As businesses shift to hybrid and remote workplaces, penetration testing and red team engagements have to adapt. Enterprise-grade remote penetration testing and remote red team assessments address the new risks while keeping the rigor of traditional security testing.
What Is Remote Penetration Testing?
Remote penetration testing is a security assessment performed without testers on your premises. External testing runs from the internet. Internal testing runs through a physical implant, a virtual implant, or both, so testers can assess your internal network without traveling to it. Together, the two phases allow a full offensive security test to be performed remotely.
Why Does Hybrid and Remote Work Change Penetration Testing?
Companies that move to remote or hybrid work rely more on collaboration and communication platforms (such as Office365, Zoom, Slack, or Google Workspace), remote desktop software, externally exposed VPNs, email, and endpoint security. More remote technology gives attackers a larger attack surface. Organizations that want to evaluate their cyber resilience should look for a partner whose tactics, techniques, and procedures (TTPs) address that larger surface, especially when testing from an external perspective.
What Are the Benefits of Remote Penetration Testing?
Realistic coverage
Testers can emulate how an adversary would take advantage of the attack surface remote work opens, while still performing traditional penetration testing.
Lower overhead
Performing all testing remotely removes travel costs and other engagement overhead, and saves time and effort.
What Should an External Remote Penetration Test Include?
External testing should use TTPs that reflect how modern attackers reach a hybrid workforce, all aimed at pivoting from external testing to internal access:
- Advanced social engineering campaigns (phishing, smishing, and social media-based)
- Direct use of credentials exposed in password breaches
- Advanced Persistent Threat (APT) style password spraying: low and slow, with IP address rotation
- Multi-factor authentication (MFA) defeats
How Do You Test from an Internal Perspective Without Being Onsite?
Remote attack platforms should deliver parity between the external and internal phases of an engagement. A comprehensive offensive security test can be performed remotely using physical implants, virtual implants, or both.
At Echelon, we provide physical implant-based remote penetration testing through our proprietary HARPI (Hardened, Advanced Remote Penetration Implant) platform. Organizations can run comprehensive remote security assessments without onsite personnel, and both internal and external networks are tested.
How Does HARPI Support Remote Internal Testing?
1. It tests your security against a physical access scenario
Your organization is only as secure as its most accessible infrastructure. A physical implant-based test lets you test against a physical access scenario. HARPI uses the same tactics a sophisticated threat actor would use to keep a physical presence in your business without being there. It takes seconds to plug in, and its small footprint makes it easy to conceal. That makes it a way to confirm your internal security controls can stop a real attack that uses the same tactics.
2. It supports black, gray, and white box testing
Because HARPI is small, it can be concealed for tests where the security team has varying levels of knowledge about the engagement. We can take a stealthy approach that relies on observation and covert techniques, or turn up the “noise” for a more direct, penetration-test-style approach with deep scanning.
3. It tests Network Access Control (NAC) capabilities
HARPI plugs into your network by ethernet, but it connects back to Echelon’s infrastructure through an out-of-band channel. That keeps our access in place regardless of NAC solutions, which we can then attempt to bypass. The alternate channel also lets us use the platform’s built-in wireless radio to scan for open Wi-Fi networks, which tests another potential attack vector.
4. It tests network ingress and egress
HARPI’s multiple connections let us test ingress and egress using both in-band and out-of-band methods. You learn what data can move in and out of your network, how much can be transferred, and whether your data loss prevention (DLP) controls stop sensitive data from leaving.
5. It allows sophisticated attacks without a human presence
Attacks such as hash relaying, internal password spraying, and custom scenarios tailored to your organization can run without sending a team to your location. Implant-based testing also allows “convergence” scenarios, where an internal and external test run at the same time until the external test catches up to the internal one, with internal progress continuing throughout. That avoids running the two phases one after the other.
How Does Echelon Secure Its Implants and Infrastructure?
Security work is sensitive, and we take your trust seriously. We secure our implants and cloud infrastructure so our tests can only improve your security.
Implant Security
- HARPI connects back to our cloud infrastructure through a one-way tunnel. Our operators can have interactive access to the implant, but the implant cannot open interactive sessions with our cloud infrastructure. If HARPI were compromised, that would not lead to a compromise of client data in the cloud.
- No CI/PII is stored on HARPI, and none is accessed or transferred unless you specifically request it. Operators are trained to alert Trusted Agents if they discover CI/PII and to proceed as advised.
- All inbound and outbound communications are encrypted, and all authentication is key-based. A compromised implant is not a compromise of client assets.
Infrastructure Security
Our infrastructure sits behind a VPN that requires MFA, and all internal infrastructure is managed through separate accounts that follow the principle of least privilege. We regularly run internal penetration tests against our own infrastructure, so we hold ourselves to the same standard as our clients.
Next Steps
Hybrid and remote work have expanded the attack surface, so organizations should adopt advanced remote penetration testing and red team engagement strategies to find vulnerabilities before attackers do. Talk to Echelon about implant-based remote security assessments.
FAQs
What Is Remote Penetration Testing?
Remote penetration testing is a security assessment performed without testers on your premises. External tests run from the internet. Internal tests run through a physical implant, a virtual implant, or both, so testers can assess internal and external networks without traveling to your site.
Can An Internal Network Penetration Test Be Done Remotely?
Yes. A comprehensive offensive security test can be performed remotely using physical implants, virtual implants, or both. Echelon’s HARPI platform plugs into your network by ethernet and connects back to Echelon’s infrastructure through an out-of-band channel, so no onsite personnel are needed.
What Can a Remote Penetration Test Include?
External testing can include social engineering campaigns, use of breached credentials, low-and-slow password spraying, and MFA defeats, aimed at reaching internal access. Internal testing can include hash relaying, internal password spraying, NAC bypass attempts, ingress and egress testing, and custom scenarios.
What Are the Benefits of Remote Penetration Testing?
Remote testing emulates how an adversary would exploit the attack surface that remote work creates, while keeping traditional penetration testing available. It also removes travel costs and other engagement overhead, which saves time and effort.
Is Client Data Safe During an Implant-Based Test?
HARPI is designed so that a compromised implant does not compromise client assets. It opens only a one-way tunnel to Echelon’s infrastructure, stores no CI/PII, encrypts communications, and uses key-based authentication. Operators alert Trusted Agents if they discover CI/PII.