Vulnerability Scanning for Security Misconfiguration

Question 1

Why is it important to perform a vulnerability scan after the process of using the API/reverse engineering?

Answer 1

Because doing a scan could set off a security control to block the connection, preventing the attacker to perform any other tests.

Question 2

The most common outcome for a vulnerability scan is the false-negative. How could this affect a company?

Answer 2

It can result in a false sense of security, because the vulnerabilities that are present were not reported by the scanner.

Question 3

Is a vulnerability scanner good to find security misconfigurations? What can a security misconfiguration include?

Answer 3

Yes, it is a good tool for that purpose. It can include missing system patch, unprotected files, weak security headers, lack of transit encryption, CORS policy misconfiguration, verbose error messages.