Insights
Northwick Cyber · Penetration Testing
Before we talk about the scope for this year’s penetration test, let me tell you about something that happened in NSW over the last ten days. I think it will save us twenty minutes of debate about what is ‘in scope’.
The Friday afternoon call
At about 1pm on Friday the 30th October, the NSW Police Cybercrime Squad was alerted to an alleged data breach at NSW Health. By the following Wednesday it was public. Cyber Security NSW had declared it a major incident, and the phrase everyone repeated was that it affected ‘an isolated server’.
The important bit first, because it matters, officials have said no patient data was impacted and no clinical service was compromised. Credit where it is due, too. Reports say the breach was picked up because an automated system flagged unusual traffic on the server. Somebody’s monitoring did its job.
But look at what that server actually was. It sat behind the Oral Health Fee For Service Scheme website, the portal supporting private dental providers who treat public patients under the scheme. Police believe around 4GB of data was taken, and the Cybercrime Squad described it as a significant amount of personal identification information about those third-party providers, mainly dentists.
The person claiming responsibility posted on a hacking forum that they’d taken around 100,000 documents from what they called a misconfigured subdomain of health.nsw.gov.au. They also claimed the only reason they didn’t go deeper into the network was that they accidentally crashed the server. None of that has been independently verified, and I would treat a hacker’s boast with the same scepticism you would give a used-car salesman. But even the confirmed version gives us plenty to talk about.
‘Isolated’, what does that really mean?
I am not here to pile into the NSW Health. Big public systems are genuinely hard to run, and I have sat on the inside of plenty of them. But I want you to notice that word.
‘Isolated’ is reassuring. It tells you the blast radius was small. What it does not tell you is the part that keeps me up at night, an isolated server can still hold thousands of people’s personal details, still sit on your domain, still put your name in the headline, and still end with detectives investigating.
Kash Sharma from BlueVoyant made the point well in the coverage, in a large health system, very little is truly standalone. The same is true of your organisation.
Meet your forgotten estate
In all my years in this industry, I have never walked into an organisation that did not have its own version of this server. It usually looks like one of these –
- The campaign microsite from 2021 that nobody took down
- The supplier or scheme portal built by an agency that has since moved on
- The staging copy spun up for user testing and never switched off
- The old subdomain still pointing at a cloud service nobody pays attention to
- The test environment loaded with production data ‘just for a week’
- The small programme website run by a small team on its own budget
They all have things in common. They were built for a purpose. The purpose passed or became routine. The project team moved on. Nobody’s name sits next to them in the asset register, if there is one. They don’t get patched on the same cycle as everything else, and they don’t make it into the annual pentest, because the scope document was copied from last year’s.
But they’re on the internet, and attackers find them faster than you do. Certificate transparency logs, DNS enumeration and a few search engine tricks will map most organisations’ subdomains in an afternoon, at no cost.
Here’s the uncomfortable truth: attackers don’t test your scope. They test your perimeter, and your perimeter is everything with your name on it that answers on the internet.
Why your last pentest probably missed it
When a client hands us a scope, it’s almost always the crown jewels, you know the main website, the customer portal, the core applications. That is very sensible, but it is a list of the things you already know about. If the claims hold up, the NSW Health breach came through something that was on nobody’s top-ten list.
So, at Northwick Cyber, before we test anything, we go and find what is actually out there. We enumerate your domains and subdomains, check certificate logs, cloud-hosted assets and old DNS records, then compare that with what you believe you own. The gap between those two lists is, more often than not, where the real findings live.
I have lost count of the number of times a client has looked at the discovery report and said, ‘Hang on, that’s still running?’
What I’d do this month
- Build or refresh your external asset inventory. Every domain, subdomain, IP address and cloud endpoint, each with a named owner.
- Kill what you do not need, properly. Take the service down, remove the DNS record and delete the data. A switched-off server with a live DNS record is an invitation.
- Bring everything else into patching and monitoring. If it is worth keeping, it is worth watching. NSW Health’s automated detection shows exactly why.
- Scope your next pentest from discovery, not from last year’s document.
- Check what your third-party and scheme portals hold. The data here was about providers, not patients. Your suppliers’ and partners’ details are your responsibility under the Australian Privacy Act too.
- Rehearse the bad day. Know who calls whom when a forum post with your domain name appears at 1pm on a Friday.
The bit I want you to take away
Big breaches rarely start at the front door. They start at the side gate nobody remembers installing. The good news is that this is the cheapest part of your security to fix. Finding and switching off a forgotten server costs far less than explaining it to the regulator, your board and the people whose details were sitting on it.
So, back to your scope. Before we lock it in, let’s spend a day finding out what you actually own.
At Northwick Cyber, that’s how every penetration test starts, discovery first, then testing, backed by 24×7 monitoring and incident response for when something does slip through. If you’d like to know what is sitting on the internet with your name on it, get in touch at northwickcyber.com.
The Summary
An attacker got into a NSW Health server that officials called ‘isolated’ and took personal details of the dentists working under a state scheme.
It shows how the sites and servers everyone has forgotten about often become your biggest exposure.
At Northwick Cyber, every penetration test starts by finding everything on the internet with your name on it, because attackers look at your whole perimeter, not just what’s in your scope.
About Northwick Cybersecurity
Northwick Cyber is the cyber security services brand of Bushey Pty Ltd, an Australian-based specialist consultancy with reach across the Asia-Pacific. We help organisations find their cyber security weaknesses before attackers do, see threats as they happen, and recover quickly when something goes wrong.
How we help
- Penetration testing. We test your websites, applications, networks and cloud environments the way a real attacker would, then give you clear, prioritised fixes. After an event like PHP2Shell, a targeted test confirms whether your exposure is actually closed.
- 24×7 monitoring. We watch your systems around the clock for signs of intrusion, so suspicious activity is caught and acted on early, not found weeks later.
- Incident response. If you suspect a breach, we contain it, work out what happened and get you back to normal operations, with clear reporting for executives, Boards, insurers and regulators.
Why it matters for Boards
Cyber risk is now a governance responsibility. Northwick Cyber gives leaders an independent view of where they’re exposed and evidence that issues have been fixed, plus a trusted partner on call when it counts. We draw on Bushey’s long experience delivering complex technology programmes for corporate and government clients.
Find out more at northwickcyber.com.
