Putting Network Security to the Test, Explained

UPI Study › Courses › Software Engineering › Free lessons › Lesson 12.5 Free with a free account

Putting Network Security to the Test

Software Engineering · Chapter 12: Reliability Engineering and SecuritySection 12.5 · lesson 79 of 1036 min · free with a free account

← A Survey of Information Security CategoriesNext lesson: Identifying and Managing Risk in Software Projects →

Earn 3 college credits for Software EngineeringRecommended for credit by NCCRS · Computer Science 301 · self-paced · one payment, lifetime access
Enroll in Software Engineering · $250 →Download the syllabus (PDF)

In this lesson

Believing a system is secure, and actually confirming it.

  • Explain why security needs active testing, not just review
  • Distinguish vulnerability assessment from penetration testing
  • Explain why authorization defines a legitimate test
  • Describe scope and responsible disclosure

Transcript

Everything said in the video, section by section (785 words). Read along, or search it.

Reliability Engineering and Security

Putting Network Security to the Test

Believing a system is secure, and actually confirming it, are two different things. The security categories covered earlier describe what a system should protect against. This section covers how teams actively check whether those protections hold up, against a realistic and determined attempt to get past them.

Review Isn't Enough

Secure on Paper

A design can look secure on paper, and still have real weaknesses that only become obvious when someone actively tries to break it. Security testing closes that gap. It works the same way usability testing closes the gap between a design that looks reasonable, and one that actually works for real people. Two approaches do most of this work, at increasing levels of depth. A broad scan for known weaknesses. And a deeper, active attempt to confirm which of them actually matter.

Vulnerability Assessment

Finding What Could Be Exploited

A vulnerability assessment systematically identifies and catalogs known weaknesses in a system. It typically uses automated or semi-automated scanning, looking for known vulnerability patterns, outdated or unpatched software, and weak configurations. The output is a prioritized list of potential issues, usually ranked by likely severity. What it does not do is confirm that a given weakness is actually exploitable under real conditions. It identifies what could plausibly be a problem, not what has been proven to be one.

Penetration Testing

Proving What's Actually Exploitable

Penetration testing goes a step further. Authorized security professionals actively attempt to exploit the weaknesses, and look for new ones, under controlled and explicitly sanctioned conditions. The goal is confirmation. Proving what is genuinely exploitable, and what the real consequence would be. It moves through a planned sequence. First, agree on scope and objectives. Then gather information about the target, within that scope. Then attempt to gain access through the weaknesses found. And finally, document everything in a report the system's owner can act on.

Figure 1

From Many Maybes to Confirmed Findings

Put the two together, and you get a narrowing process. The assessment is a broad scan that turns up many potential issues. Authorized penetration testing confirms which of them are actually exploitable. And the result is a report of confirmed findings, with prioritized fixes. Assessment finds what might be a problem. Testing confirms what actually is one.

Worth Noticing

Authorization, Not Intent

Here is something worth noticing. The line between penetration testing and an actual attack is authorization, not intent. The identical activity, performed on a system without explicit, documented permission from its owner, is not a test. It is an unauthorized intrusion, regardless of how the person performing it describes their motive.

Testing Responsibly

Scope First, Disclosure Last

Conducting security testing responsibly starts with explicit authorization. It is non-negotiable, and it always comes first. That means a clearly defined, agreed scope, specifying exactly which systems and methods are permitted, and which are off-limits. Testers document what they find carefully, and report it to the system's owner first, and privately. That gives the owner time to fix serious issues before any broader disclosure. This practice is called responsible disclosure. It exists so that testing genuinely improves security, rather than creating new exposure by revealing a weakness before it can be fixed.

Table 1

The 2 Approaches Side by Side

Here are the two approaches side by side. The assessment's goal is to identify and catalog potential weaknesses. Penetration testing's goal is to confirm which ones are actually exploitable. The assessment is a broad scan, typically automated. Penetration testing is a deep, active attempt, at least partly manual. One produces a prioritized list of potential issues. The other produces confirmed findings, with real-world impact and recommendations. And assessments run regularly and frequently, while penetration tests are periodic, and more resource-intensive.

Apply It

40 Flagged Weaknesses

Let's apply that. A quarterly scan flags forty potential weaknesses. A manager asks how many of them an attacker could actually use. The scan cannot answer that. A vulnerability assessment predicts what might be exploitable. Only an authorized, properly scoped penetration test confirms which ones are real. It is the same relationship seen earlier, between predicting a problem and confirming one.

Key Terms

The Vocabulary of This Section

Let's lock in the key terms. A vulnerability assessment is a systematic scan that identifies and prioritizes known weaknesses, without confirming they are actually exploitable. Penetration testing is an authorized, controlled attempt to actively exploit a system's weaknesses, to confirm what is genuinely exploitable. Scope is the explicitly agreed boundary of which systems and methods a security test is authorized to include. And responsible disclosure is reporting a weakness privately to the system's owner first, allowing time to fix it before any broader disclosure.

Key Takeaways

What to Carry Forward

To pull this together. A system that looks secure on paper is not necessarily secure when someone actually tries to break it. A vulnerability assessment is broad, and lists what might be a problem. Penetration testing is deep, and confirms what actually is one. Authorization, not intent, is what separates a test from an attack. So agree on scope first, and report what you find through responsible disclosure.

About Software Engineering at UPI Study

Software Engineering (Computer Science 301) is a self-paced online course of 103 video lessons in 15 chapters, from process models and agile to requirements, design, user interfaces, reliability, security and project management. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Computer Science courses Every course with PRO →

Compare: Software Engineering vs Systems Analysis

Why take it here

Why students take Software Engineering with UPI Study

How professional software gets builtSoftware Engineering covers how teams turn requirements into working, maintainable software: process models, agile, requirements, design, testing, reliability and project management. It is a core course in computer science and software degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

Software Engineering carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About Putting Network Security to the Test

What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment is a broad, typically automated scan that catalogs and prioritizes known weaknesses, while a penetration test is an authorized, deeper attempt to actually exploit them. The assessment lists what might be a problem; the penetration test confirms what is genuinely exploitable and what the impact would be. Assessments run regularly, while penetration tests are periodic and more resource-intensive.
What are the main steps of a penetration test?
A penetration test typically moves through a planned sequence: agree on scope and objectives, gather information about the target within that scope, attempt to gain access through the weaknesses found, and document everything in a report. The report gives the system's owner confirmed findings, their real-world impact, and prioritized recommendations to act on.
What separates a penetration test from an actual cyberattack?
Authorization, not intent, separates a penetration test from an attack. The same activity performed without explicit, documented permission from the system's owner is an unauthorized intrusion, whatever motive the person claims. A legitimate test also has an agreed scope that states exactly which systems and methods are permitted and which are off-limits.
What is responsible disclosure in security testing?
Responsible disclosure means reporting a discovered weakness privately to the system's owner first, giving them time to fix it before any broader disclosure. It exists so that testing improves security instead of creating new exposure by revealing a flaw before a fix is available. Testers document findings carefully and share them with the owner before anyone else.

About the Software Engineering course

How many college credits is Software Engineering?
Software Engineering (Computer Science 301) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does Software Engineering cost and what is included?
$250, paid once, with lifetime access: all 103 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. Students who want several courses choose UPI Study PRO instead.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does Software Engineering take?
It is self-paced with no deadlines. The 103 lessons total about 11 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in Software Engineering.

103 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in Software Engineering →Download the syllabusEvery course with PRO →
Software Engineering
3 credits · NCCRSEnroll →