There are many differences between penetration testing and vulnerability scanning or assessments.
Based on NIST SP 800-115, Technical Guide to Information Security Testing and Assessment,
Penetration Testing is
“Security testing in which evaluators mimic real-world attacks in an attempt to identify ways to circumvent the security features of an application, system, or network. Penetration testing often involves issuing real attacks on real systems and data, using the same tools and techniques used by actual attackers. Most penetration tests involve looking for combinations of vulnerabilities on a single system or multiple systems that can be used to gain more access than could be achieved through a single vulnerability.”
This means that an engineer, or tester, is interacting and trying to exploit vulnerabilities. Discovery findings are located on the target systems or web application. It is human driven. The idea is that the engineer or tester will be acting like a “hacker.” NIST calls this Active Security Testing.
In addition, NIST 800-115 also states that Passive Security Testing is “Security testing that does not involve any direct interaction with the targets.” This represents vulnerability scans.
An engineer or tester might plug certain information into the software. The rest of the engagement is the software scanning in-scope devices or applications for known vulnerabilities. This is an automated process. Consequently, some software also has a little check box that will allow for some vulnerabilities to be exploited. This method isn’t always accurate and contains limitations.
Moreover, software just doesn’t have the human wisdom that experienced testers or engineers have. They are looking for many vulnerabilities that could create a significant hole in your network.
For example, they are looking at things that aren’t based on business logic, such as default credentials.
What about vulnerability assessments?
The human element verifies that the vulnerabilities actually exist. Sometimes the scanning software produces a false positive. A tester or engineer verifies each finding to ensure you have a list of vulnerabilities based on current knowledge.
In short, each has it’s place but the differences should be clear. If you would like to learn more about these services, contact us today.
