Re: Securing pgm folder on IFS

[Pete Helgren <pete@xxxxxxxxxx>]

Actually, in most cases the pen testing will be done from within and 
outside.  That is primarily because most organizations assume they 
cannot be breached so don't do diligence on their internal security.   
Poor network segmentation, wide open ports, poorly secured internal 
servers, etc  are all "gold" to the bad guys. Most external pen testing 
turns up little these days if the systems are properly patched and 
secured with the most rudimentary policies an procedures.  The "easy" 
part of pen testing is using social engineering to get a payload 
established on an internal system.  Then you can rock and roll in most 
cases....hence the internal testing.

Pete Helgren
www.petesworkshop.com
GIAC Secure Software Programmer-Java
GIAC Cloud Penetration Tester
AWS Certified Cloud Practitioner
Microsoft Certified: Azure Fundamentals

On 10/23/2023 2:07 PM, Patrik Schindler wrote:
> Hello Jerry,
>
> Am 23.10.2023 um 20:26 schrieb Jerry Draper <midrangel@xxxxxxxxxxxxx>:
>
> > Nothing is accessible from the public internet.
> >
> > The IBM I is behind a solid fire wall.
> >
> > The penetration test was from inside our network as agreed to by mgmt.
> >
> > We were NOT informed to make it a fair test.
> Ah, thanks goodness!!
>
> Usually pentesting is done from outside, that's what made me wonder.
>
> :wq! PoC