The findings that come up again and again on West Midlands networks

Penetration test reports from different organisations look more alike than anyone expects. Across manufacturers in the Black Country, distribution operations off the M6 and professional practices in Birmingham and Shrewsbury, the same handful of issues account for most of what actually matters. None of them is exotic. All of them are cheaper to fix than to leave. Here is what we keep finding.

1. The works network and the office network are not really separate

This is the big one in manufacturing, and it is almost always a surprise to the people who run it. Somebody describes a segregated production network, and the test finds a shared switch, a dual-homed machine used for data collection, or a management VLAN reachable from a desk in accounts.

The separation usually existed once. Then a machine needed a file transferred off it, somebody solved the problem in an afternoon, and nobody wrote it down. Five years later it is load bearing and invisible.

This matters beyond testing. Cyber Essentials Plus permits unsupported software on a works network only where it is genuinely segregated and placed out of scope, and described segregation is not the same as real segregation. The audit will find what the test finds.

2. Remote access arranged in a hurry, years ago

Exposed remote desktop and forwarded ports remain the most common serious external finding in the region, particularly on rural sites and smaller premises where the connection was poor and somebody improvised a fix. These arrangements solve a real problem and then outlive it by years.

They are also among the most actively scanned for things on the internet. Nobody is targeting a Shropshire engineering firm specifically. They are scanning the whole address space, and a machine that answers is a machine that answers.

3. Multi-factor authentication with standing exceptions

Most organisations we test have multi-factor authentication. A good proportion have exceptions, and the exceptions are almost always for the accounts that matter most: a director who found it inconvenient, a shared mailbox, a service account somebody set up for an integration and never revisited.

The practical test is not whether you have MFA. It is to pull the enforcement report out of your tenancy and read the exclusion list. Asking whether anyone has been excluded gets you the answer somebody remembers. The report gets you the answer that is true.

4. Integrations nobody owns

Distribution and logistics operations run on links into other people’s systems: customer ordering portals, carrier interfaces, data exchanges in place for a decade. They are rarely inventoried, often authenticate with credentials that have never been rotated, and frequently predate everyone currently employed.

Listing them is harder than it sounds, because some are running on a machine in a corner that nobody associates with IT. For each one, establish what it authenticates with, when that was last changed, and who owns it at both ends. The last question routinely has no answer, and that absence is itself the finding.

5. Access that was granted once and never reviewed

In professional practices the recurring finding is not a technical weakness at all. It is that far more people can reach the client files than anybody intended, because access was granted for one matter years ago and nobody takes it away.

It costs nothing to fix and it is the single most effective thing a small practice can do. Pull the permissions on your main file store and read them. Most people are uncomfortable with what they find, which is rather the point.

What is notable by its absence

We do not often find the thing people are worried about. Sophisticated, novel attacks against bespoke systems are not what gets regional businesses into trouble. What gets them into trouble is a forgotten remote access route, an exception to a control they believe is universal, and a permission nobody reviewed.

That is good news, because it means the fixes are mostly process rather than purchase. We are consultants rather than a platform vendor, so there is nothing we are trying to move you onto a licence for, and a surprising amount of this is an afternoon of somebody’s attention.

Keeping an eye on what is actually being exploited

The other half of this is knowing which newly published vulnerabilities are being used against organisations like yours, rather than reading every advisory published. We cover that separately in how to track the vulnerabilities that matter to you, and we publish the UK security news we think is worth a small organisation’s attention at SecNews.

If you want to know which of these applies to you

A penetration test answers it properly, and we quote a fixed price once we know the scope. There are area pages for the West Midlands, Birmingham, Telford and Shropshire, and nothing is added for travel anywhere in the region.

Common questions