The expression "forewarned is forearmed" rings true today when we consider computer security. Rather than waiting for a would-be attacker to wreak havoc, a growing number of vulnerability assessment tools and services are available. Armed with the information they provide, you can prevent attacks and bolster your defenses.
Vulnerability assessments can focus on different portions of your computing environment. For example, some tools and services offer detailed inspection of your network to ferret out potential weaknesses while advising you how to correct them. Likewise, you will find assessment tools that inspect your Web application environment--we'll examine some these in a moment. Other solutions focus on databases such as DB2, Oracle, Sybase, and SQL Server as well as e-mail servers.
One reason vulnerability assessment tools are gaining ground and proving useful is the practice of information sharing. As new security threats arrive on the scene, vulnerability databases and vulnerability dictionaries are cataloging the latest problems and making that information available to a variety of assessment tools and services.
One such vulnerability resource is the Common Vulnerability and Exposure (CVE) dictionary, which--as of April 2003--had more than 2,500 entries. The information housed in these entries is made available to a variety of tools and services that you might use to examine your security infrastructure. See the CVE Web site for a list of tools and services that are CVE-compatible.
However, CVE is not the only resource for information on the latest security threats. There are several vulnerability databases available, including ones from CERT and the National Institute of Standards and Technology. When considering vulnerability assessment tools and services, be sure to look for solutions that provide ongoing updates from one or more of these databases so you can keep current on security threats and how to protect yourself against them.
Last month in this column, we looked at the types of vulnerabilities that can be introduced when you implement Web applications. Some of the more common things attackers can use to take advantage of your Web applications are server configuration errors, unpatched software, unused services, unprotected administration tools, non-validated application requests, poorly configured encryption, and issues with access control.
Whether your Web applications are simple or complex, taking the time to perform ongoing vulnerability assessments will keep your applications available and less prone to attack. Of course, assessment tools are not a replacement for a good firewall, antivirus software, and other security measures. Adding assessments merely helps increase the level of security for your organization.
Like other security technologies (such as firewalls), tools and services in the vulnerability assessment category are all over the map in terms of both functionality and price. Let's examine a few of these tools and services to get an idea of what you'll find there.
