Information security testing doesn’t just come in one flavour, there are a variety of options available, each with their pros, cons, and various levels of coverage.
For those new to security testing this can often prove confusing and many organisations are unsure as to which type of test will suit their needs, requirements, and budgets. That’s why we wanted to give you a brief overview of two of the most common testing methods, and the ones that seem to cause the most confusion, vulnerability scanning and penetration testing.
Vulnerability scanning
Vulnerability scans are software-based security assessments and are useful as part of an in-depth security approach, they are easily deployed when needed or can be set to run automatically.
Once a target has been defined, the software will scan the set target, checking it against a list of known vulnerabilities. If an issue is discovered, this will be shown on the report dashboard. Vulnerabilities could then be investigated further manually, and remediation efforts implemented where required.
There are however limitations to vulnerability scanning. Not all scanners are created equal, there are several different scanners on offer, from simple port scanners right through to complex application security scanners, and results can vary between them. One of the key factors in the accuracy of the results is the list of vulnerabilities input by developers. As we mentioned above, scanners only check against a defined list, therefore, if the list is not up-to-date or has missing issues then these will not be picked up by the scan.
There’s also the issue of false positives and scanners can often flag valid behaviours as potential security issues. These false positives would require manual interpretation and would take time to investigate. This can take vital time away from real vulnerabilities.
Finally, scans can only tell you about the vulnerability found, not any potential future attack chain. So, for example, a scan may flag a low-level vulnerability, and this may not be a priority for remediation efforts. However, attackers may be able to combine several low-level vulnerabilities to gain basic access to a network, from this they may be able to escalate privileges and eventually gain control of that network.
As you can see, what started as a ‘low-level’ vulnerability could quickly escalate and have a major effect. This would only be discovered through manual verification of the vulnerability.
Pros – easy to deploy, quick results, typically lower cost
Cons – accuracy of results, false positives, unable to demonstrate consequences of attack chains
Penetration testing
Penetration testing is predominantly a manual security assessment, one in which testers look to replicate the actions of a threat actor to uncover vulnerabilities within the set scope of the engagement and the time allotted. This type of testing is designed to provide organisations with evidence of vulnerabilities found, to explain how these vulnerabilities could be exploited by a potential threat and to provide vital remediation advice.
Due to its manual approach, penetration testing is far more rigorous than automated scanning tools and can identify issues that would usually go unnoticed by scanners, as well as eliminate the issues of false positives.
Testing can be applied to number of specific targets, including infrastructure, applications (mobile and web), as well as connected devices, and testing will follow proven methodologies to highlight relevant issues such as SQL injection, Cross site scripting (XSS) and privilege escalation.
Limitations do exist however, and these usually centre around budget, scope, and test length. Budget is one of the biggest limitations when it comes to penetration testing and concerns over budgets can often result in a limited test scope and/or length of test. This means testers have less time to investigate issues or may not be able to test the target fully, resulting in issues potentially being missed.
Scope is another limitation and penetration testers are only be able investigate the areas that have been defined by the client. Vulnerable areas could therefore be potentially excluded from a test and could ultimately provide attackers with a route in.
Pros – in-depth investigation, understanding of the potential consequences of a breach, remediation advice
Cons – budgets, limited scope and the set testing time could mean issues are missed
Why not have the best of both worlds?
Security testing is more effective when there’s combined approach and many organisations use both vulnerability scans and penetration tests to help improve their security posture.
For example, take a software development company, they may use vulnerability scans throughout the development process, helping them quickly uncover issues and make fixes as they go. However, before the software is released, they would then conduct a more thorough penetration test to ensure that the product is as secure as possible before they go live or pass on to the end client.
