You can't secure what you don't acknowledge.SM

Friday, March 20, 2009

Had a great time with ISACA yesterday

The South Carolina chapter of ISACA brought me in for a seminar yesterday that was chock full of fun. My main contact with the chapter, Sue Rusher, was a real gem to work with. She and her team made me feel right at home and they hosted the event at a great facility.

I'm seeing more and more businesses and organizations like ISACA do seminars like this. The content comes to you so to speak. Attendees get fresh material without having to spend thousands registering/traveling to national audit/information security shows. It's a great way to minimize expenses in this economy and still have the knowledge sharing needed to keep up with IT and security.

Keep me in mind for any half or full day seminars on timely information security topics you're interested in holding for your group or business - I'd love to help. Contact me and we can discuss the details.

Another Web security scanner to check out

OK, I covered Acunetix Web Vulnerability Scanner in a previous post and now it's time to share a bit about another Web vulnerability scanner called N-Stalker Web Application Security Scanner 2009. I've used N-Stalker for a while dating back to when it was a free product nearly 10 years ago. Compared to the competition I must to admit that I haven't been really impressed with the tool until now. Thiago Zaninotti - the product's founder and developer - seems to have taken things up to the right level with the latest version.

The version of N-Stalker I've been using is the Enterprise Edition as shown in the following screenshot:

N-Stalker 2009's new interface is one of the best around

There's a free edition of N-Stalker you should check out. They even offer a QA edition for use in the middle of the SDLC.

I like that N-Stalker includes policies for OWASP Top 10 and CWE Top 25 also has a web proxy (something you have to have for manual testing) as well as a HTTP brute force password cracker (although, like other vendors, it's not really a "brute force" cracker in the traditional sense but rather a dictionary-based cracker). I've yet to find a true Web-centric brute-force password cracker other than Brutus which is getting some age on it and is no longer maintained.

Another really cool thing is that N-Stalker comes with a Web server load tester...something I've had a need for many times in the past for DoS testing but have not had access to at least in the context of a Web vulnerability scanner. Very cool.

In using it, a few things really stood out that I liked a lot:
  1. You can change the scanner threads on the fly to throttle the requests without even having to pause the scan.
  2. It has specific optimization settings for scanning generic HTTP devices such as routers (hosts with Web servers many people overlook in their security testing).
  3. You can load a second instance of the program so you can run multiple scans at once...although it did seem to really slow things down.
  4. It let's you view not only the site tree (all of the files/folders in the site/app) but also an Ajax tree outlining all the Ajax related content on the site/app.
There are some downsides:
  1. I'm not crazy about the signature-based approach the scanner uses. It seems to run every check in a serial fashion with multiple iterations through the same file structure. My experience has been that it can take a very long time to complete a scan...sometimes to the point where I just have to stop it altogether.
  2. I couldn't find a "full scan" policy option that would test everything - not just OWASP Top 10, buffer overflows, XSS, SQL injection, and so on.
  3. There's no real obvious way of determining at a glance how much time (or percentage) is left on the scan.
  4. Program updates require you to step through the installation process and even (re)accept the license agreement.
  5. The reports could be more intuitive.

All in all N-Stalker is a formidable tool especially for SMBs on a budget or if you're just getting started down the Web security path. It's also reasonably priced especially if cost is as important as brand name...Probably the best thing about it is the responsiveness I get from Thiago and his team. It's almost immediate. I even found an issue that was causing an error when I exited the program that appears to be fixed. All in all, N-Stalker is definitely worth taking for a spin.

My latest security content

I've got some new information security content you may be interested in.

First off, here's an article I wrote for
Will a degree or certification help enhance your IT career?

...and one I wrote for
Why should Windows shops use Microsoft Baseline Security Analyzer?

...and finally a webcast I just recorded for
Essential Elements of Web Application Penetration Testing

As always, check out for all of my information security articles, podcasts, webcasts, screencasts and more.

How about enacting a policy to punish someone?

Imagine if someone at work ticked you off and you had the ability to enact a new IT/security policy that only affected that person. Something like no more Internet access or pay-per-use fees for laptops or, say, complete oversight and scrutiny of the person's every action when they're using the computer.

Sounds absurd doesn't it....Well, it is and so is this ridiculous new law our House passed yesterday that will tax the AIG bonuses at 90%. What you won't hear much about (do I need to say why?) is that passing a law without due process is unconstitutional. This law isn't to raise tax revenues but rather punish people for something that isn't politically correct. These bonuses were valid pursuant to a legal contract! Oh, I forgot. Contracts, the law, and our constitution don't matter much these days. It's all mob rule. Let's hand the taxpayers their rear ends, blame it on greedy corporations, and then come running to the rescue. Just wow.

Since when did the politicians (esp. Frank, Pelosi, and Obama) become concerned with using our tax dollars wisely anyway!?

Gotta love our "leaders" and the minions that voted them into office. As I (and many other small business owners) currently sweat and toil to find a way to pay Uncle Sam even MORE taxes for 2008 - way more that I've already "contributed" in the form of estimated tax payments - to support their political wealth redistribution the more I realize just how much this stuff makes me sick.

Anyway, you know passing a policy to punish someone wouldn't work in the real world of business....only in the fantasy land of government control could it be done.

Sorry - I just had to get this off my chest. Now, back to work...

Monday, March 16, 2009

Is not patching being negligent?

Well, Microsoft's Roger Halbheer thinks so - at least related to the Conficker worm as discussed here. By and large I agree.

Everything in business and everything in life depends on us making choices. We choose the behavior - in this case not applying a highly-critical patch - we choose the consequences....especially if it's an oversight because someone in IT was goofing off.

With all the talk about the importance of patching you'd think we'd have this down pat by now. I suspect it'll follow in the footsteps of "use strong passwords" and be around for good.