Gray Hat Hacking The Ethical Hackers Handbook, 3rd Edition, 3rd Edition

CHAPTER 6Insider Attacks

In the previous two chapters, we’ve discussed some up-close and personal ways of obtaining access to information assets during a penetration test by using social engineering and physical attacks. Both are examples of attacks that a motivated intruder might use to gain access to the information system infrastructure behind primary border defenses. In this chapter, we’ll discuss attacking from the perspective of someone who already has access to the target’s information systems: an insider.

Testing from the insider perspective is a way to assess the effectiveness of security controls that protect assets on the local network. Unauthorized insider access is a common factor in identity theft, intellectual property theft, ...