Vulnerability scans and penetration tests are automated processes that assess systems for known vulnerabilities and provide risk exposure reports. These assessments are necessary for compliance with PCI DSS standards and are typically performed annually, requiring expertise and specific scanning tools like Rapid7 or Nessus. They help identify weaknesses in security settings, including password vulnerabilities, and may involve the use of external auditing firms to interpret results.

1. Type
VulnerabilityScansPenetrationTests
- Scans system for known vulnerabilities
- Provides reports on risk exposures
- Automated process, per the business?s
choice
- Searches network devices like routers,
servers, firewalls and switches
- Requires a program like Rapid
7, Nessus, Retina and Qualys
for the scan
- Auditing firms can help
organizations sort out the
results to learn more about
their system and whether it is
sufficient for operations
- Requires expertise and planning
- Performed at least on annual basis
- Mandatory per PCI DSSand the PCI
Security Standards Council
- Simulates a hacking scenario
- Scope focuses on a highly valuable asset
- Exposes lax or inadequate security
settings or other unsecured business
processes
- Frequently uncovers password issues such
as reused passwords and unencrypted
passwords
- Necessary to have a
program like Core
Impact, write code
and/or hire an auditing
firm to perform the
penetration test
Vulnerability Scan &
Penetration Test Comparison
Feat ures, Funct ions,
Requirement s, Goals & Findings
Means of
Implement at ion
Vulnerability Scan &
Penetration Test Comparison
Type Feat ures, Funct ions, Requirement s, Goals
& Findings
Means of Implement at ion
Vulnerability
Scans
PenetrationTests
- Scans system for known vulnerabilities
- Provides reports on risk exposures
- Automated process, per the business?s choice
Searches network devices like routers, servers,
firewalls and switches
- Requires a program like
Rapid 7, Nessus, Retina and
Qualys for the scan
- Auditing firms can help
organizations sort out the
results to learn more about
their system and whether it
is sufficient for operations
- Requires expertise and planning
- Performed at least on annual basis
- Mandatory per PCI DSSand the PCI Security
Standards Council
- Simulates a hacking scenario
- Scope focuses on a highly valuable asset
- Exposes lax or inadequate security settings or other
unsecured business processes
- Frequently uncovers password issues such as
reused passwords and unencrypted passwords
- Necessary to have a
program like Core Impact,
write code and/or hire an
auditing firm to perform the
penetration test