Question: why does the client think that continuous scanning of a production system is required to identify “application data entry fields that do not have validation”? I would have thought a better place to detect this would be during development? Or does the client fear that this could happen at any time?
A VMS (vulnerability management system) is typically used to do the continuous scanning. That can look for issues like SQL injection, but typically is used to identify patches that are missing, insecure configuration, vulnerable third party libraries etc – typically the things you depend on, but which might be outside your developers’ control. Lots of other tools out there that hook into earlier phases of development though; SAST / DAST would be what you’d be looking at typically. Static Application Security Testing (SAST) typically does source code analysis throughout the development lifecycle. DAST treats your app as “black box” typically, but can validate things like SQL injection vulnerabilities before something gets to Prod… From: [email protected] <[email protected]> On Behalf Of Greg Harris Sent: Thursday, 21 June 2018 12:55 PM To: ozDotNet <[email protected]> Subject: [Off Topic] Generic system vulnerabilities testing tool – Open ports etc Hi All, My client is looking for a tool (they are willing to pay for it) that will warn them of potential exposures on a production system. I think that we may be looking for multiple tools here, because the requirements are wide… He has asked for something that runs in the background continually scanning the system for vulnerabilities so that if something gets opened up we know about it fairly quickly. Looking for things like open network ports, SQL injection attack possibilities, application data entry fields that do not have validation / verification. Looking at https://cwatch.comodo.com/blog/website-security/top-10-vulnerability-assessment-scanning-tools/, https://www.techrepublic.com/article/solutionbase-take-advantage-of-vulnerability-scanning-tools-to-increase-network-security/ and https://www.comparitech.com/net-admin/free-network-vulnerability-scanners/ There are a lot of tools out there. This is an area I where I have little experience, so if anybody has experience and can provide some advice I would be very grateful. Thanks in advance Greg H Greg Harris [email protected]<mailto:[email protected]> phone: 0407 942 982 Baulkham Hills NSW 2153
