Penetration test, external and internal network

Blackharbor Security tested the external and the internal network of Tidewell IT over five working days. The tester, Mikael Strand, worked from the public internet first and then from a laptop on the office network, within rules of engagement agreed beforehand.

The report names three weaknesses: an admin interface on the backup server that the customer network could reach, an injection flaw in the legacy hosting control panel, and no rate limit on the single sign-on login. Each one went to its owner with a due date, and Hans Overbeek tracked the remediation plan.