Suppose I have a penetration tester working in my data center. She is testing my systems and is probably finding some issues, allowing her to gain root access to a machine that is inside a subnet deep inside the company network.
How can I be sure, that after the job is done, this system is not permanently compromised?
The question arises: How do I monitor what a penetration tester is doing during a penetration test to ensure that there are no longtime effects on my infrastructure?
Solutions I have thought about:
- Nuke the machine from orbit.
This would protect the machine that was inside the scope, but a skilled hacker can gain access to other servers that are in the same subnet and/or pivot from the server that she has gotten access to to another machine.
- Monitor all network traffic in the subnet
Not helpful if the pen tester makes a lot of noise and if the test takes several days it is also very costly.
- Set up the pen testing desktop on a virtual desktop and give the penetration tester access to this machine. Monitor what this machine is doing, inspect shell history etc.
Also extremely costly, comes close to a forensic investigation and is susceptible to errors. I can probably do the pentest myself then.
- Have ironclad contracts, only work with trusted companies and trust their employees.
Close enough? Is this the only solution? Or is there another way to better monitor penetration tester?