Vulnerability Assessment and Penetration Testing

Difference between vulnerability assessment and penetration testing

Vulnerability assessment is an exhaustive inspection of the entire system, while penetration testing is a simulation of a specific problem.

To use an analogy, vulnerability assessment is like checking the keyholes of a house one by one to see if there are any keyholes (system vulnerabilities) that can be opened with a known key (attack tool). Penetration testing, on the other hand, simulates a burglar (attacker) attempting to break into a house, prying open the windows and keyholes of the house, and so on, to see how effectively the house security system can prevent burglary.

Vulnerability assessment and penetration testing should be used differently because the methods used and investigated in each are different.

▼ Vulnerability Assessment (Web Application Assessment and Platform Assessment)

▼ Penetration Testing

Vulnerability Assessment (Web Application Assessment and Platform Assessment)

In the Web Application Diagnostics, we investigate each company's own web applications. Platform Diagnostics" examines the operating system (OS), middleware, and network components installed on the server.

Features of the "Web Application Diagnosis" Service

FRONTEO's expertly trained diagnostic technicians identify potential security problems in web applications and websites and provide advice on necessary countermeasures.

Overview of the "Web Application Diagnosis" service

img_idx_0301

We perform inspections via the Internet using our own inspection tools to ensure standardization of quality and comprehensiveness of diagnosis items.
Specialized technicians perform manual inspections while considering the structure of the application, making it possible to detect vulnerabilities that are difficult to detect with conventional diagnostic tools.

In addition, we not only investigate the existence of vulnerabilities, but also verify the specific impact of the vulnerabilities on the customer's system. The report is prepared in an easy-to-understand manner, including a 5-point evaluation by an engineer, an overall assessment, an explanation of the vulnerability and risk (degree of impact), and countermeasures, and includes screen captures.

＞Click here for details of Web Application Diagnostic check items.

Features of the Platform Assessment Service

In addition to vulnerability scanner-based diagnosis, FRONTEO also performs manual diagnosis by technicians. This service can "reduce the risk of vulnerability omissions and false positives" and "detect vulnerabilities that cannot be detected by diagnostic tools," which are not possible with vulnerability scanner-based diagnosis alone.

Overview of "Platform Assessment" Service

An independent and professional third-party evaluates OS and various server software for vulnerabilities. We investigate whether unnecessary services are operating or being disclosed, as well as whether mail relaying, DNS recursive queries and zone transfers, and web content and various services that do not need to be disclosed are inadequately configured. If vulnerabilities are detected as a result of the diagnosis, we will present remedial measures that take into account the configuration and environment in which the service is provided, along with the details of the vulnerabilities and possible risks, to help improve the security level.

>Click here for details of inspection items of platform diagnosis.

penetration test

Service Features

FRONTEO conducts objective evaluations of attack resistance and security levels by simulating attacks on the client's systems (servers and network equipment) on par with attackers. We provide system enhancement measures.

Service Overview

We verify the vulnerability of target servers and network devices via the Internet or from a specified internal LAN segment, using multiple tools and manual operations.

In addition, we verify whether or not an attack is possible by using programs or original scripts that allow intrusion into the server by taking advantage of known vulnerabilities disclosed on the Internet.