It's important to understand that when we're
utilizing any type of scanning software,
whether it's web application scanning or vulnerability scanning,
that scanning is not 100% foolproof.
It doesn't always relay the information exactly true or accurate.
And we call these problems or validation. When we valid
something, we're validating a scan, we're validating the results of said scan,
whether it's a true positive,
a false positive or true negative or a false negative we go through and we
identify is this vulnerability is this flaw that's in the system that we just scan
accurate 100%.
When we validate the results of a scan,
we ought to refer to something as being a true positive as a
piece of information that's factually true on the scan that we just performed.
We're validating the flaw truly exists.
So when we scan something,
we positively identify a flaw that is a positive
notion within a flaw or vulnerability within the system,
we validate that saying it's a true positive meaning that the,
the flaw or the vulnerability positively exists.
And we've defined it as accurate
and complete that is referred to as a true positive.
Then we have something that's called a false positive within a false positive.
The scanning result came back and it said, hey,
this vulnerability exists on the system.
But when we go in to validate it, we find out that, that
that positive doesn't actually exist.
I've seen this in the past with analytics
server where a vulnerability scanner went through,
it scanned the Linux server and it found
windows vulnerabilities associated with that Linux server.
Obviously a Linux server
is not a windows server.
And so having vulnerabilities articulated to a Linux server that are
windows based comes back and that is considered a false positive.
Yes, the vulnerability might exist if it was a windows server.
But since it's a Linux server that's not accurate,
we call that a false positive or we have a positive
notion of a vulnerability or a flaw in the system.
That isn't true ie a false positive.
The next one we have is a true negative. This occurs when we scan a device or
system and it comes back and there's nothing there, there's no vulnerabilities,
there's no flaws, there's no misconfigurations.
We call that a true negative because we validated that those flaws,
those vulnerabilities, those misconfigurations,
they don't exist and we've verified that they don't exist.
Therefore, it is a true negative. Finally, we have what's called a false negative.
A false negative is when the system or the scan comes back.
And it says, hey, there's no vulnerabilities, there's no flaws,
there's no misconfigurations.
This system is ready to go.
But then we find out now there was actually a flaw or vulnerability
within the system and it wasn't properly flagged as being a vulnerability.
We call this a false negative because the vulnerability exists,
but the scanner didn't pick it up.
Now of these four, which one do you think is the most dangerous?
Some people would say false positive because a false positive
wastes a lot of people's time you go through,
you scan something, it's a positive.
Then we investigate it
and we waste time to verify that, hey,
that positive doesn't actually exist.
And so we call that a waste of time.
But I would argue that a false negative is actually the worst case scenario for
any system or vulnerability in this system
because we're coming back and we're saying,
hey, the scan came back clean.
There's nothing wrong with it,
but there is actually something wrong with it.
There's a vulnerability of flaw or misconfiguration
within that system that we didn't detect.
And if a malicious actor detects it,
that could pose some serious consequences for overall infrastructure.