Tag Info

New answers tagged

0

Briefly: CVEs are for "known knowns" or specific vulnerabilities. CWEs are for "unknown knowns" or vulnerability types. Dynamic scanners are looking for instances of already-identified vulnerabilities. Static scanners do that, too, but one of their main advantages is that they are also looking for not-yet-identified new vulnerabilities. An obvious example ...


1

No, you would not typically do this though you can walk through much of the .net supporting libraries in a debugger if you want to check exactly what a specific piece of code is doing. You may be able to scan some of the libraries using static code analysis that can operate on binaries but with large reputable vendors they will have already done this or ...


5

Is it standard practice to conduct a security review of Microsoft's own code base when you build an app on the Microsoft stack? No. One reason being is that you will not have access to proprietary (Windows, IIS, .Net, patches) code unless you reverse engineer it and the effort of it would outweigh the benefits. The common approach is to define ...



Top 50 recent answers are included