Automated web assessments are very low value - from them to companies like Qualys and automated scanners save your time and money.
Is your website Secure!
41–50 of 58 posts
Re: Is your website Secure!
#42And 502 Bad Gateway, even though behind Cloudflare.
It works fine, so far. I think their server was down then
Re: Is your website Secure!
#43not working...
Re: Is your website Secure!
#44google.com scores 50/100. This is one of those scanners crappy pentesters use for multi page reports of false positives?
Hah this triggers me. Last week we got a pentest done on our apps. This week we got some high-prio tickets on our board because they found major security violations!!! Our app, which uses an API, used a dangerous permission! "android.permission.INTERNET" How they can report this with a straight face, I don't know. Makes me want to go in the security business though, if that is the level of competence I'm absolutely p…
From experience, most are very junior and use automated solutions which just don't make sense. When we do ours we really focus on core elements and very material findings... as everyone should. But competency is so rare in this field it's hard to follow.
Re: Is your website Secure!
#45Automated web assessments are very low value - from them to companies like Qualys and automated scanners save your time and money.
Do you have an example of automated scanners?
Re: Is your website Secure!
#46Earlier quoted context omitted.
Average Joe and businesses alike will assume that a tool telling them their site is secure means that they don't have to worry much about it. A tool that can easily be made to report "100% secure" is then quite harmful. Even large corporations rely largely on buying reports, and in turn buying products to fix the results of those reports as their primary security strategy.
I get your point, but I still can't believe the average Joe would think like this. Also, large corps get SOC2, yet they are still not secure. Also, auditors use tools like this or have their tools to get reports telling them they are 100% secure. No one should ever assume 100% security, even when the odds suggest otherwise. Maybe you are right.
> Also, large corps get SOC2, yet they are still not secure.
SOC2/ISO27001 audits are just "are you living up to the processes you defined yourself for SOC2 compliance", not "are you secure". It is dealt with by whatever Compliance unit the company has and only serves to avoid legal issues, and has nothing to do with whoever runs IT security.
Security audits is usually quite laughable, and work tends to be initiated by security vendors who happen to have a scan that gives some "very bad" result which they just so happen to have a silver bullet product to fix. Then the company uses that scan until the next company comes along...
Few companies take security seriously, designing things for security rather than just buying whatever bandaids they see in the store.
Re: Is your website Secure!
#47They only give themselves 85/100. https://inspect.new/inspect.new
They give almost the entire planet 85/100, because they've decided that every webpage must have a Permissions-Policy header. This is disingenuous.
Permissions-Policy is an extension of Content-Security-Policy. If you embed third party contents in your page, you will absolutely want a CSP and a permissions-policy. If you made the site yourself, if what's being served up is all yours and no third party code, you have no need for this header. Because you know you won't ask for permissions you don't need.
This service has no idea whether you're a 3rd-party-embedding site or not, and can't know because the 3rd-party data could appear directly in the HTML (e.g. blog comments). So they can't say you must have this header. It's a false positive to say you need it, and it's needless box-ticking to add one if you don't need one.
Ironically, my own site would pass this because for a fleeting time in the past, Google were trying to force new ad-tech on everyone, and the only way they offered to opt out (it was not opt-in as it should be) was for site owners to write Permissions-Policy:interest-cohort=() -- see https://amifloced.org/
Re: Is your website Secure!
#48I made something similar a long time ago, it's mostly aimed at people that use CMSs like Wordpress or Joomla. The database was created using the most common attack endpoints bots have tried on my own sites. https://prober.dev if anyone wants to try it out
That test is actually funny, in a good way; like how you said you got those links in the first place on the about page is pretty much what any experienced web dev finds out day-to-day.
Most sites I sent to it came back with plenty of false positives, mainly because htaccess rewrites resolve the URIs as query string IDs and returned empty pages with "Sorry, but the information you're looking for doesn't exist..."
Re: Is your website Secure!
#49They gave schneier.com 55/100.
Re: Is your website Secure!
#50They only give themselves 85/100. https://inspect.new/inspect.new
They give almost the entire planet 85/100, because they've decided that every webpage must have a Permissions-Policy header. This is disingenuous. Permissions-Policy is an extension of Content-Security-Policy. If you embed third party contents in your page , you will absolutely want a CSP and a permissions-policy. If you made the site yourself, if what's being served up is all yours and no third party code, you have…
Yes, but you would also need to guarantee that content that does 3rd party stuff can't get injected.