Vulnerability Assessment

Vulnerability assessment is used to find out the Vulnerabilities on the target network. By using some automatic scanning tools and some manual support, vulnerabilities, and threats can be identified. The tool will categorize these vulnerabilities. When the vulnerabilities are classified, the security professional prioritizes these vulnerabilities, and they decide which vulnerability will path first. They will decide that they should reduce the risk level, or they should remove the weaknesses. In the market, there are a lot of good tools. A vulnerability scan with proper scoped can find out a lot about an environment, including common weaknesses in applications, unapplied patches, gaps in network control, vulnerabilities software versions. Using the vulnerability scanning tool, the security team can provide the recommendation on how the vulnerabilities can exactly remediate with configuration changes, patch management or hardening security infrastructure.

Vulnerability assessment Process

• Automated discovery of all assets is completed by the vulnerability scanner within our environment.
• In the infrastructure, network and application, various vulnerabilities are searched and identified.
• The vulnerabilities are identified according to risk and priority.
• Vulnerabilities are remediated by its security professional with configuration changes, patch management or hardening security infrastructure.

Penetration testing

Penetration testing is used to find out the Vulnerabilities of a particular network. Penetration testing determines that vulnerability is genuine or not. The vulnerability will be considered as genuine and reflect on the report if a penetration tester exploits a potentially vulnerable spot. If they are unavailable to find the spot, the report will show unexploitable theoretical vulnerabilities. If we exploit theoretical vulnerabilities, it will lead to Dos. It means it threatens the network, so to exploit theoretical vulnerabilities is not a good idea. A penetration tester tries to harm a customer's network by installing malicious software on the customer's computer or taking down the server, or getting unauthorized access to the customer's system. This step does not include in vulnerability assessment.

Penetration testing process

• Gathering the open-source intelligence
• Scanning and discovering
• Identify the vulnerabilities
• Attack phase
• Risk analysis
• Send report

Differences between Vulnerability Assessment and Penetration Testing

Vulnerability scanning and penetration testing are different from each other. Penetration testing can exploit the vulnerabilities while a vulnerability scan identifies the rank of vulnerability and report it. The differences between Vulnerability assessment and penetration testing are as follows:

Breadth vs. Depth

Vulnerability coverage (breadth and depth) is the main difference between penetration testing and vulnerability assessment.

Vulnerability assessment detects security weakness as many as possible. It is the breadth over depth approach. To maintain the security status of the network, security should be regularly employed; especially when ports opened, new services added, and new equipment installed.

Penetration testing is used when the customer asserts that the security defense of their network is strong, but they want to check whether they are hack-proof. It is the depth over breadth approach.

The automation degree

Vulnerability assessment allows a wider coverage of vulnerability. It is usually automated.

Penetration testing helps to dig deeper into the weakness. It is a combination of manual and automated techniques.

Choice of professional

In the vulnerability assessment, automated testing does not require high skills. Security department members can also perform it. However, the security employees of a company may find some vulnerability, but they can't include them in the report. So the vulnerability assessment vendor of the third party has more information.

To perform penetration testing, we require a high level of expert. A service provider of penetration testing always outsources it.

Choice of Vendors

The penetration testing and vulnerability assessment differences show that both security testing is expert to guard the security of a network.

Vulnerability assessment is used to maintain security.

Penetration testing discovers the weakness of security.

To take advantage of penetration testing and vulnerability assessment is possible only if you hire a high-quality vendor who has the ability to understand pen test and vulnerability assessment. But most importantly, the vendor should have the ability to translate the difference between vulnerability assessment and pen test to the customer.