Vulnerability Scanning - 4.3
Summary
Vulnerability scanning identifies security weaknesses through non-intrusive network scans, static code analysis, and dynamic testing with random inputs. It also includes package monitoring to ensure software is updated and free of known vulnerabilities.
Notes:
Network Scanning
- Non-intrusive scans of a network or system designed to identify potential vulnerabilities without disrupting normal operations.
Application Security
- Static Analysis: Scans source code without execution to identify vulnerabilities, such as insecure coding practices.
- Dynamic Analysis (Fuzzing): Actively tests an application by sending unexpected or random inputs to detect vulnerabilities and abnormal behaviors.
- Package Monitoring: Continuously monitors software packages or libraries for security vulnerabilities, ensuring they are updated and free from known issues.