The Difference Between a Vulnerability Scan and a Penetration Test
What is the difference between a vulnerability scan and a penetration test?
A common question many client’s may ask, is what is the difference between a vulnerability scan and a penetration test? This blog post will go into addressing the similarities and differences of each activity.
What is a Vulnerability Scan?
A vulnerability scan is a thorough scan and assessment of a network or application. For the purposes of this article, we will assume the context of a client having an assessment of their external perimeter. That is, any assets that are exposed to the Internet that anyone in the world can access.
A vulnerability scan for a client’s external perimeter will generally include all of the IP addresses or FQDNs (Fully Qualified Domain Names) belonging to that client’s organization. This may include all sorts of assets such as the main marketing website, a VPN portal, a web application, and other various services. Lucid Security generally recommends including all assets during a vulnerability scan, especially critical systems. Once the hosts have been provided, it is now time to run the vulnerability scan. A popular vulnerability scanner is Tenable’s Nessus. The scan runtime will vary based on the amount of hosts included by the client, and the complexity of the services that may be running.
From here, the vulnerability scanner will generate a list of all of the potential vulnerabilities and security risks. This is where Lucid Security’s expertise comes into play. From here, our experienced Security Engineers parse through the results to determine the following:
- Is this a false positive?
- Is this truly a security risk?
- What is the true criticality of this vulnerability?
These are just a few questions Lucid Security considers when reviewing the results. At this point, Lucid Security will now compile a list of all of the vulnerabilities and their associated affected assets, and create a custom-tailored report for the client. This report will include the following:
- Complete list of all vulnerabilities.
- Associated criticality of each finding.
- A detailed remediation description to assist in fixing the issue.
- Supplemental information which is not provided by vulnerability scanners.
The report is then sent to the client securely.
What is a Penetration Test?
A penetration test has elements of a standard vulnerability scan, but takes it a step further. Again, we will be assuming the scenario is testing an organization’s external perimeter by conducting an external penetration test. A penetration test is a comprehensive assessment of an organizations assets, in this case provided again as IP addresses or FQDNs. The penetration test will have the following phases:
- Scope verification – All assets provided by the client are rigorously verified as belonging to the client. While the scope provided to the client is generally accurate, it is always possible for a typo to be made or IP addresses to change from previous years assessments. This ensures that testing is true to the organizations intended hosts.
- Open-Source Intelligence (OSINT) – In this phase, the security team scours the Internet for any potentially sensitive information which may aid in the assessment. This could be usernames, sensitive documents/files, etc.
- Enumeration of assets – Here the security team begins to actively examine what is running on the hosts. The team will be looking for any open ports or services that can potentially be attacked.
- Vulnerability Identification – One of the most important phases of an external penetration test is actually identifying the vulnerabilities which may exist. This is crucial for the remediation process for a client.
- Exploitation – At this phase, the security team will attempt to exploit potential vulnerabilities. This is beneficial to demonstrate impact, as well as potentially uncover additional sensitive information which may aid in follow-on attacks.
- Reporting – The reporting phase consists of gathering all of the identified vulnerabilities and information during the OSINT phase and ensuring that all the findings are accurate and have remediation steps to aid in fixing the issues. During the reporting phase, the reports are peer-reviewed by a Lucid Security engineer to ensure that all findings are addressed, and the remediation steps are accurate.
- Debrief – The debrief is generally an 30 minute to an hour long call in which the security team will review the findings with the client. In this phase, the client can ask any questions, address any concerns, and get a detailed and comprehensive understanding of the findings.
Conclusion
While a vulnerability scan and a penetration test both attempt to identify vulnerabilities for a client, the biggest takeaway is that a penetration test goes a few steps further. Both are very important and recommended by Lucid Security to be conducted. Generally, a vulnerability scan should be conducted monthly or quarterly to monitor any new threats that may be introduced in the ever-changing security landscape. While a penetration test is generally recommended to be conducted annually or bi-annually.
How Lucid Security Can Help
Lucid Security has decades of hands-on security experience in vulnerability threat assessments and penetration testing. Our expert security engineers are ready to secure your networks and applications. Reach out today to get started!
