Vulnerability Assessment vs. Penetration Test

It is all about Vulnerabilities. 

So, what is the Vulnerability? It is a Weakness in an Information System or System Security Procedures or Internal Controls or System Design or System Implementation or Configuration/Setup that will raise risk and expose it to be exploited or triggered by a threat actor. 

As Window Snyder - Chief Security Officer at Square, Inc. said: "One single vulnerability is all an attacker needs.".  

To find this vulnerability we need to search for it and to search for it we need to test the system from a security perspective to find it. So, Security Testing is to identify the threats in or on the system and measure its potential vulnerabilities "Weaknesses" so these threats and vulnerabilities must be remediated to reduce the risk. In other words, Security Tests are to identify all possible loopholes and weaknesses of the system which might result in a loss of information, revenue, repute at the hands of the employees or outsiders of the Organization.

There is a considerable amount of confusion in the industry regarding the differences between Vulnerability Scanning/Assessment (VA) and Penetration Testing (Pentest), as the two phrases are commonly interchanged. However, their meaning and implications are different. 

The Vulnerability Assessment simply identifies and reports known vulnerabilities, whereas a Penetration Test (Pentest) identifies known/unknown vulnerabilities and attempts to exploit them to determine whether unauthorized access or other malicious activity is possible. Sure, I will not depend on these definitions. I will elaborate more about it later in this article. But, to start we need to know at least a simple definition of these two essential tests in Information Security.

Before start explaining about definitions of these tests. I would like to explain why I prefer to begin the article with the Vulnerability Assessment then moves to Penetration Test. 

Vuleraibiltiey Assessment is a standalone exercise and also it is one of the fundamental phases in Penetration Testing. So, starting with Vulnerability Assessment will save us some time by not repeating the same definition when we reach it in the Pentation Test.  

What is Vulnerability Assessment (VA)? 

Many organizations undertake vulnerability assessments to tick a box, usually for compliance. Which is a wrong understanding for a very very very important and cornerstone exercise in Information Security !!! Imagine a thief reconnaissance for and identifying a back entrance to your house, but not entering. And you don't know about that back entrance. Isn't that will be scary because he/she may use it to harm you somehow. So, you should be alerted and close this entrance.

Vulnerability Assessment is a scan which is following a process of identifying, quantifying, and prioritizing (or ranking) the severity of the vulnerabilities in a system based on known vulnerabilities. It uses an automated tool in this process to check the systems if it has vulnerabilities.

These tools depend on Known Vuleraibilties retrieved from the Vulnerability Database like OSVDB, NVD,...etc. Which is updated frequently with the latest vulnerabilities.

The results of the scan will show how an application, website, server, or other systems are vulnerable, but it doesn’t exploit it.

This exercise is not fully automated it needs the involvement of an Infosec expertise to analyze the resulted report then filter out the false positive based on research that he/she will perform and his/her experience. Moreover, filtering and sorting the results of the report has to be based on Business Criticality because not all vulnerabilities will be patched as soon as the report is released. In the last stage, a final report will be shared with the concerned team like System Administrator or Network Administrator. Accordingly, they can work on remediating the vulnerabilities. Just to mention that this is one of the main phases that is performed by adversaries "Hackers" while they are planning to attack you.

Performing a Vulnerability Assessment on your organization's Systems, Servers, and Applications more frequently is recommended. The schedule for this exercise must be performed at least every month or less on critical Business Systems. Also, it is recommended to be performed on newly implemented applications, Servers, and Systems before launching it.

The article "Vulnerability Management (VM) vs. System Admins. It is a challenge !!!" will explain more about the implementation of Vulnerability Assessment and Vulnerability Manamgnet in the organization.

What is the Penetration Test (Pentest)? 

Penetration testing is a monitoring control, which periodically checks the efficiency of the vulnerability management process. If vulnerability management is done right, penetration testing should turn out to be a “blank report”. Which is not easy!!!

Penetration testing is a method of identifying and testing vulnerabilities or gaps in IT security (systems or networks or applications) that could be exploited in external or internal organization infrastructure or applications, leaving your business at greater risk. A penetration test usually begins with an automated vulnerability scan but goes into far more depth. In our thief scenario, this time they are checking for a back entrance and then actually entering the building.

This testing many people might consider ‘hacking’ which is a systematic examination of organization applications or networks or systems undertaken by qualified, experienced security experts (consultants) who have been given permission to exploit the vulnerabilities and misconfigurations they find to determine their potential impact. The consultant will work to a defined test methodology to enter the network through the identified gaps (hence the term, ‘penetration’), using their knowledge, Open Source information, and a range of tools. 

Once vulnerabilities have been identified and tested in your systems and networks, they provide expert advice for strengthening your defenses and how to remediate them by issuing a comprehensive report about the full pentest exercise. 

Penetration testing is not enough by itself because it is an exercise that will consume time and effort so it will take a longer time than Vulnerability Assessment. So, Penetration testing frequency to be performed on the organization as highly regulated industries is once or twice a year it will be enough. Just to mention in this part that Penetration testing can be done on newly developed and implemented applications or systems before or after it went live. But that will not replace the application security review testing phase on the newly developed applications or systems that need to be performed as part of the application or system project test phase.

Going through all Security Tests will take longer and will make this article boring. The purpose of this article is to explain the difference between VA (VuleraibiltiyAsssessment) and PT (Pentest) only. 

By Abdulla Abusaif, CISSP, GMON, PMP, CEH, Security