What is the difference between penetration testing and vulnerability scanning?

A combination of penetration testing and vulnerability scanning is key to comprehensively defending against cyberattacks, says Nick Hayne at Quiss.

It seems barely a day goes by without news of another ransomware attack, or dire warnings of the growing threat businesses face from hackers. There is only so much an organisation can do on its own before turning to specialist help to find the weak spots in its defences, before criminals do.

Two terms becoming more prevalent in this fight against cybercriminals are penetration testing and vulnerability scanning. But what do these terms mean? And how important are they in keeping your systems, networks, devices and people safe from attack?

In short, they are different approaches to security, but either one undertaken in isolation is of little use.

Penetration testing

Different penetration tests can be performed – internal, external, web-application, GDPR, etc. But regardless of the test, it should be undertaken by a specialist IT-security professional. They will use the same tools and methods as hackers to discover vulnerabilities, and then attempt to exploit them.

External testing assesses the infrastructure accessible through the internet and usually involves firewalls, VPNs, etc. These will also typically include attempts to phish employees. An internal test assesses the infrastructure inside the corporate network, and the risk posed by virus/malware outbreaks, rogue employees and physical intruders.

Effective penetration testing requires experience, detailed knowledge of infrastructure and systems architecture – allied to a range of specialist skills, which is why it costs more than automated processes. Testers understand the hacking world and will seek to exploit a new vulnerability unknown outside the dark web.

Vulnerability scanning

Vulnerability scanning identifies potential vulnerabilities in network devices such as firewalls, routers, switches, servers and applications. But it is a largely automated process focussed on finding potential and known vulnerabilities without attempting to exploit them.

This type of scanning encompasses the entire business and is much wider than penetration testing in scope. Effective vulnerability scans require good knowledge of systems, and are typically run by systems administrators or external security personnel.

It is cost-effective to run scans frequently to discover known vulnerabilities and patch them, but this should ideally be coordinated with penetration testing – to offer a more comprehensive solution that combines detection and preventative measures.

The question for every organisation to answer is: how much risk are you prepared to accept against the cost of regular vulnerability scans, and at least biannual penetration testing?

Vulnerability scanning and penetration testing inform your cyber risk analysis and help determine the controls needed at the business, department and individual level. The reports provided will offer suggestions to close weaknesses in your defences – and that could be priceless.