Where Vulnerability Assessment is a more passive and analytical process, Penetration Testing is an active attempt to break through network defenses (ethical hacking), focusing attack attempts on the network, web applications and other organizational applications and entry points. This is a damage-free exercise, only to test if security measures are sufficient against a simulated real-world attack.
To uncover what information (public or private) an attacker can gain from an organization via an attack originating externally, this External Penetration Exercise will be conducted without any internal access “assistance” to simulate exploits against Internet-facing digital assets (e.g., web applications, web servers, network endpoints, VPN, e-mail servers). The majority of hacking attempts are simulated by this external test.
To simulate “insider attacks” (e.g., guests entering the organization’s physical boundaries including wireless range, malicious staff or other insiders, and even the scope of access an attacker gains once the external defenses are breached), this Internal Penetration Exercise is performed within premises. Focus is on workstations, internal applications, access controls, domains, and internal documents, to identify vulnerabilities of sensitive information and controls.