In this lesson,
we're going to talk about the concept
of false positive, false negatives,
true positives, and true negatives.
Understanding these terms are important
for analyzing the results of your pentest
and improving your testing methodology.
First, let's define what we mean
by true positives and true negatives.
A true positive occurs
when the testing correctly, identifies a vulnerability
or threat that is actually present.
For example, let's say you run a vulnerability scanner
on a web application
and it identifies a SQL injection flaw in the login form.
Upon further manual testing,
you confirm that the flaw exists and can be exploited.
This is a true positive
because the scan accurately detected a real issue.
Another example of a true positive might be found
during a social engineering test.
Suppose you send a phishing email to a group of employees
and the test accurately identifies the specific individuals
who fall for the phishing attempt.
Identifying these individuals is a true positive
since they reflect genuine weakness
in the organization's security awareness.
On the other hand, a true negative is
when your testing correctly identifies
that there is no vulnerability
or threat where none exists.
For instance, you perform a thorough scan
of an internal network segment looking for open port
that could indicate a potential entry point for attackers.
The scan returns no significant findings,
and a subsequent manual review confirms
that all systems are properly secured
and no open ports are vulnerable.
This is a true negative
because the scan accurately reflects the true state
of the network.
Now, let's move on to false positives and false negative.
A false positive occurs when you're testing indicates
that there is a vulnerability or threat,
but in reality, there isn't one.
This can happen for various reasons,
such as overly sensitive detection tools
or misconfigurations.
For example, if you run a web application scanner and find
it flags a potential cross-site scripting vulnerability
on a contact form,
but upon manual inspection,
you find that the form is actually properly sanitized
and secure, this is a false positive.
It means the tool inaccurately identified a threat
that does not exist.
False positives can also incur in network scanning.
Suppose a vulnerability scanner alerts you
to a suspected outdated software version on a server,
but after checking,
you confirm that the server is fully patched
and the software is up to date.
This misidentification is another example
of a false positive.
False positives can be very frustrating
because they lead to wasted time
and effort as you investigate
and verify these incorrect finding.
Now, on the other hand, we have false negatives.
A false negative is when your testing fails
to detect a vulnerability or threat that actually exists.
This is more concerning than a false positive
because it means a real issue
is going unnoticed and unaddressed.
For instance, if your scan misses an existence
of a buffer overflow vulnerability in the application,
this is a false negative.
It poses a risk
because the vulnerability remains in the system,
potentially exploitable by attackers.
Another example of a false positive could occur
during a physical security test.
Imagine you're testing the security of a building
and fail to notice that a side door
is frequently left unchecked.
If you overlook this vulnerability,
it means your assessment is incomplete
and the organization remains at risk of unauthorized access.
False negatives are particularly dangerous
because they provide a false sense of security.
To effectively manage these outcomes, it's important
to tune your testing tools and methodologies,
regularly update your tools
to ensure they have the latest signatures
and detection capabilities.
Also, consider combining automated scans with manual testing
to reduce the chances
of both false positives and false negatives.
For example, after running an automated scan,
follow up with manual testing to verify the results.
This hybrid approach can help you catch issues
that automated tools might miss
and confirm the accuracy of the finding.
So, remember, true positives
and true negatives indicate accurate results
from your testing;
while false positives and false negatives represent errors
that need careful management to ensure the integrity
of your security assessments.
Use a combination of automated
and manual testing to achieve the most accurate results.