Bypassing Security Controls

The COVID-19 pandemic has led many organizations to switch completely to remote working in 2020, and this has significantly increased the risk associated with the endpoint devices that remote workers use. The rise of Endpoint Detection and Response (EDR) from early 2018 to now has emerged as a replacement for traditional antivirus software, due to the various types of security incidents, especially sophisticated ransomware and leakware. Having said that, most of the time, when testers get internal network access or highly privileged access, they think they are done with the test, assuming that they have the knowledge and toolset to completely compromise the network or enterprise.

One of the neglected aspects during a penetration test activity is bypassing security controls to assess the target organization’s detection and prevention techniques. In all penetration testing activities, penetration testers or attackers need to understand what renders...