Product Details
Product Rating
Core Impact
Lockdown Auditor
nCircle IP360
Sniffer Portable 4.7.5
Sunbelt Network Security Inspector
Typhon 3
WebInspect
Our Best Buy is Typhon 3 for its no-nonsense approach and comprehensive functionality combined in a package that will be easily understood and effectively deployed within most organizations. Three of the rest did well enough for us to recommend them. Core Impact is a very interesting product that can help you undertake full-blown penetration tests against your networks and applications. It is powerful, flexible, intuitive, and likely to become an indispensable tool for many. Also, nCircle IP360 is a well-conceived, enterprise-strength solution that is uniquely scalable and provides for effective vulnerability management. It is a professional product for professionals. WebInspect warrants a recommendation as a particularly valuable tool for web developers and those responsible for managing web-based services and implementations.
Penetration testing (2004)
Julian Ashbourn reviews products capable of probing the network defenses of anything from a major e-commerce operation to a mom-and-pop grocery store
Penetration and vulnerability testing is a complex area. One might think of it in terms of layers, from straightforward, vendor-specific tools such as Microsoft's Baseline Security Analyzer (which checks for obvious misconfigurations and missing security patches) to sets of sophisticated tools used by experts to probe and check an organization's network infrastructure and the applications on it.
Another way to think about penetration testing is as the in-depth testing of a specific software product in order to uncover vulnerabilities before general release.
Penetration testing and vulnerability testing are frequently confused. Penetration testing usually refers to a specific attempt to penetrate a network from outside to gain access to files and information accordingly. It is often undertaken by a specialist and a trusted third-party agency on behalf of an organization.
Vulnerability testing is more thorough, including the testing of a specific software application, an individual device or an entire network. Such a test may not necessarily be undertaken against a live environment.
It is not unusual to find vendors and tools that effectively encompass both of these tests. The question arises as to how we can effectively evaluate such products within the scope of an SC Magazine group test, especially as in the majority of cases the tools will represent only a small part of the overall solution or strategy.
In this context, we might think of the tools as an automobile mechanic's socket set. He will want to use quality tools but the important thing is how he uses them and to what effect. This will be closely linked to his individual training, and his experience with the tools and the automobiles he is servicing.
Similarly, the security professional who specializes in penetration and vulnerability testing (whether he or she resides within your organization, or within a third-party consultancy) will wish to use adequate tools and to develop their own expertise and experience in relation to the infrastructure and situation at hand.
The combination of tools and experience will provide the confidence you are seeking with regard to penetration testing. We should think of them as being interdependent. With regard to this particular evaluation, therefore, we have considered it a useful first step to take a look at this area and understand which tools are available and how they work.
For some people, purchasing tools off the shelf and then deploying them may be all they need. For others, the acquisition of tools may be a first step on a strategic path that includes the use of specialist third-party services. Some organizations may prefer to use third-party services entirely, trusting the consultants to select the right tools.
In any event, it is useful to understand what these tools are and what they do, hence this particular evaluation. Another aspect to consider is that any given corporate IT infrastructure, no matter how large or small, is likely to have its own set of peculiarities that may expose different shades of vulnerability – even down to a specific workstation or component.
It is therefore difficult to generalize in this respect, and this is where specific experience of the infrastructure and the applications it carries will pay dividends.
Furthermore, the components being tested will have different levels of importance for the business and this must be considered.
An enterprise engaged solely in internet commerce, for example, may consider itself potentially more vulnerable than one for whom IT plays a smaller part in its activities. A government agency might consider itself to be more at risk from intrusion than a mom-and-pop grocery store, and so on (although some would argue that we should not make assumptions in this respect).
In terms of penetration and vulnerability testing you should recognize that any testing relates to the infrastructure in place at the time. If new software or components are introduced, the test becomes outdated and should be repeated.
You should take a strategic view of this and conduct regular testing using your own in-house personnel, or use trusted third parties with proven expertise in penetration and vulnerability testing.
SC Magazine brings you this test to explain penetration testing and give you a feel for some of the available tools. Product recommendations are particularly difficult, because all these products have merit in one way or another. It is nice to find such products available to help you understand and protect your IT assets. It is really a question of matching the available capabilities to your particular needs.
Interested parties are encouraged to do additional research via the internet and then to contact vendors directly. You must remember to keep things in perspective, and in the context of your own operations. You might even like to start your penetration testing with a careful risk analysis.
