Breach and Attack Simulation VS Pen Testing: What’s The Difference

Gartner research analysts Augusto Barros and Anton Chuvakin call for action on threat simulation and Breach and Attack Simulation (BAS) technologies. Their concerns regarding these technologies have also been brought up by many security leaders. Thus, we thought it would be fitting to discuss our perspective on different security testing services including BAS and penetration testing. 

Let’s have a look at different approaches to ensure cyber security:

Penetration Testing 

Penetration testing is a manual testing approach that evaluates the security of an environment by exploiting vulnerabilities in a system or software application. Typically, pen tests are performed once or twice a year, or even quarterly in the case of organizations with stringent security compliance standards. It focuses on external attacks and has certain objectives due to the impact and risk to users and networks. They are used to test whether an organization’s networks, hardware, platforms, and applications are vulnerable to an attacker.

Vulnerability Scanning 

Vulnerability scanning involves the identification of vulnerabilities associated with vulnerability management systems. Since these systems do not incorporate context, their output may not reflect the security risks. Even if security experts achieve patching all vulnerabilities, it does not indicate a truly secure environment. For instance, attackers can take advantage of weaknesses such as phishing attacks and data exfiltration. 

Breach and Attack Simulation (BAS)

Gartner identified a new technology known as Breach and Attack Simulation (BAS) in its Gartner Cool Vendor report. BAS enables organizations to quantify security effectiveness by simulating hackers’ breach methods which ensure the security control work as expected. This ability to assess security eliminates bottlenecks and provides actionable results. 

Red Team Assessment

Red team assessments are similar to penetration tests, but they are designed to specific scenarios such as accessing a critical server or business-sensitive application. Red teaming projects focus on emulating an advanced level threat actor using stealth and identify gaps in an organization’s security strategy. The effectiveness of this strategy can drive a better understanding of how a business will detect and respond to real-world cyber attacks. Almost all organizations have red teams yet it is a challenge for them to build these teams as there is a shortage of engineers with the required security skillsets. 

Growing Demands to Utilize BAS 

Over the past few years, attack simulation has become a hot area of development as organizations seek ways to improve their network security and identify security issues before the attackers do. Companies are looking for security testing services to secure their defenses and ensure a secure software experience. On the contrary, red-teaming is the practice of exploiting system vulnerabilities to help find and fill security gaps. Security red teams engage in full penetration testing, that most organizations can afford to perform regularly. Large enterprises and software companies secure their systems with maintained internal red teams but startups and small businesses need to hire services for checking their systems for potential risks and weaknesses. Red teaming is a point in time attack to help organizations understand how their IT teams will react to a real-attack, to test their defense readiness. The goal here is not to find a broad range of vulnerabilities, rather a successful breach to assess how the organization would react to it. It is an active attack to test active security defenses. 

Scope of Automated Penetration Testing

In an automated pen test, the scope for a test is set and objectives are assigned. The result of an automated test is a binary answer if a tester achieved the objective. It helps in addressing questions such as can an attacker gain access to a system, and how? With the help of automated pen tests, the load on manual pen testers is relieved. These tools provide customization options for pen testers to set their scope and objectives accordingly. Using these automated tools, testers identify the gaps in security controls and solutions to strengthen them. 

Scope of BAS

BAS follows a different approach by testing individual security control and provides solutions to secure each control. It can be performed in the following three ways:

• Test the efficacy of individual security controls including endpoint, web gateway and web application firewall. 
• Test the security posture of an organization against a list of possible risks and threats
• Identify all possible lateral movement with a broad scope leveraging techniques used by pen testers

BAS is automated and is accessible by various skill-level experts as it relies on analysts and developers and not the expertise of the end-user of an application. It provides a report based on tests that mimic reality and they are not limited to the scope of a pen test. Security teams should adapt defenses to protect the business environment when providing security testing services to organizations. BAS can be performed as frequently as a company wishes to, which is not possible in case of automated pen-testing. Once these tests attacks are simulated, an organization will have a picture of what their security stature looks from the perspective of an external attacker and their response to withstand these types of attacks. 

Is BAS Expected to Kill Pen-Testing?

The growing demand for BAS raises an interesting discussion about the role of pen-tests which are believed to be affected. Pen-testing focused on vulnerability finding without an intent to replicate threat behavior will no longer exist. Instead, companies will hire security testing services to replicate the approach and methods of real threats. This is one growth factor that can replace pen-testing. BAS automates a simple pen test, performing scans until everything is thoroughly checked. If software testing companies have the option of getting all that done with a simple click of a button, why would they prefer manual pen testers? Thus, BAS is the new tool of this era that provides consistent, faster and better results, with fewer skills required.