Vulnerability scanning is often confused with penetration testing. In reality, these two techniques are quite different, and both are important for understanding and mitigating cyber risk and maintaining a strong security posture. Both are also often called out as requirements in major industry and geopolitical regulatory frameworks, including PCI, HIPAA, ISO 27001, and more.
Vulnerability scanners use primarily automated processes that look for known vulnerabilities in networked assets such as servers, routers, and endpoints, generating a report of those vulnerabilities that is sorted based on some criticality rating. Penetration testing is a manual effort conducted by a person or team, using a variety of tools and techniques, to exploit weaknesses in your organization’s defense mechanisms.
5 Key Differences between Vulnerability Scanning and Penetration Testing
- The scope of a vulnerability scan is typically all assets in an organization whereas a penetration test is very targeted, covering critical assets only.
- Penetration testing requires highly skilled, security analysts, whereas vulnerability scanning can typically be conducted analysts trained in the use of the tool and in basic networking and security concepts
- Both vulnerability scans and penetration tests are known to be intrusive and can cause outages and other issues on corporate networks.
- Vulnerability scans have a low unit cost and can be conducted quite often, whereas penetration tests are costly and are typically conducted once per year, depending on the organization.
- Vulnerability scans can be instigated manually or automatically and will complete in as little as several minutes to as long as several hours. Penetration testing, on the other hand, are always manually instigated and last anywhere from days to weeks.
Vulnerability Scanning Basics
Vulnerability scanning looks for known vulnerabilities (unpatched software, misconfiguration, etc) in your assets, and generates a report of these vulnerabilities, often times highlighting which of these vulnerabilities represents the greatest risk to your organization. Most vulnerability scanning tools leverage CVSS Scores as the basis for vulnerability prioritization, but newer generations of these tools leverage CVSS, in addition to threats, exposure, asset criticality, and compensating controls to provide a risk-based criticality score that is specific to the organization conducting the assessment.
A vulnerability scanner typically uses either authenticated or unauthenticated scans. When authenticated, the tools logs in as a trusted user and attempts to identify vulnerabilities that any legitimate, authenticated user would be able to exploit. When unauthenticated, the tool does not have trusted access to the network, and is more similar to what an adversary would experience when initially attempting to attack your network assets.
Vulnerability scanning is mostly automated, and is typically applied to a large number of assets on a corporate network. These scans can be run often, and have a lower variable cost than penetration testing. Vulnerability scanning has been known to cause issues on targeted machines, so it is an intrusive technology that needs to be executed carefully.
Penetration Testing Basics
A penetration test is an exhaustive examination that includes a live person actually digging into your network’s complexities to exploit the weakness in your systems. Typically, skilled analysts use a wide variety of tools to attempt to actively exploit weaknesses in an organization’s cyber defenses. Unlike vulnerability scanning, which might target the majority of the assets in an organization, the scope of a penetration test is typically quite targeted.
Relative to vulnerability scanning, penetration testing is quite costly, primarily due to the need to have highly skilled testers designing and executing the tests. As a result, penetration tests are typically targeted just at higher value mission critical assets. A penetration test might take anywhere from days to weeks, and are done on a periodic basis – once or twice a year, typically. Like vulnerability scanning, penetration testing can cause issues and outages on enterprise assets. This is mostly related to the intrusiveness of the tools and techniques chosen by the testing team.
Conclusion
Vulnerability scanning and penetration testing both play an important role in strengthening cyber resilience. Vulnerability scanning should be the starting point in your infosec program, allowing you to get a broad sense for risk exposure. Penetration testing is a useful periodic add-on that can test for weaknesses using the same techniques typically leveraged by attackers.
