Vulnerability assessments and penetration tests are complementary but should be deployed sequentially: vulnerability assessments come first, then penetration testing against hardened systems. Testing systems that have not been hardened gives predictable results, since the objective of penetration testing is to assess the strength of security defenses.
Executive Summary
Vulnerability assessment and penetration testing both serve important functions for protecting business applications against security threats. The approaches are complementary but should be deployed sequentially. Vulnerability assessments should be performed ahead of penetration tests, because penetration testing against systems that have not been hardened based on the results of vulnerability assessments is inadvisable and the results are predictable. Comprehensive vulnerability scans inform organizations of configuration, program, user and other weaknesses that could be exploited to compromise systems during real or simulated attacks. The resulting recommendations enable organizations to remediate security weaknesses using a prioritized approach and support countermeasures to detect and respond to potential attacks. Once systems are hardened and defenses are prepared, a penetration test is a valuable exercise to test the adequacy of security mechanisms. Testing hardened systems that are actively monitored for attacks forces pen testers to use more complex attack vectors and evasive techniques to avoid detection. This improves the quality and reliability of penetration test results, providing a stronger litmus test for system security, threat detection and incident response.
Key Takeaways
- Vulnerability assessment and penetration testing are complementary but should be deployed sequentially.
- Vulnerability assessments should be performed ahead of penetration tests.
- Penetration testing against systems not hardened from assessment results is inadvisable because the results are predictable.
- Vulnerability assessment recommendations let organizations remediate weaknesses using a prioritized approach.
- Testing hardened, monitored systems forces pen testers to use complex attack vectors and evasive techniques.
How do vulnerability assessment and penetration testing differ?
Vulnerability assessment and penetration testing are complementary approaches that both protect business applications against security threats, and they should be deployed sequentially. The following table compares the two approaches, based on the role each plays.
| Approach | When it is performed | What it does | What it produces |
|---|---|---|---|
| Vulnerability assessment | First, ahead of penetration tests | Informs organizations of configuration, program, user and other weaknesses | Recommendations to remediate weaknesses in a prioritized approach |
| Penetration testing | Once systems are hardened and defenses are prepared | Tests the adequacy of security mechanisms | Lessons learned for areas overlooked or inadequately secured |
Why should a vulnerability assessment come before a penetration test?
Vulnerability assessments should be performed ahead of penetration tests because penetration testing against systems that have not been hardened based on assessment results is inadvisable, since the results are predictable. The objective of penetration testing is to assess the strength of security defenses, not to exploit ill-equipped and unprepared systems and processes to prove a point.
What does a vulnerability assessment deliver?
The results of comprehensive vulnerability scans inform organizations of configuration, program, user and other weaknesses that could be exploited to compromise systems during real or simulated attacks. The recommendations enable organizations to remediate security weaknesses using a prioritized approach. They also support the implementation of countermeasures to detect and respond to potential attacks.
When is penetration testing valuable?
Once systems are hardened and defenses are prepared, performing a penetration test is a valuable exercise to test the adequacy of security mechanisms. The lessons learned from the discovery and exploitation of vulnerabilities during penetration tests can be applied to address areas that may have been overlooked or inadequately secured after vulnerability assessments.
How does testing hardened systems improve penetration test quality?
Penetration testing against hardened systems that are actively monitored for attacks forces pen testers to exercise more complex and difficult attack vectors. It also compels pen testers to deploy evasive techniques to avoid detection.
This improves the quality of penetration tests and the reliability of the results, providing a stronger litmus test for system security, threat detection and incident response.
Frequently Asked Questions
Should vulnerability assessment or penetration testing come first?
Vulnerability assessments should be performed ahead of penetration tests. The two approaches are complementary but should be deployed sequentially, because penetration testing against systems that have not been hardened based on assessment results is inadvisable and the results are predictable.
What is the objective of penetration testing?
The objective of penetration testing is to assess the strength of security defenses. It is not meant to exploit ill-equipped and unprepared systems and processes to prove a point, which is why systems should be hardened first.
What do vulnerability assessments tell an organization?
The results of comprehensive vulnerability scans inform organizations of configuration, program, user and other weaknesses that could be exploited to compromise systems during real or simulated attacks. The recommendations enable prioritized remediation and support countermeasures to detect and respond to potential attacks.
Why test systems that are hardened and actively monitored?
Penetration testing against hardened systems that are actively monitored for attacks forces pen testers to use more complex and difficult attack vectors and evasive techniques to avoid detection. This improves the quality and reliability of the results, providing a stronger litmus test for system security, threat detection and incident response.