firewalls as high.
• The Customer received a detailed description of what was done during the black-box penetration testing.
• INNERLUXES also provided a characterization of how the tested firewalls behaved.

Technologies and Tools

Metasploit, Nessus, Nmap, Tor.