Opinions on security auditing software

[MattWray]

I was curious what everyone is using to audit security. I would like to get something to check the strengths and weaknesses of our network, but am unsure of what software out there is any good. I have LanGuard scanner, but am looking for something a little stronger...TIA!

Thanks,

Matt Wray
MCSE, MCSA, MCP, CCNA

http://www.sss-steel.com

 

[StellaIndigo]

I don't think this is a one application answer. Although I have a 'favorite' set of testing tools I will generally use a broad range of them while security testing.

I my job I find the end user the weakest link... 'vote them off the network'... and social engineering the biggest threat.



There are 10 types of people in the world. Those that understand binary and those that don't.

 

[peterve]

Just from the top of my head :

Eeye Retina
ISS Internet Scanner
Nessus
Saint/Satan

Keep in mind that - in order to understand the results & in order to be able to anticipate the impact on the network when running the tools, it might be wise to get some additional security training... Scanning tools are a great help - but don't rely on them to find all the holes in your network. As mentioned by StellaIndigo, you can't scan the users, you cannot perform a software automated security audit on a person...
Security Awareness is at least as important as scanning your own network...

Good luck



--------------------------------------------------------------------

http://kickme.to/dpsecurity

--------------------------------------------------------------------
How can I believe in God when just last week I got my tongue caught in the roller of an electric typewriter?
---------------------------------------------------------------------

 

[Xemus]

Don't forget NMAP. Great open source port scanner. If you can scan your network from an external interface (outside the router) you can double check your incoming vulnerabilty levels as well.

http://www.insecure.org

http://www.closedsocket.com

 

[MattWray]

Thank you all. I am aware that the biggest concern is usually the User doing something he shouldn't. I can only get so far with trying to catch that. I want to have "all my bases covered", so to speak.

Thanks for the suggestions. I will look into them...

Thanks,

Matt Wray
MCSE, MCSA, MCP, CCNA

http://www.sss-steel.com

 

[fberryman]

Nessus is free and does a great job for the price.

 

[MattWray]

Thanks fberryman, I'll check it out...

Thanks,

Matt Wray

GFH

http://www.sss-steel.com

 

[Xemus]

NESSUS has a Win32 version available as well, called NEWT.

http://www.tenablesecurity.com/newt.html

http://www.closedsocket.com