Navigating the various types of Security Assessments and selecting an IT security service provider can be a daunting task; however, it does not have to be. Understanding the available services and defining your organization’s needs at the beginning can help you get started on the right foot, which will ultimately save both time and money.

Know what types of services are available.

In order to choose the best security service for your needs, you should first be aware of some common industry terms surrounding security assessments.

Vulnerability Assessment
A periodic vulnerability assessment will help to ensure your system’s integrity, and is a crucial component of a well-managed information and technology security strategy. The vulnerability assessment allows a technical security consultant to identify risks within your system in a manner that is non-intrusive. It is the simplest security assessment available, and in today’s fast-paced e-commerce marketplace it has become more important than ever.

How does it work?
Vulnerability Assessment identifies, quantifies and prioritizes weaknesses and potential risks that could compromise your enterprise network and systems. The primary vulnerabilities uncovered in a vulnerability assessment can be categorized as unpatched or obsolete software, poorly configured systems, and missing or poorly configured security protocols.

A Vulnerability Assessment is an unobtrusive way to obtain insight into areas that are potentially exploitable by both authorized users and attackers.

Penetration Test
During a penetration test, (commonly referred to as a pen test), organizations identify a domain or range of assets to be tested. A technical security consultant takes the position of a possible attacker, performing an actual attack or attempted penetration via the points of weakness identified by your organization or within in the vulnerability assessment (see above). If an attack is successful, the technical security consultant will examine the effects of the attack and assess the impact an information security breach could have on your organization.

How does it work?
Differing from the Vulnerability Assessment, a penetration test actually infiltrates the system. Identified vulnerabilities are penetrated, and then evaluated based on potential business impact if exploited. Findings are presented along with a detailed approach for mitigation.

Taking the vulnerability assessment one step further, a penetration test is an invaluable component of a comprehensive technical security assessment. A Penetration Test is a method of evaluating the security of a computer system or network by simulating an attack by a malicious user. It confirms the legitimacy of potential weaknesses identified in the vulnerability assessment and quantifies potential business impact if exploited.

Web Application Test
Most businesses today employ web-based applications for sales, marketing, accounting and othervarious business functions. While these applications have many benefits, including the convenience of online accessibility and enhanced team collaboration, they can also expose an organization to vulnerabilities that could be leveraged to gain unauthorized access to network resources or sensitive data. A Web Application Assessment allows for the discovery of vulnerabilities that exist in web-based applications and provides strategies to protect the organization against identified points of weakness.

How does it work?
There are two types of application testing designed to identify potential weaknesses in specific web applications. Web application vulnerability assessments and web application penetration tests are performed similarly to their non-application specific counterparts while they focus on discrete applications in order to analyze their security.

Web application testing will allow an organization to determine the security level of its web-based applications. Upon completion of the assessment, the technical security consultant will recommend mitigation strategies to maximize your system integrity and security.

Consider your testing options.

When considering a Vulnerability Assessment, Penetration Test or Web Application Testing you will also want to determine whether to conduct internal testing, external testing, or a combination of both.  Click to read more about choosing the right security assessment for your business, or contact us to learn more.