Call us on 03450 21 21 51

SRM Solutions
What is a vulnerability assessment and how should you use it?
The SRM Blog

What is a vulnerability assessment and how should you use it?

Julia Wailes-Fairbairn

Written by Julia Wailes-Fairbairn

29th March 2019

Share this article

If your business is a house, with all that you hold precious contained inside it, then a vulnerability assessment is the regular checking of doors and windows to ensure that they are firmly locked. While this can be done routinely by the residents, it is often difficult for those who are familiar with the layout and construction to see the building from every angle or foresee its actual vulnerabilities.

A vulnerability assessment is the information security equivalent of a household security check. Also known as vulnerability scans, these assessments evaluate computers, systems, and networks for security weaknesses; also known as vulnerabilities. The benefits of a vulnerability assessment are obvious: quick, affordable and because they are automatic, they can be scheduled to run on a regular basis. To configure a vulnerability assessment, you usually set up an account with an automated scanning tool and enter the details of the device (or devices) that you want to assess – and off you go.

But beware: vulnerability assessments may provide false reassurance. They are a passive approach to vulnerability management, because they don’t go beyond reporting on vulnerabilities that are already known to exist and have been detected. The scans are generally of a prescribed nature, in that they are checking for known issues and patches according to a database. They do not inform about the potential exploitation of vulnerabilities nor about vulnerabilities that have not already been identified in the wild.

This is especially the case for custom coded applications as it’s unlikely the code base would have been checked by a security professional. Vulnerability assessments may provide part of the story but they do not provide a complete picture. By their very nature, they cannot understand or anticipate the complex ingenuity of sophisticated human hackers. It simply shows you where your weaknesses may be.

A penetration test on the other hand, simulates a hacker attempting to get into a business system through the exploitation of vulnerabilities, which is why the process is sometimes referred to as ‘ethical hacking’. But unless properly scoped by experienced professionals, a penetration test is limited by what it is asked to do. Because it cannot think for itself. This is where the value of ‘scoping’ comes in.

A correctly-scoped penetration test utilises the most important tool in the penetration test armoury: the human mind. A penetration tester will often start out with a similar set of tools, including the use of a vulnerability assessment but this is where the penetration test deviates and begins to delve much deeper in the security of a network, applications and the underlying operating system.

A qualified penetration tester can think laterally; using both training and experience to analyse and synthesise. They will put themselves into the mind of a hacker and have the imagination to anticipate possible weaknesses. Penetration testers provide a deep look into the data security of an organisation and typically their reports are meticulously detailed and contain a description of attacks used, testing methodologies, and suggestions for remediation.

So how should you best use vulnerability assessments and penetration tests? Well, ideally, using both encourages optimal network security. Vulnerability assessments are great for a weekly, monthly or quarterly insight into your network security, while penetration tests are a very thorough way to really put your network security under the microscope. Of course, fully scoped penetration tests can be more costly, but having a professional examine every nook and cranny of a business’ infrastructure and systems, the way a real world attacker would, may save a great deal of money in the long run; not forgetting the value-add of a comprehensive report following the completion of a project, and the access to remediation advice or best practise advice.

SRM has many years’ experience in vulnerability assessments and penetration testing. We utilise a leading web application and infrastructure scanning tool which automates the discovery of security flaws within network perimeters to quickly identify any required remediating actions. A full no-jargon report provides details of the findings of the vulnerability assessment. Our expert team can then work with an organisation to scope and develop a penetration testing programme and put practical remediation steps into practice.

If you would like to find out more about vulnerability assessments, penetration testing and SRM’s consultancy service then please speak to Laura Chatton on 03450 21 21 21 or laura.chatton@srm-solutions.com.

Or visit our website.

Follow us on Linkedin.

Or read our blog:

It’s not a Dark Art: how we demystify cyber security

A reactive mindset is today’s biggest threat to data security

Virtual CISO: too good to be true?

PCI compliance is like car maintenance: it’s not just an annual event