Running security scans
While this chapter describes some core security testing requirements, it is unusual because this area has so much shared code and common vulnerabilities that third-party companies have extensively automated it. Don’t start security testing from scratch; you will never achieve the depth and breadth of knowledge compiled by third-party tools.
Security scanners can quickly find common security issues such as these:
- Unnecessarily open ports: Accepting inputs to services you don’t need unnecessarily increases your attack area
- Out-of-date software and libraries: Libraries are kept up to date with the latest security fixes, so running old software leaves you vulnerable
- Out-of-date security hash functions: Older, less secure hash functions can be compromised. meaning attackers could break encrypted communications
- Connections that don’t require encryption: Accidentally sending messages in clear text allows eavesdropping ...
