Confusion between Vulnerability Assessment and Penetration Testing

There has always been a fair amount of confusion between Penetration Testing and Vulnerability Assessments. In India however the problem takes a new turn with vendors confusing between the two.

I was recently in a meeting with a potential customer and we were discussing their current vendors and what they provide in their Penetration Test. As I glanced over the reports I noticed that the service provided was purely a Vulnerability Assessment masquerading as a Penetration Test. The particular vendor in question had only conducted a port scan followed by listing possible vulnerabilities that exist for the service and operating system versions identified.

In my opinion I would barely even classify this as a Vulnerability Assessment. A Vulnerability Assessment Engagement from Security Brigade goes through the following phases:

• Pre-Assessment Analysis
• Information Gathering
• Port Scanning
• Enumeration
• Threat Profiling & Risk Identification
• Network Vulnerability Assessment
• Application Vulnerability Assessment
• Engagement Analysis
• Mitigation Strategies
• Report Generation
• Support

A Penetration Testing Service however goes many steps further with the following phases:

• Pre-Assessment Analysis
• Information Gathering
• Port Scanning
• Enumeration
• Social Engineering
• Threat Profiling & Risk Identification
• Network Vulnerability Assessment
• Application Vulnerability Assessment
• Exploit Research & Development
• Exploitation
• Privilege Escalation
• Retaining Access
• Network Propagation
• Engagement Analysis
• Mitigation Strategies
• Report Generation
• Support

The difference can be clearly seen in the fact that a Penetration Testing goes further after analyzing the vulnerabilities into exploitation, privilege escalation, retaining access, network prorogation etc. Simply put a Vulnerability Assessment provides an overview of the flaws that exist on the system while a Penetration Testing goes on to provide an impact analysis of the flaws identified, the possible impact of the flaw on the underlying network, operating system, database etc.

I believe it is fairly important for Clients and especially Vendors in India to understand the difference and represent the two services in their traditionally accepted form. I believe this is a crucial step for Indian IT Security to take a step forward and providing real security to customers.

One of the white papers that I am currently working on specifically looks at the difference between Vulnerability Assessments and Penetration Tests with a focus on:

• What is covered by each service
• What factors should be considered while determining their requirements
  
• How a Client can determine their requirements
• Comparison of the benefits and draw-backs of both the services
• etc.

The paper should be released sometime this month and can be found on Security Brigade's website.