Top mistakes in web vulnerability assessments
Thousands of new vulnerabilities are reported in software every year, and many stay open for weeks or even years while organisations struggle to manage them. These are some of the most common mistakes made during web vulnerability assessments, and how to avoid them.
1. Not testing from every angle
Test the application both with and without authentication, and understand how controls such as firewalls, WAFs and intrusion prevention systems affect the results. A scan that only sees the public pages, or one that is silently blocked, gives a false sense of security.
2. Relying on old technology
It is tempting to put off updates and patches. Outdated software that stays in place for long periods becomes a serious vulnerability and raises business risk significantly.
3. Assuming one scan finds everything
Issues can remain undetected after a complete scan. Combine tools with manual testing, and repeat assessments regularly.
4. Not using the tools available
Many good tools exist to simplify and automate vulnerability management. Use them, so your team's time goes on analysis and fixing rather than repetitive checks.
5. Treating it as a side task
Vulnerability management cannot simply be added to someone's existing responsibilities. It is a complex, constantly changing, business-critical process, and it needs clear ownership and enough resources.
6. Not training developers
Assuming developers will learn only from their mistakes is not enough. Give your team regular training and real case studies, so the same kinds of vulnerability stop appearing in new code.
7. Missing the big picture
People running assessments do not always have a full view of the network: where internal firewalls, IDS/IPS sensors and other controls sit. Without it, they can misread results or miss whole areas.
It comes down to planning
Avoiding these mistakes is mostly a matter of planning. A process that is well planned, well resourced and well documented keeps problems to a minimum, and puts you in a strong position when something does go wrong. If one of those elements is missing, fix the process now; it is much easier than continually dealing with the consequences later.
How Vooki Pro helps
- Warns when a scan's login session looks invalid.
- Detects WAF blocking and shows it on the scan.
- Shows scan coverage and a Scope view of what was and was not scanned.
Frequently asked questions
What is the most common mistake?
Scanning without authentication, which leaves most of the application untested.
How do I know my scan covered enough?
Check the discovered URLs and requests scanned, and compare with the size of the application.
Try Vooki Pro free for 7 days
Avoid these mistakes with a scanner that tells you about them. The trial unlocks every feature for 7 days, and scanning runs on your own machine.
Related: Authenticated scanning: why you must scan behind the login · Scanning applications behind a WAF or rate limits
Related Articles
OWASP Top 10: the most critical web application security risks
The OWASP Top 10 is an awareness document for web application security, published by the Open Worldwide Application Security Project (OWASP). It represents a broad consensus among security experts about the most critical security risks to web ...Web application vulnerability assessment checklist
A vulnerability assessment identifies the security weaknesses in a web application and rates each one by severity. This checklist covers the whole process in 14 sections and 118 checks, from planning to retesting. It follows the way the OWASP Web ...JSON Web Token (JWT) vulnerabilities
JSON Web Tokens (JWTs) carry identity and permissions between a client and an API. They are signed, not encrypted, and their security depends entirely on how the server validates them. Small validation mistakes let an attacker forge a token and ...OWASP Top 10 2017 and what changed in 2021
OWASP updates its Top 10 list of web application security risks every few years. This article shows the 2017 list and how it changed in the 2021 edition, which is the current one. The OWASP Top 10 2017 A1:2017 Injection A2:2017 Broken Authentication ...Why web vulnerability testing should be automated
Whether you run a website or simply use one, you want to know that it is secure. Browsers help a little: they warn you when a site's connection is not secure. But a browser warning only covers the connection. It says nothing about weaknesses inside ...