Audit, Assessment or Pentest — Can you use them interchangeably?
Ever wondered the difference between a cybersecurity audit, vulnerability assessment and pentest?
We all did — but let’s stop right here. We’ll clear that out right away.
| Hi everyone! I’m Gopi Gor, a cybersecurity enthusiast, who often has silly ideas (or maybe smart ones) and this blog explores the difference between a cybersecurity audit, vulnerability assessment and a penetration test.
Let’s go over some quick definitions for each of them.
- Cybersecurity Audit — An assessment done to evaluate the effectiveness of the current security controls, policies, procedures and compliance with existing standards.
- Vulnerability Assessment — As the word suggests, this assessment identifies the potentail vulnerabilities or weaknesses that may exist in the systems or networks of an organization.
- Penetration Test — Now this one is a simulation. A simulation of a real world attack, to identify the vulnerabilities and identify their impact.
Audit vs. Vulnerability Assessment vs. Pen Test
The purpose of each of these differ, who performs it and what they uncover each depend on which of these are being performed. Let’s look at a real-time scenario which would give you the answers that might have left you wondering most times.
Get Gopi Gor’s stories in your inbox
Join Medium for free to get updates from this writer.
Consider a healthcare institution, one that holds sensitive patient records in their HRM system, which at all times must be kept secure and confidential. In this scenario, let the HRM system with the records be the application that we are testing for all three cases.
- First, the internal team, or external in some cases, would do a Vulnerability Assessment, to identify the vulnerabilities, document them, and give solutions to mitigate them. But stop. This team doesn’t fix any of these. This assessment is done to just FIND out the vulnerabilities that exist in that current HRM system. Weaknesses that could be used to exploit the system and gather sensitive information stored in it. The main purpose of this is to IDENTIFY VULNERABILITIES that cause pose a risk to an organization.
- Now let’s bring the Penetration Testing team in, so what different are they doing? They are actually using this list of potential vulnerabilities in the system, and running a simulation of a real-time attack that could exploit these vulnerabilities. This allows us not only to identify the vulnerabilities, but also see to what level they can be exploited based on the current security posture of the organization. The main purpose of the penetration test therefore, is to test the vulnerabilities, as well as dive into the level of security needed to improve the posture.
Once this is done, the teams usually work internally with their IT and Security to ensure that the recommendations, mitigations, patches or required measures are applied.
- Now imagine 6 months have passed by, and instead of doing both kinds of tests all over again, they want to evalue their current security posture, along with verifying if they are complying with the required industry standards.
This is where the Cybersecurity Audit team comes in. This team is usually an external team, one from consulting companies or market leaders in running audits like Deloitte, or KPMG. They will go over not just technical controls, but admin and physical controls as well. This means physical access control methods, security guards, defenses, and compliance with regulatory frameworks such as HIPAA for this healthcare institution. They are the ones who usually make the final report on the basis of the findings, and suggest improvements that may be required.
Knowing the difference between these common cybersecurity processes, it itself the first step in securing your environment and organization.
My next blog is going to dive deeper into what an actual Cybersecurity audit looks like, and the 3 main sections that go into a successful audit.
Stay tuned, and make sure if you guys found this blog informative, follow me, and hey, don’t forget to give me a clap!
