Tell me 5 things a scanner can’t find.
The threats a scanner miss are usually related to your business. For an eCommerce site, these include:
- An adversary stealing credit cards from your application
- An adversary manipulating the price of an order
- An adversary cancelling an order after it has been shipped
- An adversary faking an order on behalf of another user
- An adversary denying access to all other shoppers
For an online banking site, the threats a scanner ignores include:
- An adversary siphoning off funds from other users
- An adversary stealing account statements of other users
- An adversary generating fake account statements
- An adversary reversing older transactions
- An adversary escalating his privileges to an administrator
In the case of an Online Reservations site, a scanner will not find these threats:
- An adversary stealing credit cards of patrons from the application
- An adversary cancelling reservations of other users
- An adversary faking reservations on behalf of other users
- An adversary stealing the customer database
- An adversary closing the reservations at his will



