Re: Security scanning tools

[Devilscrow Sr <devilscrow () gawab com>]

Hi Jack,

My answers inline...

Jack Solomon wrote:

> My questions to the group are:
> 1. What tool[s] should I look to buy that that correctly reports 
> security vulnerabilties with the least false positives?

Firstly, mbsa for me is more of a information gathering tool that also 
does some basic security checks. Secondly, some amount of post scan 
analysis / verification is always very important and required to get 
better results out of your vulnerability scans. This will help you 
reduce the number of false positives.

> 2. Are false positives a known [feature] of all scanning tools?

Oh, yes !
That goes without saying.....

-dev

---------------------------------------------------------------------------
----------------------------------------------------------------------------