ZDNet UK

• CNET NETWORKS UK BUSINESS SITES:
• atlarge.com
• BNET UK
• silicon.com
• SmartPlanet.com
• ZDNet.co.uk

Smart security: network scanners

• Tags:
• Nessus,
• Netrecon,
• Retine,
• Eeye

Lamont Wood ZDNet US

Published: 06 Nov 2002 10:00 GMT

• 
• 
• 
• 
• 

Christopher Klaus, founder and CTO of ISS (which Rasmussen identifies as the market leader) likened the task of the scanner to "twisting the door knobs to find out what vulnerabilities exist." He preferred to use the term "expert rules" instead of AI. He said his software will scan ports on a network and use information it has picked up at one port, such as insecure passwords, to attempt penetrations elsewhere. (He says ISS can penetrate most corporate networks because in-house programmers often use Web ports for other applications, such as instant messaging.)

At Symantec, NetRecon product manager Harold Toomey also preferred the term "expert system." He boasted that his product also uses progressive scanning, but added that it emphasises safety -- it won't crash a trading floor, he said.

At eEye, Retina uses an AI feature called Common Hacking and Attack Methods (CHAM), explained Day. CHAM includes intelligent algorithms that look for buffer overflow and Web server protocol weaknesses. Plus, it can be set to perform network-wide or selective sweeps, at pre-set times and intervals, Day said.

At Foundstone, Cole indicated that the details of how the scanning is done are secondary. "The challenge is to communicate the risk in business terms," he said. To that end, he said FoundScan emphasises accurate but "gentle" scans, combined with guidance on fixing whatever problems it uncovers.

At Cyc Corp., they freely admit to using AI. The company, it turns out, is the last traditional AI firm, having spent the last 18 years developing a database with second-order predicate calculus intended to endow software with common sense.

Cyndy Matuszek, CycSecure's project manager, said the product (still in beta) not only generates a list of vulnerabilities, it uses AI to generate an "impact statement" so that the users can judge which vulnerabilities are worth their attention. "Of five hundred problems on a network, only 20 may play into problems that you care about," she noted. It also uses AI to find vulnerabilities that would be more obvious to a human than to a machine, like pet names used as passwords, and knowing that it is suspicious if anyone but the system administrator installs a packet sniffer.

All the products scan TCP/IP networks. Pricing for Foundstone's FoundScan starts at $35,000 for up to 256 IP addresses; maintenance costs extra. The software runs on a Widows host.

Retina from eEye also runs on Windows, and costs $6,520 for one scanner, and up to 256 IP addresses. Each scanner license, or "activation key," handles up to 512 IP addresses. The annual price of maintenance is around 30 percent of initial purchase price.

The single-machine version of ISS's Internet Scanner, which also runs on Windows, is a free download; but a license for 250 devices will cost you $6,095; a perpetual license for 250 devices costs $11,400. Both prices include maintenance.

Pricing for NetRecon 3.5 starts at $3,995 for up to 256 IP addresses, or $19,995 for an unlimited number. It runs on a Windows host. The annual cost of maintenance is 18 percent or 25 percent of the original price, depending on how much support you want.

CycSecure runs on a secure (Linux-based) server. The cost is reportedly "several thousand dollars" for the server, and then $10 to $100 per IP address, depending on the scale.

The Nessus Security Scanner is a free download that runs on Unix-like systems, such as Solaris, FreeBSD, and Linux.

So, while they may call the process various names, what's important is that these systems will probe your network like a hacker would, poking and prodding it with patience and expertise you hope no hacker will ever possess. Putting an AI scanner in your corner should keep your network from being knocked out by the human variety.

---

Go to section: Smart security: network scanners Page 2

• 
• 
• 
• 

• Share this article:
• 
• 
• 
• 
• 

• Most Recent
• Most Popular
• Most Discussed