Why an Automated Scan is not a Penetration Test

Often, vulnerability scans are passed off as penetration tests, or pentests for short. However, there is a huge difference between these packages. What they are and why you shouldn't rely on vulnerability scans alone is described in this blog post.

Vulnerability scans look for known vulnerabilities in systems and report potential exposures. Penetration tests, on the other hand, are used to exploit architectural vulnerabilities and determine the extent to which a malicious attacker can gain unauthorized access to assets. A vulnerability scan is usually automated, while a penetration test is a manual test performed by a security expert.

A good analogy for this is that a vulnerability scan is like walking up to a door, checking to see if it is unlocked, and stopping there. A penetration test goes further: it not only checks to see if the door is unlocked, but it also opens it and goes inside.

What is a Vulnerability Scan?

A vulnerability scan identifies vulnerabilities using specialized scanner software and attempts to classify them according to their criticality.

A vulnerability scanner is a tool used to automatically identify vulnerabilities and classify threats based on established vulnerability assessment methods, such as the industry standard CVSS or vulnerability databases. However, the mere output of a vulnerability scanner is of limited use, as the data may contain false positives, so it still needs to be analyzed and quantified afterwards.

What are the Types of Automated Scans?

There are three types of vulnerability scans, which can take anywhere from a few minutes to several hours, depending on their scope. A distinction is made between internal scans, external scans and host scans.

Internal Scans

Internal scans aim to identify vulnerabilities in an organization's internal network. This can be a cloud network, a network segment, an enterprise network, or the entire organization consisting of multiple networks (production, staging, enterprise).

External Scans

External scans include the scope of components connected to the Internet, such as email, web applications, firewalls, applications/portals, and websites.

Host Scans

Host scans include a vulnerability assessment that explicitly targets a single or multiple hosts that serve as a database, web server, server, workstation, or other function.

What is a Vulnerability Assessment?

A vulnerability assessment is a method of identifying and classifying threats that affect an asset, i.e., a server, workstation or device. An assessment helps organizations identify vulnerabilities with a vulnerability scanner, quantify and categorize them with the assistance of an analyst, and also mitigate those risks.

Vulnerability Assessment vs. Vulnerability Scan

The key difference between the two analyses is that the Vulnerability Scan is the precursor to a Vulnerability Assessment.

The Vulnerability Assessment process aims to perform vulnerability scans and create a list of vulnerabilities that affect applications, complemented by security expertise in classifying false positives and explaining the impact of attacks and their likelihood of occurrence.

Under no circumstances should the mistake be made of purchasing a vulnerability scan disguised as an assessment. Only a vulnerability assessment provides a practical risk assessment for organizations.

What is Penetration Testing?

In penetration testing, the tester behaves almost identically to a potential attacker. Therein lies the strength of this measure: in pentesting, one assumes the worst case scenario: A well-informed attacker tries to penetrate the company's system in a targeted manner. The difference with an attacker is that vulnerabilities are exploited in a controlled manner and without any adverse effect on the company. The main difference from a vulnerability assessment here is the specific exploitation of the vulnerability and the attempt to penetrate further to uncover additional vulnerabilities. More information about pentests can be found here

• Penetration Test

Vulnerability Assessment vs. Penetration Test

. . . . .

Vulnerability Assessment	Penetration Test
Identifying and documenting vulnerabilities using specialized scanner software	Identify, securely exploit and document vulnerabilities using automated tools and especially dingen manual testing
Scaling based on the number of IP addresses/networks	Scale based on the criticality/functionality of the asset
More coverage, less depth	Deeper analysis

A vulnerability assessment is good to quickly get a superficial overview of the vulnerabilities of the entire system landscape. Whereas e a pentest, on the other hand, is suitable for performing a more in-depth analysis of assets.

So How do I Maximize the Security of my Assets?

With the ever-increasing risk of security breaches and the ever-growing threat, performing an automated vulnerability scan on a regular basis is a must for any organization. However, even the most accurate vulnerability scanners cannot replace human expertise. Therefore, they should be combined with regular penetration testing, which can find vulnerabilities that scanners fail to detect. Vulnerability scans cannot replace the importance of penetration testing, and penetration testing alone cannot secure the entire network.