It's important to understand that when we're utilizing any type of scanning software, whether it's
web application scanning or vulnerability scanning, that scanning is not 100% foolproof.
It doesn't always relay the information exactly true or accurate.
And we call these problems or validation.
When we validate something, we're validating a scan.
We're validating the results of said scan, whether it's a true positive, a false positive, a true
negative or a false negative, we go through and we identify is this vulnerability, is this flaw that's
in the system that we just scan accurate 100%?
When we validate the results of a scan, we often refer to something as being a true positive as a piece
of information.
That's factually true on the scan that we just performed.
We're validating the flaw truly exists.
So when we scan something, we positively identify a flaw that is a positive notion within a flaw or
a vulnerability within the system.
We validate that saying it's a true positive, meaning that the the flaw or the vulnerability positively
exists, and we've defined it as accurate and complete.
That is referred to as a true positive.
Then we have something that's called a false positive within a false positive.
The scanning result came back and it said, hey, this vulnerability exists on the system.
But when we go in to validate it, we find out that that that positive doesn't actually exist.
I've seen this in the past within a Linux server where a vulnerability scanner went through it, scanned
the Linux server, and it found windows vulnerabilities associated with that Linux server.
Obviously, a Linux server is not a windows server, and so having vulnerabilities articulated to a
Linux server that are windows based comes back.
And that is considered a false positive.
Yes, the vulnerability might exist if it was a windows server, but it since it's a Linux server,
that's not accurate.
We call that a false positive, or we have a positive notion of a vulnerability or a flaw in the system
that isn't true, i.e. a false positive.
The next one we have is a true negative.
This occurs when we scan a device or a system and it comes back and there's nothing there There's no
vulnerabilities, there's no flaws, there's no misconfigurations.
We call that a true negative because we validated that those flaws, those vulnerabilities, those misconfigurations,
they don't exist.
And we verified that they don't exist.
Therefore it is a true negative.
Finally, we have what's called a false negative.
A false negative is when the system or the scan comes back and it says, hey, there's no vulnerabilities,
there's no flaws, there's misconfigurations this system is ready to go.
But then we find out, no, there was actually a flaw or a vulnerability within the system, and it
wasn't properly flagged as being a vulnerability.
We call this a false negative because the vulnerability exists.
But the scanner didn't pick it up.
Now of these four, which one do you think is the most dangerous?
Some people would say false positive because the false positive wastes a lot of people's time.
You go through, you scan something, it's a positive.
Then we investigate it and we waste time to verify that, hey, that positive doesn't actually exist.
And so we call that a waste of time.
But I would argue that a false negative is actually the worst case scenario for any system or vulnerability
in the system.
Because we're coming back and we're saying, hey, the scan came back clean.
There's nothing wrong with it.
But there is actually something wrong with it.
There's a vulnerability, a flaw or misconfiguration within that system that we didn't detect.
And if a malicious actor detects it, that could pose some serious consequences for our overall infrastructure.