Businesses often perceive vulnerability scanning as an alternative to penetration testing. This idea is wrong. An organization that is aware of cyber security must incorporate both of these activities into its business processes and ensure that they work in unison. For both web application security and network security, one of them greatly reduces the security stakes. Penetration tests and vulnerability scans are also considered separately compliance requirements (for example, payment card industry data security standards – PCI DSS, ISO 27001, or HIPAA compliance). Let’s take a look at the key differences between penetration testing and vulnerability scanning and their place in the cybersecurity ecosystem.
What is an penetration test?
During an intrusion test, a trusted professional mimics the activity of a real-world black-hat hacker and uses manual testing to detect potential vulnerabilities and incorrect configurations, exploit vulnerabilities, and infiltrate business assets. Such tests are designed to act as a cyber attack but are carefully designed not to affect data security. This trusted professional, known as a Pentaster, may be part of an internal security team or may be hired by an outside company. If an intrusion test result is a security breach, security professionals provide detailed vulnerability assessments and penetration test reports so that the business can eliminate vulnerabilities that lead to breaches.
For many reasons, businesses often choose outsourced penetration tests. First, there is a more objective perception of systems tested by an external entity. Second, many businesses cannot find security experts who specialize in pen testing, hire them full-time, and give them adequate work on a regular basis. Third, a business that provides comprehensive security services, including risk assessment and intrusion testing services, has a much larger experience and a much larger expert base.
Penetration testers cannot automate their work. To attack they use some security tools such as manual vulnerability assessment and penetration testing tools (for example, Metasplots). They may also use techniques such as social engineering (including phishing) to assess the safety of company employees.
Penetration tests are sometimes thought to be more thorough than vulnerability scans but in reality, they cover a different scope of vulnerability. Focuses on pen testing, which cannot be detected automatically, for example, business logic vulnerabilities and new vulnerabilities (zero-day). You cannot expect that a vulnerability scan will be a part of an penetration test.
Bounty vs. Penetration Testing
Some companies believe that bounties are a good alternative to regular safety checks. Bounty encourages freelance ethical hackers to try to breach your security control so that they receive a reward for such a successful endeavor. However, you cannot guarantee that talented white-hat hackers will find out about your donation or choose to follow it, so donations are unexpected.
Grants are not an effective alternative to testing but they are a valuable addition. A security-conscious business should have a public disclosure policy with appropriate funding. However, regular penetration tests are still required.
What is vulnerability scanning?
A vulnerability scan is an activity performed by an automated tool with minimal human assistance. By design, vulnerability scans should be scheduled and automated as part of a software development lifecycle. Such a security scan is designed to detect known problems although the scope of vulnerability testing depends on the vulnerability scanning tool selected.
A vulnerability scanner detects the structure of the scanned asset (some professional tools even discover existing resources) and then attempts a series of automated tests on each component of that structure. Common tools use only signature-based scanning, but more advanced tools try to attack as they do during penetration testing. Such vulnerability scanning is often referred to as automated penetration testing.
Professional tools include vulnerability assessment and vulnerability management functionality and working with basic mitigation technologies such as web application firewalls. With tools like these, you can decide which vulnerabilities need to be addressed first and you can also monitor remedies. That way, you can be sure that major security risks have been quickly and effectively eliminated
How often do you perform security assessments?
Once a business applies a vulnerability scanning solution, there is no limit to how often such scans can be performed. The only concern is that such scans can be resource-intensive and so businesses often choose to perform them off-hours for production resources. Professional vulnerability scanning solutions are also designed to integrate into the software development lifecycle and therefore such testing can be performed after each source code change using a continuous integration solution.
On the other hand, penetration testing is very time consuming, expensive and resource intensive. That is why they are usually performed once every few months or at large intervals.
Get the latest content on web security
In your inbox every week.
Author
Senior technical content writer
Tomasz Andrzej Nidecki (also known as Tonid) is a senior technical content writer working for Aquinatics. A journalist, translator, and technical writer with 25 years of IT experience, Tomasz was the managing editor of hakin9 IT Security Magazine in his early years and ran a major technical blog dedicated to email security.
