0 Results Found
              Back To Results
                Fundamentals

                Vulnerability Scanning vs. Penetration Testing

                Vulnerability scans and penetration tests are very different from each other, but both serve important functions for protecting a networked environment By: Patrick Barnett

                When people misunderstand the differences between penetration testing and vulnerability scans, they are often missing a vital component in their overall network security profile.

                Vulnerability scans and vulnerability assessments search systems for known vulnerabilities. A penetration test attempts to actively exploit weaknesses in an environment. While a vulnerability scan can be automated, a penetration test requires various levels of expertise.

                Regular vulnerability scanning is necessary for maintaining information security. Secureworks® incident response (IR) analysts have observed some clients performing vulnerability scans weekly and others not performing these vital scans at all. Secureworks analysts recommend scanning every new piece of equipment before it is deployed and at least quarterly afterwards. Any changes to the equipment should immediately be followed by another vulnerability scan. The scan will detect issues such as missing patches and outdated protocols, certificates, and services.

                Organizations should maintain baseline reports on key equipment and should investigate changes in open ports or added services. A vulnerability scanner (e.g., Nessus, GFI LANGuard, Rapid7, Retina, Qualys) can alert network defenders when unauthorized changes are made to the environment. Reconciling detected changes against change-control records can help determine if the change was authorized or if there is a problem such as a malware infection or a staff member violating change-control policies.

                Penetration testing is quite different, as it attempts to identify insecure business processes, lax security settings, or other weaknesses that a threat actor could exploit. Transmission of unencrypted passwords, password reuse, and forgotten databases storing valid user credentials are examples of issues that can be discovered by a penetration test. Penetration tests do not need to be conducted as often as vulnerability scans but should be repeated on a regular basis.

                Penetration tests are best conducted by a third-party vendor rather than internal staff to provide an objective view of the network environment and avoid conflicts of interest. Various tools are used in a penetration test, but the effectiveness of this type of test relies on the tester. The tester should have a breadth and depth of experience in information technology, preferably in the organization’s area of business; an ability to think abstractly and attempt to anticipate threat actor behaviors; the focus to be thorough and comprehensive; and a willingness to show how and why an organization’s environment could be compromised.

                A penetration test report should be short and to the point. It can have appendices listing specific details, but the main body of the report should focus on what data was compromised and how. To be useful for the customer, the report should describe the actual method of attack and exploit, the value of the exploited data, and recommendations for improving the organization’s security posture.

                Table 1 lists the differences between vulnerability scans and penetration tests.

                Vulnerability scan

                Penetration test

                Frequency

                At least quarterly, especially after new equipment is loaded or the network undergoes significant changes

                Once or twice a year, as well as anytime the Internet-facing equipment undergoes significant changes

                Reports

                Provide a comprehensive baseline of what vulnerabilities exist and what changed since the last report

                Concisely identify what data was compromised

                Focus

                Lists known software vulnerabilities that could be exploited

                Discovers unknown and exploitable weaknesses in normal business processes

                Performed by

                Typically conducted by in-house staff using authenticated credentials; does not require a high skill level

                Best to use an independent outside service and alternate between two or three; requires a great deal of skill

                Value

                Detects when equipment could be compromised

                Identifies and reduces weaknesses

                Table 1. Comparison of vulnerability scans versus penetration tests.

                Vulnerability scanning and penetration testing are both critical to a comprehensive security strategy. They are powerful tools to monitor and improve an organization’s network environment.

                Related Content