Security scanning a cms based site

[grey_lady]

Can anyone tell me, is it worth running a security scan e.g Accunetix on a website that is purely CMS based and does not collect any user information?

Thanks.

[DaveB]

Can anyone tell me, is it worth running a security scan e.g Accunetix on a website that is purely CMS based and does not collect any user information?

Thanks.

Is it publicly accessible i.e. from the Internet, or is it purely internal?

If it has any kind of external accessibility it's worth scanning. There might not be anything in terms of sensitive data on it, but it can still get hijacked and used as a proxy by the bad guys or provide a back door into your network.

[grey_lady]

It's publicly accessible - thanks.

[pmeswani]

Can anyone tell me, is it worth running a security scan e.g Accunetix on a website that is purely CMS based and does not collect any user information?

Thanks.

Firstly, who owns the site? You, the service provider or a third party?

If you don't own the site or the network on which the box resides, you may get done under the Computer Misuse Act unless you get explicit consent from the owner of the site and network.

[grey_lady]

The site is owned by my company but it and the servers it sits on are bought by my company in a 'managed service' agreement, I'm a test manager by the way.

I do realise that it would have to be with the agreement of the service company and at a quiet time.

[Advocate]

Can anyone tell me, is it worth running a security scan e.g Accunetix on a website that is purely CMS based and does not collect any user information?

Thanks.

My advice is to get it done properly...

[Sysman]

I do realise that it would have to be with the agreement of the service company and at a quiet time.

Whatever you do, before you run anything get permission to do so from all parties concerned in writing.