Loading…
6
Tried OWASP ZAP on our staging site and it flagged 47 alerts, most were total noise
I ran a baseline scan on a Wednesday afternoon and spent the rest of the day just closing false positives on header configs. What's everyone using to cut through that noise, or do you just tune the rules and move on?
1 comments
Log in to join the discussion
Log In1 Comment
nancy4758d ago
Oh boy, been there. A buddy of mine ran a scan on his company's test site and got something like 60 alerts, and about 50 of them were the same missing security headers over and over. He ended up writing a small config file that just tells ZAP to skip those known rules, and it cut his list down to about 6 real things worth a look. The rest he just marks as accepted risk and moves on. Tuning the rules is really the only sane way to deal with it, in my view. Trying to review every alert by hand will eat your whole week.
3