OWASP DevSecOps Guideline - v-0.2
Vulnerability Scanning
Vulnerability scanning is an inspection of the potential points of exploit on a computer, application, endpoints, and IT infrastructure (including network) to identify security holes.
Performing vulnerability scanning is a common requirements for regulatory compliance and can help to minimize an organization’s cybersecurity risk. An Approved Scanning Vendor (ASV), for example, is a service provider that is certified and authorized by the Payment Card Industry (PCI) to scan payment card networks.
In the following, we take a look into different types of vulnerability scanning that are as follows:
- Static Application Security Test - SAST
- Dynamic Application Security Test - DAST
- Interactive Application Security Testing - IAST
- Software Composition Analysis - SCA
- Infrastructure Vulnerability Scanning
- Continer Vulnerability Scanning