Penetration Test Report (Volkis): Company Name   Security Review and Phishing Campaign v1.0

™
Security Review & Phishing Campaign
PreparedforCompanyName,2January2023
Table of Contents
Executivesummary 3
Overview 5
Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Rootcauseanalysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Effectivesecuritypractices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Additionalrecommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
PhishingCampaign 8
Scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Microsoft365Review 14
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Multi-factorAuthenticationenabledforallusers . . . . . . . . . . . . . . . . . . . . . . . . 16
Multi-factorAuthenticationenforcedforGlobalAdmins . . . . . . . . . . . . . . . . . . . . 17
EnforcePasswordProtection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Externalmailforwardingrestricted . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
DKIMenabledforalldomains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Emailbouncemessageisnondescript . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
“onmicrosoft”emailaliasesremoved . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Calendarsarenotsharedexternally . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Officeadd-insrestricted . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
DMARCRecordsarepublished . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Appendices 30
AppendixA:Phishingcampaignresults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
AppendixB:Securityreviewmethodology . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
AppendixC:Webapplicationpenetrationtestingmethodology . . . . . . . . . . . . . . . . 33
AppendixD:Riskassessmentmethodology . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
AppendixE:Documentcontrol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
SecurityReview&PhishingCampaign-CompanyName Page2
Version1.0,released2January2023
Executive summary
CompanyNameengagedVolkistoaperformpenetrationtestingontheirinternet-facingwebapplica-
tion,performasecurityreviewofCompanyName’sMicrosoft365tenancyandsimulateaphishing
campaign.Thistestwasperformedonabesteffortbasis,whichaimstoperformasmuchtestingas
possiblewithinthescopedtimeframe.
Volkisusedthesamehackingtoolsthathackerswillusetoinvestigateandunderstandthescope,then
findandexploitidentifiedsecurityvulnerabilities.Thetestinginvestigatedsecurityvulnerabilitiesthat
couldpresentrisktoCompanyNamebyallowinganattackeraccesstosensitiveinformationsuchas
clientdata,tomanipulateapplicationprocesses,ortoaffecttheoperationsofCompanyName.
Volkisranaphishingsimulationagainst60CompanyNamestaff. Theconsultantcraftedanemail
thatsimulatedcommunicationfromastaffmemberaboutanewpartnershiptofacilitatealaptop
replacementprogram.TheuserwasencouragedtoclickthelinkandenterMicrosoft365credentials
toregisterfortheprogram.TheemailwasdeliberatelytargetedatCompanyNameusersratherthan
usingagenericphishingattempt,suchasanunpaidinvoice,totesttheuser’sabilitytospotattacks
againstthebusiness.
20%ofusersclickedtheprovidedlinkandapproximately8usersattemptedtoentercredentials.These
numbersarehigherthanaverageandindicatealackofawarenessandtrainingonhowtospotand
handlephishingemails.ProvidingInformationSecurityAwarenessTraining(ISAT)touserswillhelp
themtobetterprotectthemselvespersonallyandthebusinessbyencouragingsecurehabits.
CompanyName’sMicrosoft365tenancywasreviewedforsecuritymisconfigurationsthatamalicious
actormaybeabletoabuse.Itiscleareffortshavebeenmadetohardenthetenancyagainstattacks
howeverthereisroomforimprovementinmostareassuchasemailprotections(DKIM/DMARC)and
restrictionsonemailforwarding.
CompanyName’spublicpresenceislimitedwhichmakesitdifficultforattackerstoobtaininformation.
Fewprivateemailaddressesandnosensitiveinformationcouldbefoundusingcommontools.While
SecurityReview&PhishingCampaign-CompanyName Page3
Version1.0,released2January2023
somenecessaryportsareexposedtotheinternet,externalserviceswereeitherprotectedbyCloudflare
ornonresponsive.Breachedpassworddatabasesdidnotcontainanycleartextpasswords,andthe
passwordhashesthatwereavailable(fromCanva.combreachfrom2019)werenotabletobecracked
withinthetestingtimeframe.OverallCompanyName’sexternalfootprintiswellmanaged.
TheCompanyName’swebsiteimplementscommonWordPressattackmitigationsandisresilient
toattack. Duringthetime-frameoftheassessmentsomeout-of-datepluginswerefound,butno
vulnerabilitieswereidentified.
InordertoimprovethesecuritypostureofCompanyName,Volkisrecommends:
• PerformingaphishingsimulationdebriefwithusersandimplementingInformationSecurity
AwarenessTraining.
• AdditionalhardeningoftheMicrosoft365tenancyinlinewithrecommendationsprovided.
• ImplementingapatchmanagementpolicyforWordpresswebsite.
Formoreinformationaboutthisreport,theidentifiedvulnerabilities,andadditionalservicesthat
couldhelpyouinyoursecurityjourney,pleasecontactyourVolkisconsultant:
Contributor#1
• Email:Email#1
• Mobile:Ph#1
SecurityReview&PhishingCampaign-CompanyName Page4
Version1.0,released2January2023
Overview
CompanyNameengagedVolkistoperformasecurityreviewontheirInternetaccessiblewebapplica-
tions,andMicrosoft365tenancyaswellasperformaphishingcampaign.
Testingwasperformedovera5-daywindowonabesteffortbasis.Bestefforttestingaimstoperform
asmuchtestingaspossiblewithinthescopedtimeframe.
Scope
Thescopeofthetestincluded:
• Aphishingsimulationagainst60users
• AsecurityreviewofoftheprimaryMicrosoft365tenancy
• Webapplicationpenetrationtestofwww.company.com.au
• Publicpresencereview
Root cause analysis
Thissectionhighlightswhatwedeterminedtobethelikelyrootcauseofthevulnerabilitiesdiscovered.
Byaddressingtherootcause,youreducethechancesofintroducingnewvulnerabilitiesofthesame
class.
Informationsecurityawarenesstraining
Eventhoughmostemployeeshavenoexperienceininformationsecurity,securityisnever-the-less
becomingakeypartoftheworkofeverypersonwhoworkswithcomputers.Thismeanstheemployees
needtrainingontheinformationsecurityrequirementsandexpectationsfortheirwork.
SecurityReview&PhishingCampaign-CompanyName Page5
Version1.0,released2January2023
EffectiveInformationSecurityAwarenessTraining(ISAT)programmesincorporateamixtureofclass-
roomstylepresentationsorcomputer-basedtraining,regularupdatesusingemailsorannouncements
inteammeetings,andpostersinvisiblelocations.
CompanyNameshouldconsiderimplementinganISATprogrammeforitsstaff.Thiswillhelptogrow
thesecuritycultureoftheorganisationandprotectthecompanyfromsocialengineeringattacks.
Effective security practices
Volkislikestocelebratethepositives!Thissectionhighlightssomeoftheeffectivesecuritypractices
andcontrolsthatwereobservedduringthepenetrationtest.
Limitedattacksurface
CompanyName’sexternalinfrastructurewasfoundtobewell-secured, withalimitednumberof
servicesexposedtotheinternetandusingmostlysecureconfigurations.Thispreventedanysuccessful
attacksagainsttheCompanyNameinfrastructure.
Additional recommendations
Defence-in-depthisasecurityconceptthatteachesmultiplelayersofprotectionagainstadversaries.
Theserecommendationsarenotspecificallyrelatedtoavulnerabilitybutwillincreasetheoverall
securityoftheorganisation.
OutdatedWordPressplugins
Thecompanyname.com.auwebsiteisusinganoutdatedversionofthewoocommerceandgravity-
formsplugins.Althoughtherearenosecurityflawspresentintheolderversionoftheseplugins,they
shouldstillbeupdatedasabest-practice.Additionally,CompanyNameshouldreviewtheirpolicyto
ensuremoreregularupdatesofpluginsinthefuture.
Unneces