Slashdot Mirror
Nmap Security Tool Survey
spring writes "Every so often, the author of everyone's favorite network reconnaissance tool, nmap, runs a survey to determine which security-oriented software products are most popular. This year's tool survey was just released, and it contains some interesting results. Old favorites like Nessus, Snort, Netcat, and Ethereal made the list, of course. SAINT and SARA are still around. But a number of new tools appeared this year, like Windows-only GFI LANguard, SuperScan, and Cain & Abel. Nikto and Kismet demonstrate the growing importance of wireless networks. The survey contains many good tools. Certainly worth a read."
remember that these tools aren't going to be the "end all/be all" of network security.
You also have to have a good preventive security plan, which these tools will help out in. However, there should also be a plan of action should these security measures get bypassed (i.e. an insider job, program exploits, trojans, etc...)
But that's just my contention...
Join the TWIT army now!
It's These Guys.
When a windows java exploit can reformat your disk by visiting a malformed web page, you don't really have to wonder why they're so popular.
Hilary and I intend to run these against every machine in the world, ferreting out and destroying those eeeevil P2P pirates!
Ethereal == tcpdump with graphical interface. Incredibly nice tool, but hardly a security tool.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
for those interested in sec tools on mac OS X, here is a small list of tools to add :
rpg password generator
kismac a kismet equivalent that also includes a WEP cracker. very nice!
macanalysis a really good security tools suite
Although it wasn't on the list, Wellenreiter is really great wireless scanner. Plus, it runs on the Zaurus under OZ3, which makes it great for less conspicuous scanning since you don't have to lug a laptop around.
Has anyone seen a decent piece of software that can find WAP's on your network by scanning from the wired part of your network?
What I want is something that scans for known MAC ID's or something to identifiy wireless access points without having to fly all over the country to do it.
There are plenty of wireless based scanners but they involve travel.
Any hints?
While all these tools turn out to be the Security Analyst's bible to utopia, they're also the ultimate cracker tools, missing only the Xploits that the old neverending line of script-kiddies use to bypass each and every point that these tools do their best to detect.
Nessus is, however, a single tool, that can be as both useful to the white hat5 as it is the bl4ck hats.
It gets my number one tool vote as being as useful to both partys - yet completely impartial.
A very difficult road to tread indeed...
In the last couple weeks I've amassed a few servers and a client network so, I've had no choice but to become a sysadmin. Which is not what I consider myself (I'm a graphic designer/Web App Programmmer) but, for the sake of responsibility, I find myself fast becoming one.
So I welcome any such article as the one posted here to help better educate me and get me up to date on the even the most mundane of utilities (I hadn't even heard of nessus/netcat)
I'm not a fresh unix convert or technically challenged, it's just that my occupation has demanded that I focus on front end and applicational development rather than network security and monitoring.
So to get by I've been using very basic common sense like running firewalls for port blocking, not running insecure services such as telnet and in the event that i have to (one of my servers is a multiuser webhost so I had to turn FTP on) research and run a more secure variant of that service (for FTP I opted for vsftpd over wu/pro)
And for security, besides my basic IP Masquerading and port blocking firewall (ya, it's that basic, I'm no guru) I run tripwire, which I run a sanity check daily as well as run snort.
This config runs on everyting from my OS X laptop to the RH9 boxes for dev/production serving and seems "ok" for the moment.
I do plan on evaluating/installing some kernal level patches to the RH boxen such as grsecurity but I thought I'd use this topic to fish for pointers as I am also looking for some good educational material such as IP/Network configuration and indepth material on properly setting up an ironclad DMZ. So if anyone has some highly recommended links or knows of soome good books on amazon to point out or even comments to make here to give some pointers, i'd be much appreciative.
He developed it as a tool to help system administators secure their system but SGI did not like it because crackers could use it.
Was this SGI tool nmap or not? I was only 16 at the time and can't remember.
http://saveie6.com/
1) Unplug the power cords and network cables / phone lines.
2) Put it back in the box.
3) Send it back to the place that you bought it from.
Sure its not very practical, but it would make my job a hell of a lot easier
I am surprised that aide was not listed. It is a free equivalent to tripwire (which is on the list), and works very well for my needs on both Linux and FreeBSD.
After SAINT the network tool went after the author of Saint (the open source server/service uptime application) over a name/branding dispute, we have stopped recommending their product (the network security tool) entirely.
They were similarly named, however, there was very little chance of them being confused for one another. Apparently SAINT didn't have enough confidence in their own marketing or their customers intelligence to keep their lawyers out of it.
Just my 2 cents worth. But then, my 2 cents has an effect on a few large clients with large budgets. Good Job SAINT.
----- LoboSoft specializes in Digital Language Lab
I belive that you're thinking of Netsaint...aren't you?
:-)
It's now called Nagios
- There's no way to prevent it from spitting up gobs of annoying dialog boxes. This is especially annoying when you're playing some 3D game and zone alarm tries to put up a box on the screen asking you to allow it to go online.
- It is a pig. It takes 5 minutes or more to boot on my laptop, and is by far the last component ready when I boot up my machine
- The interface needs work. It's hard for me to find just about everything in it, from the access logs, to the application table, to the network table, etc...
- It is not good about remembering your settings unless you shut it down normally. If the only time you leave windows is when you crash, be prepared to tell Zone Alarm that Mozilla is allowed to access the internet all over again. I've actually gone and run every network application I could think of, then rebooted just so I wouldn't have to tell Zone Alarm about it again.
Those are just the annoyances I could think of off the top of my head. I probably wouldn't run it (I'm behind a BSD firewall at home anyway) except that the IT department insists on it (it's my work machine).I read the internet for the articles.
1) Update your install of IRIX 6.5 to the most recent version available to you (6.5.16m for most people, 6.5.19 or 6.5.20 for those with a support contract). If you're unsure about updating, read about the IRIX Release Process as well as theIRIX Compatibility Mandate.
2) Install the security patches for your version of IRIX (note that IRIX releases previous to 6.5.15 will probably not have the most recent security patches available).
3) If you're a security newbie, run the "Improve System Security" application... it can be found under the Security and Access Control section of the System Manager.
4) Install IPFilter, be sure to learn how to use it.
5) Subscribe to SGI's security advisory mailing list.
6) Newbies outta read some of SGI's other sysadmin manuals as well:
Personal Sysadmin
IRIX Admin
7) Update your various freeware apps... be sure to read the seperate freeware security notice:
http://freeware.sgi.com
Retina, by Eeye, is another excellent scanning school. IMHO, it's better than GFILanguard. I especially like the ability to fix registry problems from the scanning machine. It's interface is also very smooth. It's located here. They also have another product for scanning IIS, but I haven't used it yet.
Maybe we DID take the blue pill. You wouldn't remember anyway.
APTools is one example.