What is a Vulnerability Scan?
A vulnerability scan, also known as a vulnerability assessment, is an automated test that looks for and reports potential vulnerabilities within a system. Vulnerability scans are a passive approach to vulnerability management since they don’t go beyond reporting on vulnerabilities. And since they do not go beyond reporting, scans are generally quick. The time required depends on the size and complexity of the system being scanned.
What is a Penetration Test?
A penetration test, also known as a pentest, is made up of many manual tests which are intended to exploit the vulnerabilities in a system. A penetration test simulates what a hacker would do and see when attempting to hack into a system. Penetration tests are an extremely detailed way of finding vulnerabilities within a system and because of the depth the test goes into, it takes longer than a vulnerability scan.
Before starting a penetration test, the penetration tester would need to conduct information gathering on the system, i.e., searching for information leakage, identifying the type and version of the server, search for vulnerabilities. Once the information gathering process is completed, the penetration tester can begin the penetration test and attempt to prove that the vulnerabilities found can be exploited.
The Main Differences
A vulnerability scan takes less time to complete than a penetration test since the test does not go into as much detail as a penetration test would. Since the vulnerability test only scans the system for vulnerabilities and does not exploit it, it allows for a lot of false positives. Whereas with a penetration test there are less false positives because of the depth it goes into. Due to the amount of human effort and level of skill required for each assessment, the vulnerability scan is generally cheaper than a penetration test.
Can a penetration test be fully automated to save time and money?
Although the bulk of identifying vulnerabilities can be automated, there are some scenarios that cannot currently be fully automated. An example of this is the insecure storage of user credentials. This is where passwords are not hashed but stored in plain text or are only encrypted. The encryption could also be using an insecure hashing algorithm. An automated web vulnerability scanning tool will not be able to determine how user authentication details are stored in a web application backend database.
When a penetration test is conducted manually, less false positives are found and therefore the results from the test are more accurate. Manual testing also verifies that vulnerabilities are actual vulnerabilities and not false positives. A common false positive that could be avoided through manual testing is CSFR (Cross-Site Request Forgery).