Energy / critical infrastructure · Gas grid operator · 1,500 users

White-box penetration test of a hybrid environment for a gas grid operator with 1,500 users

Two operators sit in a dimmed control room in front of a video wall showing a pipeline network schematic, one of them pointing at the wall.

Users: 1,500
Scope: Azure, Entra ID, Active Directory
Findings: 5 critical, 10 high
Duration: 1 month

Situation

A regional gas grid operator with 1,500 users belongs to the critical infrastructure sector (KRITIS) and is subject to heightened IT security requirements. Its environment is hybrid: Active Directory on-premises, Microsoft Entra ID and several Azure landing zones. The operator wanted an independent assessment of how far an attacker with insider knowledge could get.

Approach

WCS carried out a white-box penetration test within one month. In a white-box test, the testers receive architecture documents and documented access, so the time goes into attack paths.

Preparation: scope, architecture and permission concepts, test window and access.
Azure and Entra ID: roles and permissions in Entra ID and Azure RBAC, privilege escalation scenarios, separation of the landing zones and policies. The simulations started from regular user and service accounts.
Active Directory: attack paths through ACLs, delegations and nested groups up to Tier 0, Kerberos weaknesses and the credential hygiene of service accounts.
Transitions between AD and Entra ID, including Entra Connect and its synchronisation accounts.

Result

The test produced 5 critical and 10 high findings, each rated by exploitability and risk. The operator received prioritised recommendations, so the most serious issues can be addressed first, and a final report with a management summary for the executive level. WCS presented the results in a closing session. The report gives the operator a documented basis for its remediation plan.