Protecting a digital network is a persistent challenge for any modern business. All responsible managers today understand the vital importance of maintaining constant active measures to ensure the integrity of the company’s system.
There are, broadly speaking, two methods out there to assess a system’s strength in holding up against attack and malicious programs: The Penetration Test and the Vulnerability Scan.
These terms are often used interchangeably by people who’d like you to believe they’re more or less the same thing. They’re not.
Penetration tests and vulnerability scans are similar in that they are both designed to detect potential flaws in a system’s current configuration. But fundamentally the two are significantly different.
Understanding the vital differences between a penetration test and a v-scan can help you achieve the most for your network security and deploy your IT resources with top efficiency.
(NOTE: If you’re considering a penetration test, our free tool below matches you with top-rated pentest firms that fit your budget.)
Outcomes For a Penetration Test vs Vulnerability Scan
So let’s start with the basics: What do these two procedures actually do?
Simply put, penetration tests are simulations designed to play out the same scenarios a hacker would use to break into a network. These simulations aim to identify security issues early on before hackers can find and exploit them.
Vulnerability scans–sometimes called vulnerability assessments–involve running a program that assesses computers, systems, and networks for security weaknesses. Typically, a vulnerability scan will focus on one or more specific network devices such as firewalls, routers, switches, servers, or other types of embedded applications.
The difference that makes penetration testing distinct from a vulnerability scanning tool, is the human element.
While many available vulnerability scanning programs are good at detecting predetermined issues, they will not replicate the methodical steps a real-world hacker will use to penetrate a system.
So in summary:
An effective vulnerability scan will tell you whether or not your system contains specific flaws and vulnerabilities.
A pen test, if executed well, can give insight into a full range of potential exploits and how to defend against them.
Method
These differences show up in how these two processes are executed and applied.
Vulnerability Scanning Method
Vulnerability scans are automated procedures. A pre-set program called a vulnerability scanner identifies and creates an inventory of all systems and applications connected to a network. For each of the devices it scans, the program attempts to pinpoint the operating system that is running it and the software installed on it. Additionally, it also looks for other attributes such as open ports and user accounts that could create vulnerabilities for the network.
After the initial scan, the program will have a full list of the items operating on the network. The scanner will then check each item in the inventory against one or more databases of known vulnerabilities.
The deliverable of the completed scan process is a list of all the systems, apps, and other elements found and identified on the network, highlighting any that have known vulnerabilities that need attention.
Keep in mind, vulnerability tests can be executed in one of two ways:
You can hire a professional scanner in the same way you contract a pen tester. There are firms that specialize in providing v-scans, typically at a bundle rate of a certain number of scans per month.
But because vulnerability scans are automated and don’t require nearly as much technical know-how, you can also do it yourself. The market for vulnerability scan software is pretty vast and offers quite a spectrum of options. Anyone with a half-decent IT team or a bit of computer knowledge themselves can deploy these programs. Additionally, many v-scan tools are cloud-based so they don’t actually require purchasing software, either your own licensed version or as a SaaS.
Penetration Testing Method
As we mentioned before, penetration testing is essentially a cyberattack on a digital system–the only difference being the people trying to gain access aren’t actually trying to rob any data or otherwise harm the network.
How does that play out?
First, an experienced developer will define the goals of the testing exercise. This includes which elements of the system will be assessed during the test. This is actually a very crucial aspect of the test that you and your contracted tester will have to work out. But more on that in a bit.
Next comes the reconnaissance stage.
Here, the analysts will collect intelligence on the network and its vulnerabilities. This can include assessing the apps embedded in a system for known weaknesses and the way user account structure is built. The goals here are to get as much data as possible for identifying potential vulnerabilities to exploit and create attack plans for execution.
Finally, the developers in charge of testing will execute attacks they believe have a chance of penetrating the network. If any of these attacks are successful, the testers will then move on to determine what’s called the persistence factor. This means assessing how long it takes for security protocols, either automated or human-initiated, to kick in and respond. In this way, pen testers will mimic the techniques of cybercriminals who will try and wrest control of a network for as long as possible and hide proof of their intrusion. The length of this ‘persistence testing’ is one of the major factors in the time duration of penetration tests.
Costs
Like many IT investments, there is a significant range of prices, for both pen tests and v-scans, based on the quality of the service you’re getting and the characteristics of your system.
Penetration Testing Costs
To give a ballpark figure, for the typical small to medium business, penetration testing costs can run between $4,000 at the lower end, to $40,000. The most important factors determining the exact number are the size of the organization and its complexity. Companies that have a wider array of components–mobile apps, internal and external servers, and other complex computer systems–are going to require a higher budget.
Last but not least, the scope of a pen test will greatly influence the price. As we mentioned before, the initial stages of executing any penetration test involve the testers determining what type of vulnerabilities they’ll be looking for. Very rarely will any company want the ‘full package’ of tests. Rather the testers and the client will work together to determine what type of cyber threats are most relevant to this particular system.
It’s important to make a point of discussing this with your tester as early as possible as this is going to be an important deciding factor not only for the scope of the test but for the price as well.
>>> We’ve also written at length about the costs of network penetration testing here.
Vulnerability Scan Costs
Just as with pen tests, v-scans also have a significant range in terms of pricing.
The factors that determine those prices however are not exactly the same.
When contracting a v-scan, the number of scans per month / per year will be the most significant factor.
The second factor is the quality of the scan. Typically speaking the quality of a v-scan relates to the database of vulnerabilities the program is basing its assessment on. If the service provider has access to multiple reputable databases, this will produce a more reliable scan.
So, to give an idea of what the price range is:
There are some services that will charge you as low as $1,000 a year which will include a pretty high number of scans per month. As you might have guessed, this low end of the market will not give you a particularly high-quality scan.
Industry-standard level scanners like BurpSuite and Frontline Vulnerability Manager are going to run closer to $3,000 – $4,000 for a yearly subscription.
>>> For a full breakdown of the costs of vulnerability assessments, see this article.
When to Use Which
Going through this article, you’ve probably understood by now how v-scans and pen tests are vastly different from each other.
Vulnerability scans are automated programs designed to look for a narrow range of specific problems while pen tests are extensive operations that are levels above the average v-scan in terms of their thoroughness.
But it would be a mistake to walk away thinking pen tests are ‘better’ than vulnerability scans. That would be like saying a hacksaw is ‘better’ than a table knife.
The magnitude and power of the tools you use are determined by what exactly it is you want to do.
Not all system assessments require a full-blown pen test. In fact, for many aspects of network testing, it’s much more effective and efficient to run a vulnerability scan.
Furthermore, as we eluded to earlier, vulnerability scanning does have a key advantage that penetration tests do not.
Because they are executed via automated programs that are run on the system being tested, vulnerability scans are relatively easy to scale. When dealing with a large network–like a corporate-sized project for instance–there can literally be dozens of applications running on hundreds of machines and devices across thousands of accounts.
Running an automated program that requires little to no human input is the only efficient way of scanning all of these individual elements.
So let’s break this down.
When to Contract a Vulnerability Scan
There are a few circumstances where a v-scan should be a company’s go-t0.
First and foremost is to satisfy specific compliance demands. Many industries are required by law to undergo certain system security checks and these can be satisfied by v-scans.
For example, if your organization processes cardholder data, you are subject to the PCI Council standards (PCI DSS) and therefore required to conduct vulnerability scans every quarter and after any significant changes to your network.
The second is when a company wants to test a high number of elements within an enterprise network. As we’ve mentioned, the main advantage of a v-scan is its high volume capacity. So if a company is managing a large number of digital assets like many different online applications and multiple websites, vulnerability scanning will simply be more efficient.
When to Contract a Penetration Test
Penetration testing is important since it’s the only method for ensuring no anomaly problems exist within a network. In other words, new and complex threats require expert cybersecurity consultants to manually identify and assess.
What this means for companies is that whenever implementing a new set of processes, management-level systems, or any other major level changes to a network, it is worthwhile to contract a pen test. New companies for instance that are just getting started should also consider hiring a pen tester to get an idea of how their newly assembled network stands up to attack.
But remember, when considering pen tests and v-scans, it’s not an either-or question.
Both vulnerability scanning and penetration testing can form an important part of your cyber risk management.
Subscribing to a v-scan service offers you the regular ‘check-up’ style tests to ensure your systems are maintaining baseline security. Conversely, pen tests constitute the thorough, high-level assessments needed to protect against more advanced threats.
By understanding the unique IT and security requirements of your company and planning with your prospective service providers, you can find the best way to integrate both of these important tools into your cyber strategy.
