[ Thanks to An Anonymous Reader for
this link. ]
“A large number of web application scanning tools are
available, both commercial and open source. Effective use of these
tools is an important part of a thorough web application security
assessment, and regular security scans are required to comply with
security requirements such as section 6.6 of the Payment Card
Industry Data Security Standard (PCI-DSS).“The Web Application Security Scanner Evaluation Criteria
(WASSEC) is a set of guidelines to evaluate web application
scanners on their ability to effectively test web applications and
identify vulnerabilities. It covers areas such as crawling,
parsing, session handling, testing, and reporting.“The goal of the WASSEC is to create a vendor-neutral document
to help guide web application security professionals during web
application scanner evaluations. This document provides a
comprehensive list of features that should be considered when
conducting a web application security scanner evaluation. Different
users will place varying levels of importance on each feature, and
the WASSEC provides the user with the flexibility to take this
comprehensive list of potential scanner features, narrow it down to
a shorter list of features that are important to the user, assign
weights to each feature, and conduct a formal evaluation to
determine which scanning solution best meets the user’s needs.”