Vulnerability Assessment vs Penetration Testing: What’s the Difference?

Posted May 3, 2019

Eli Whitney invented the idea of interchangeable parts when he built a firearms factory in 1798. Unfortunately, more than 220 years later some people are applying interchangeability to their cybersecurity programs – particularly when it comes to vulnerability assessment vs penetration testing. The problem with this line of thinking is that there are several key differences between vulnerability assessments and penetration testing (also known as pen tests).

Vulnerability Assessment vs Penetration Testing: What’s the Difference?

First, let’s look at the two processes individually.

A vulnerability assessment is a process for identifying the vulnerabilities and weaknesses in a business environment as well as where they are located. Using one or more automated “scanning” tools, your infrastructure can be scanned for technical vulnerabilities. Manual scans and testing can also be used to evaluate the security of your networks and applications or to verify the results of automated scans. Vulnerability scanners are unable to distinguish between flaws that can be exploited by attackers to cause damage and those that can’t. Some reasons to perform a vulnerability assessment include:

Matching up critical vulnerabilities with critical assets
Generating a list of the patches or other remediation that need to be applied
Identifying (through the assessment process) all of the false-positives and false-negatives that exist
Satisfying PCI, HIPAA and NERC-CIP regulatory requirements

With penetration testing an organization can simulate a real-world cyberattack on targeted assets, using the same tools and techniques that modern cybercriminals use. This is accomplished by understanding who your threats are, their capabilities, motivations, and targets. In addition to evaluating your network, a pen test can also include physical security and social engineering. A pen test simulates as closely as possible the effect that these threats have on your business. Penetration testing should not be done simply to prove you can be hacked or to prove that you are vulnerable. It also shouldn’t be done just because it sounds like a “cool” process. Here are a few reasons to perform a pen test:

To test your cybersecurity controls after they have matured
To identify exploitable vulnerabilities in critical assets, including money, intellectual property, credit card applications, critical infrastructure and other crown jewels
To satisfy PCI, NERC and other compliance requirements
After significant changes to your business or infrastructure

It is recommended that a pen test be conducted by a third-party rather than an internal team in order to avoid any conflicts of interests and provide an objective view of the environment.

Vulnerability assessments and penetration testing are both critical to maintaining a strong security posture. See the chart below for further differences between the two.

Vulnerability-Assessment-vs-Penetration-Testing

Which one should you do?

The answer is probably both. However, it depends on the business problems you’re trying to solve as well as the maturity of your cybersecurity controls and the compliance or regulatory requirements your organization must meet.

Can’t decide between vulnerability assessment vs penetration testing? We can help you find the right solution for identifying and assessing your security weaknesses. Email GreyCastle Security at intel@greycastlesecurity.com or give us a call: (800) 403-8350.