Vulnerability Scanning vs Penetration Testing: What Is the Best Approach for Your Organisation?

Vulnerability Scanning is an automated process in which your network or applications are scanned using a range of scanning tools. The goal is to identify known vulnerabilities in your systems.

Scanning tools’ databases are regularly updated with information about vulnerabilities including coding bugs, packet anomalies, configuration faults, and known paths cyber-criminals use to compromise confidential data. By scanning your systems, these tools are looking to identify these known vulnerabilities in your environment, so you can then run the necessary patches to remediate them.
In many organisations, Vulnerability Scanning is performed by the IT department, or external cyber-security specialists. The actual scanning process not only identifies known vulnerabilities, it can also classify them in terms of severity, allowing your IT team to prioritise patching those vulnerabilities that represent the greatest risk to your organisation. All too often, breaches occur because organisations have failed to patch well-known vulnerabilities that cyber-criminals have been exploiting for years. With Vulnerability Scanning, there is no longer any excuse for organisations to neglect patching these vulnerabilities.

Vulnerability Scanning is an activity that should be undertaken on a regular basis. A full network Vulnerability Scan should be run at least annually. Some compliance standards, such as PCI DSS, actually mandate it. Vulnerability Scanning is both effective and efficient. However, whilst there are many advantages to Vulnerability Scanning, it also has its limitations. Like many aspects of cyber-security, the good guys are in a constant race against the bad guys. The same scanning tools you use to identify vulnerabilities, may be used by cyber-criminals to identify weaknesses for exploitation. 


Furthermore, the most sophisticated threat actors are not simply looking to exploit widely-known vulnerabilities. Rather, they are hunting to discover new vulnerabilities. So-called Zero Days are vulnerabilities that have just been discovered for the first time. As patches don’t yet exist for these vulnerabilities, organisations can find themselves at the mercy of cyber-criminals. That’s why many organisations also incorporate Penetration Testing into their cyber-security strategies.

Penetration Testing , also known as Ethical Hacking, seeks to identify and breach exploitable systems in your organisation’s environment. Penetration Testers, whether in-house or external experts, adopt the mindset and tactics of a threat actor. 

A key difference between Vulnerability Scanning and Penetration Testing is the latter’s use of manual interrogation techniques. Penetration Testing goes beyond Vulnerability Scanning as it seeks to uncover hidden vulnerabilities, not simply those that are widely-known. 
The objective of Penetration Testing is to identify ways in which a sophisticated threat actor could breach your defences. This knowledge provides your organisation with critical awareness that allows you to harden your systems and ensure your security posture can be made more resilient.
A typical Penetration Testing engagement usually encompasses the following stages:

Scope

The scope of a Penetration Testing exercise is critical. It starts with careful consideration of the objectives you hope to accomplish. 

Application Penetration Testing should be undertaken whenever you are launching a new web or mobile application or releasing new functionality for an existing application.

External Network Penetration Testing should be undertaken to determine the strength of your organisation’s perimeter defences. 

Internal Network Penetration Testing should be undertaken to determine whether a breach of your perimeter allows unfettered lateral movement across your network. 

With web services, such as APIs, increasingly used to connect different systems and to facilitate data transfers, it is also critical to undertake Web Services Penetration Testing. Even your organisation’s Wi-Fi routers may be vulnerable. Wireless Network Penetration Testing ensures unauthorised individuals are not connecting to your network through Wi-Fi routers.

You also need to determine whether the Penetration Testers should interrogate your systems as authenticated users, i.e., those who have access to login and password credentials, or unauthenticated threat actors.

Furthermore, you need to determine whether to undertake Black-Box Penetration Testing, where the testers have no prior knowledge of the system, architecture or source code. This approach simulates how a genuine threat actor would likely attempt to attack your systems. 

Alternatively, White-Box Penetration Testing provides the testers with extensive system information. The benefit of this approach is that testers can examine the source code to identify potential points of weakness. Another approach is Grey-Box Penetration Testing, where the testers are accessing the systems with some knowledge, for example as a privileged user.

Reconnaissance and Planning

Once you have determined the scope of Penetration Testing, the testers will begin their reconnaissance and planning. This step sees the testers gather critical information about the systems they will test to determine likely points of weakness.

The Penetration Testers will look for open-source intelligence (OSINT) that may help to identify vulnerabilities and potential entry points.

The Penetration Testers will also conduct threat modelling to map-out how they will conduct their attack.

Interrogation

Armed with a map of likely vulnerabilities and entry points, the Penetration Testers undertake their interrogation of the systems, as outlined in the scope. The objective for the Penetration Tester is to go as far as possible within your environment, whilst evading detection.

The Penetration Testers will only go as far as authorised by the client. They will also make every effort to avoid causing any damage, data loss or business interruption.

Throughout the interrogation stage, the client will be kept fully-updated of progress. Clients will be alerted to any severe vulnerabilities that are uncovered, so urgent steps can be taken to remediate the risk.

Reporting

Upon completion of the Penetration Test, a comprehensive report will be developed that outlines any vulnerabilities uncovered, the severity of those vulnerabilities, along with essential remediation advice. 

The client is then armed with a blueprint for strengthening the security of the tested systems.