Internal and External Network Vulnerability Assessments

Compliance+ Security performs vulnerability assessments of network infrastructure from both external and internal perspectives, depending on the objectives and scope of the engagement.

An external assessment evaluates systems and services that may be accessible from the Internet. An internal assessment evaluates systems and devices that may be accessible from within the organization's network.

The assessment may include:

• Servers and workstations
• Network infrastructure and network devices
• Firewalls and other security appliances
• Internet-facing systems and services
• Operating systems and applications
• Network protocols and exposed services
• Missing security patches and outdated software
• Unsupported or end-of-life technologies
• Insecure configurations
• Weak or unnecessary services
• Other technical vulnerabilities identified within the agreed assessment scope

The specific systems and assessment methods are determined based on the organization's environment, objectives, and authorized scope.

Vulnerability Assessment Does Not Mean Exploitation
A vulnerability assessment is primarily focused on identifying and evaluating technical vulnerabilities. It is not intended to demonstrate how far an attacker could penetrate an environment.

Where appropriate and within the agreed scope, limited validation may be performed to help confirm the presence or potential impact of an identified vulnerability. However, the assessment does not automatically include exploitation, persistence, privilege escalation, lateral movement, or intentional access to sensitive information.
Organizations requiring an assessment of whether identified vulnerabilities can actually be exploited may benefit from a separate penetration testing engagement.