{"id":18561,"date":"2026-05-22T14:52:19","date_gmt":"2026-05-22T06:52:19","guid":{"rendered":"http:\/\/140.122.63.201\/2025itc\/?page_id=18561"},"modified":"2026-09-16T13:32:47","modified_gmt":"2026-09-16T05:32:47","slug":"18561-2","status":"publish","type":"page","link":"https:\/\/v2.itc.ntnu.edu.tw\/?page_id=18561&lang=en","title":{"rendered":"Website Vulnerability Scanning"},"content":{"rendered":"\n
\n

:::<\/a> Home<\/a>>Services<\/a>>Website Vulnerability Scanning<\/p>\n\n\n\n

\n
\n
\n
Description<\/a><\/div>\n\n\n\n
Eligible Users<\/a><\/div>\n\n\n\n
Application and Usage<\/a><\/div>\n\n\n\n
U<\/strong>ser Guide<\/a><\/div>\n\n\n\n
Web Application Vulnerability Scanning Application and Execution Process<\/a><\/div>\n\n\n\n
Cybersecurity Vulnerability Scan Acceptance Standards<\/a><\/div>\n\n\n\n
Vulnerability Scan Acceptance Requirements<\/a><\/div>\n\n\n\n
Risk Acceptance Application Procedure<\/a><\/div>\n\n\n\n
Important Notes<\/a><\/div>\n\n\n\n
Contact Information<\/a><\/div>\n\n\n\n
Related Websites<\/a><\/div>\n<\/div>\n<\/div>\n\n\n\n
\n

Website Vulnerability Scanning<\/strong><\/strong><\/h1>\n\n\n\n

Service Description<\/strong>
The Information Technology Center provides a Web Application Vulnerability Scanning Service<\/strong> using HCL AppScan Standard<\/strong>, procured through the Ministry of Digital Affairs Government e-Procurement Platform. This service helps ensure compliance with information security requirements, personal data protection regulations, and reduces the risk of data breaches.<\/p>\n\n\n\n

Eligible Users<\/h2>\n\n\n\n
\n\n\n\n

Official websites and service websites operated by all university departments and units.Each unit of the school<\/p>\n\n\n\n

Application and Usage<\/h2>\n\n\n\n
\n\n\n\n
    \n
  • Application fAuthorized staff members or website administrators may access the service through<\/li>\n\n\n\n
  • University Administrative Information Portal \u2192 Information Services \u2192 Vulnerability Scanning Service Registration System\n
      \n
    • Departments may schedule regular annual vulnerability scans, which can serve as supporting documentation for website management, procurement acceptance procedures, and administrator handover processes.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n

      User Guide<\/h2>\n\n\n\n
      \n\n\n\n
        \n
      • Please refer to the official Vulnerability Scanning Application Guide<\/strong> for detailed instructions. Once a scan schedule is registered, the website will automatically be added to the scanning queue and processed in chronological order<\/li>\n<\/ul>\n\n\n\n

        Web Application Vulnerability Scanning Application and Execution Process<\/h2>\n\n\n\n
        \n\n\n\n

        <\/p>\n\n\n\n

        I. Pre-Application Assessment<\/h2>\n\n\n\n

        (1) Security Classification Assessment<\/h3>\n\n\n\n

        Before applying for a web application vulnerability scan, departments are advised to evaluate the security classification of their website.<\/p>\n\n\n\n

        (2) Sensitive Data Review<\/h3>\n\n\n\n

        Review whether the website contains sensitive information, including personal data or other confidential information.<\/p>\n\n\n\n

        (3) Sensitive Data Identification Criteria<\/h3>\n\n\n\n

        The classification of sensitive data shall be determined in accordance with the definitions published by the Ministry of Justice Personal Data Protection Information Website.<\/p>\n\n\n\n

        (4) Selection of Security Classification<\/h3>\n\n\n\n

        Based on the above considerations, departments shall select the appropriate website security classification for vulnerability scanning (refer to the appendix for classification details).<\/p>\n\n\n\n

        \n\n\n\n

        II. Vulnerability Scanning and Result Processing<\/h2>\n\n\n\n

        (5) Issuance of Compliance Certificate<\/h3>\n\n\n\n

        If the server meets the vulnerability scanning requirements for the selected security classification, the Information Technology Center will issue a Vulnerability Scanning Compliance Certificate as proof of compliance.<\/p>\n\n\n\n

        (6) Application Review and Scan Execution<\/h3>\n\n\n\n

        Upon receiving an application, the Information Technology Center will conduct vulnerability scanning according to the security classification selected by the applicant department.<\/p>\n\n\n\n

        (7) Vulnerability Assessment Standards<\/h3>\n\n\n\n

        The vulnerability scanning and protection requirements are based on the latest OWASP Top 10 Web Application Security Risks<\/strong>, as well as standards established by the Ministry of Education and Taiwan’s National Institute of Cyber Security.<\/p>\n\n\n\n

        (8) Scan Result Determination<\/h3>\n\n\n\n

        Upon completion of the scan, compliance with the selected security classification shall be determined based on the official Website Security Scan Report provided by the Information Technology Center (sample report available).<\/p>\n\n\n\n