False Positives, False Negatives, and Log Review
Summary
PDF p.241After a vulnerability scan, a summary report is generated, highlighting vulnerabilities based on their criticality. False positives and false negatives are common issues in vulnerability scanning, and log reviews can help validate the findings.
In plain words
Supplementary — not from your PDFScan reports aren't perfect. A false positive flags a vulnerability that isn't really there, which wastes time and erodes trust in the scanner. A false negative misses a real vulnerability, which is more dangerous because it gives false confidence. Reduce false negatives by rescanning and using scanners from different vendors. Use log review to confirm or disprove findings with real evidence.
Detailed explanation
PDF p.241-
Vulnerability Scan Reports
- Content: Summary of discoveries, color-coded by criticality.
- Review: By scope (most critical across all hosts) or by host.
- Details: Links to specific information and remediation steps.
-
False Positives
- Definition: Incorrect identification of a vulnerability.
- Example: A scan flags an open port as a risk, but the port isn't actually open.
- Impact: Wastes time and effort, may lead to disregarding scans.
-
False Negatives
- Definition: Potential vulnerabilities that go undetected.
- Mitigation: Run repeat scans periodically, use scanners from different vendors.
- Risk: Automated tools may not replicate a skilled hacker's success, leading to a false sense of security.
-
Log Review
- Purpose: Validate vulnerability reports by examining system and network logs.
- Example: A scanner identifies an unstable process; log review confirms repeated failures and related issues.
- Benefit: Confirms the validity of vulnerability alerts using relevant data sources.
Important terms
taken from the text above- Review
- By scope (most critical across all hosts) or by host.
- False Positives
- Incorrect identification of a vulnerability.
- False Negatives
- Potential vulnerabilities that go undetected.
Examples & real-world scenarios
Supplementary — not from your PDF- A scanner reporting a vulnerable version that has actually been backport-patched (false positive).
- A second vendor's scanner finding an issue the first missed (false negative).
- Checking service logs to confirm a reported crash-prone process.
Scenario
A report says a server has an open risky port. The admin checks the firewall and host logs, finds the port is closed and never used, and documents it as a false positive with evidence.
Common mistakes
Supplementary — not from your PDF- Assuming a clean scan means no vulnerabilities.
- Dismissing findings as false positives without evidence.
Practical skills
Supplementary — not from your PDF- Validate a scan finding using logs.
What I should remember
Key Points PDF p.241-
Vulnerability Scan Reports
- Content: Summary, color-coded criticality.
- Review: Scope or host.
- Details: Links to remediation steps.
-
False Positives
- Definition: Incorrect vulnerability identification.
- Example: Flagged open port not actually open.
- Impact: Wasted effort, potential disregard of scans.
-
False Negatives
- Definition: Undetected vulnerabilities.
- Mitigation: Repeat scans, different vendors.
- Risk: False sense of security from automated tools.
-
Log Review
- Purpose: Validate reports.
- Example: Confirming unstable process through logs.
- Benefit: Validates alerts with data.