# What are best practices for running vulnerability scanners on a research project?

**URL:** <https://ask.cyberinfrastructure.org/t/what-are-best-practices-for-running-vulnerability-scanners-on-a-research-project/919>\
**Category:** ResearchSOC Cybersecurity\
**Tags:** vulnerability-scanners\
**Created:** [May 23, 2019, 6:14pm UTC](https://ask.cyberinfrastructure.org/t/what-are-best-practices-for-running-vulnerability-scanners-on-a-research-project/919 "2019-05-23T18:14:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mary\_Conley](https://ask.cyberinfrastructure.org/user_avatar/ask.cyberinfrastructure.org/mary_conley/32/185_2.png) [@Mary\_Conley](https://ask.cyberinfrastructure.org/u/Mary_Conley)\
**Post date:** [May 23, 2019, 6:14pm UTC](https://ask.cyberinfrastructure.org/t/what-are-best-practices-for-running-vulnerability-scanners-on-a-research-project/919/1 "2019-05-23T18:14:23Z")

</div>

I would like your opinions on what are some best practices using vulnerability scanners on your projects, and what you liked or didn’t like.

---

<div class="post-metadata">

**Author:** ![pdurbin](https://ask.cyberinfrastructure.org/user_avatar/ask.cyberinfrastructure.org/pdurbin/32/1304_2.png) [@pdurbin](https://ask.cyberinfrastructure.org/u/pdurbin)\
**Post date:** [May 23, 2019, 7:14pm UTC](https://ask.cyberinfrastructure.org/t/what-are-best-practices-for-running-vulnerability-scanners-on-a-research-project/919/2 "2019-05-23T19:14:54Z")

</div>

Are these projects webapps? What protocols are in play? HTTP? SMTP? SSH? For that you might like [https://www.owasp.org/index.php/OWASP\_Zed\_Attack\_Proxy\_Project](https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project)

Or are you talking about scanning for vulnerabilities within the dependencies in your source code? For that you might like [https://www.owasp.org/index.php/OWASP\_Dependency\_Check](https://www.owasp.org/index.php/OWASP_Dependency_Check)

These are both listed under “Flagship Projects: Projects that have demonstrated strategic value to OWASP and application security as a whole” at [https://www.owasp.org/index.php/Main\_Page](https://www.owasp.org/index.php/Main_Page)

---

<div class="post-metadata">

**Author:** ![mkrenz](https://ask.cyberinfrastructure.org/user_avatar/ask.cyberinfrastructure.org/mkrenz/32/228_2.png) [@mkrenz](https://ask.cyberinfrastructure.org/u/mkrenz)\
**Post date:** [June 5, 2019, 2:55pm UTC](https://ask.cyberinfrastructure.org/t/what-are-best-practices-for-running-vulnerability-scanners-on-a-research-project/919/3 "2019-06-05T14:55:58Z")

</div>

In regards to SSL/TLS/HTTPS I use these two resources for checking configuration:

[https://www.ssllabs.com/ssltest/](https://www.ssllabs.com/ssltest/)  
[https://observatory.mozilla.org/](https://observatory.mozilla.org/)

For both sites it’s probably a good idea to check the box that will exclude your results from the list of public results so that you don’t advertise yourself if you get anything less than an A. Both of these scanners are unique enough to warrant using each of them. For instance, I’ve seen sites that get an A+ on ssllabs, but an F on Mozilla’s Observatory.