Theres a lot of confusion out there still even amongst security professionals as to the difference between penetration testing (pen test) and vulnerability assessment (va).
The difference is quite significant, the two items can be described as follows.
Vulnerability Assesment
Wikipedia describribes a vulnerbility assesment as "the process of identifying, quantifying and prioritising (ranking) the vulnerabilites on a system".
I could not agree more and more importantly, the definition is not tied to any specifics such as, its internet visibility only, or its done on internal only and so on. The scope of the assesment can be anything you like and the indentification of a vulnerability is not tied to just detection from a scanning tool.
So what does this mean to the security analyst in reality?
Normally, the VA is a passive, non intrusive assesment and the key word here is 'assesment'.
Lets consider the below simple but all too common example. When we conduct our assesment, we must quantify and prioritise, once done we can begin to plan and mitigate the issues.
Example: A Microsoft web server exploit published, your Microsoft web server is assessed as being vulnerable, the web service on the server is internet visible, exploits are confirmed available to attackers to exploit the web service, the server handles credit card transactions!
Clearly, in the above example, the risks are pretty high including the liklehood of being exploited on a server which (you would hope) is deemed critical due to credit card details. Had the server not been internet visible, such as a private intranet, the risk would be lower, becuase we have quanitifed the issue, we can now proritise and create the remediation and mitigation work accordingly.
Vendors also often refer to vulnerability assesment, these are usually (but not restricted to ) vulnerability scanning vendors or patch managment vendors. Both are vaild for VA. In the above example, if using a scanner, the vulnerability will be detected and then the VA process would kick in. With Patch Managment, you are simply getting the same information but in another way, at which point the assesment process kicks in again. Most companies do both scanning and patch management, its two ways of constantly evaluating your vulernabity exposure, its two persepectives from which to detect vulnerabilites. Patch management does not always tell you that there is an issue, specially if vendors do not have a patch ready to deploy. Scanner's also can miss things depending on the frequency and visitbility that the tools have to test and also if there is no actual exploit to create a test with.
Dont forget, these solutions can be used both proactively as well as reactively. If your concerned about a server , you can scan it and run a patch report and produce a VA in no time. There are many other ways to assess yourself for a vulnerability and many tools and services with which to do it, e.g. Integrity checking, compliance mangemnt, Anti Virus and of course, a Penetration Test !. Also worth noting is that the status of any vulnerability ( or not) can change at any point so regular assesments are required.
Penetration Testing
Again, according to wikipedia, the following is a description of what a penetration test is;
"A penetration test is a method of evaluating the security of a computer system or network by simulating an attack by a malicious user, known as a cracker (though often incorrectly referred to as a hacker). The process involves an active analysis of the system for any potential vulnerabilities that may result from poor or improper system configuration, known and/or unknown hardware or software flaws, or operational weaknesses in process or technical countermeasures. This analysis is carried out from the position of a potential attacker, and can involve active exploitation of security vulnerabilities. Any security issues that are found will be presented to the system owner together with an assessment of their impact and often with a proposal for mitigation or a technical solution. The intent of a penetration test is to determine feasibility of an attack and the amount of business impact of a successful exploit, if discovered."
Yet again, we find ourselves agreeing with this description. The first diffierence with VA is that a penetration test is 'active' whereas a VA is passive and non-intrusive.
The next difference is that a penetration test may use the holes discovered in a VA to verify risks and exposures by exploiting the hole ( this is what makes it active or intrusive). Penetration testing methodlogies do have in their process a vulnerability assessment, this is one of the first steps when testing becuase you have to find the potenital holes in security in order to penetrate!
A penetration test can have a scope of testing which can be internet only, internal only, both and anything else that you want to simulate. Unlike some explanations I have heard, a penetration test is not restricted to just the hackers view from the internet. Infact, I have conducted many Pen Tests to verify and assist with the lock down and hardening of a new platform or service (in complete privacy) before it goes live.
The scope of a penetration test can literally be anything from a vulnerability assessment to fully exploiting the targets to destructive testing.
