NT OBJECTives – focusing on securing web services

Recently a new tool for security assessment and defense was announced: The Fire & Water Toolkit – a collection of cohesive, interactive command line tools that perform network discovery, mapping, assessment and reporting, as well as strong web server defense.

The company behind this software is NT OBJECTives and they are focused on securing web services. JD Glaser, CEO of NT OBJECTives said: “It’s so much more challenging with the number of web services coming out, the number of web applications and all that is going on the webserver level.”

What everyone is concerned when talking about new security software is money so let’s address that issue at the very beginning. Glaser said: “We realized that people in the industry don’t want to pay incredibly high prices for security tools anymore.” And that’s exactly where Fire & Water comes into play. The price for the toolkit is very competitive – $199 per user, $999 per enterprise. But that’s not all, Fire & Water is freeware for personal use. Glaser noted: “I always believed in giving out free tools to the security community. We want people to be able to use the Toolkit to solve a lot of their problems quickly and for free, that’s the purpose of the Toolkit.”

People who use the Toolkit for personal use can still download all the updates but the subscription includes CD-ROM distribution of the toolkit, quarterly CD updates via mail, and email notification and downloads of updates, fixes and enhancements.

As for the toolkit itself, it’s not a comprehensive solution, but it rather focuses on overall security checks of the most dangerous vulnerabilities. Glaser added: “We want the users to find the big vulnerabilities and take care of them first.” Just as an example, the toolkit contains checks for over a 100 IIS and 100 Apache vulnerabilities. The number of addition grows on a regular basis as the Toolkit is constantly updated.

All the tools are designed to handle scans of large networks and as “bin” tools, Fire & Water can be uploaded to remote servers without installation, and can be tailored to provide customized data through the use of command line switches.

The real power of Fire & Water lies in it’s robust reporting features that give you a lot of control with the results. By using XML output interactively, Fire & Water can easily and effectively manage multiple scans and their resulting data via standard (command line) output, CSV, HTML reports (created via XSL templates provided with the tools). Custom report formats can be used by creating your own XSLT templates.

The Fire & Water Toolkit includes:

• ntoscan – a fast, accurate port scanner that discovers live hosts and their open ports, capable of banner grabbing, randomized scanning, and a powerful host and customization syntax
• ntoweb – a simple, accurate web server scanner that checks for known, common, high-exposure vulnerabilities
• ntoroute – a traceroute tool that collects data from each of the hosts to identify network architecture
• ntomap – a map generator that graphically documents the scanned network and quickly points out vulnerabilities, includes drill-down capabilities to quickly review host characteristics
• ntotrend – an analysis tool that compares data from multiple scans to track changes in network architecture and security posture
• ntowire – an Internet Information Server ISAPI filter that dynamically enforces strong security policy on web servers, capable of being updated with Snort signatures for greater security

There are a few features in Fire & Water that help ensure accurate data and reduced false positives:

Web Server Fingerprinting – The toolkit accurately identifies web server platforms regardless of banner or stack manipulation, even if a third party filter is obfuscating the information.

Advanced Page Proofing – While the rapid proliferation of “Custom 404 Pages” on today’s sites encourages more user-friendly navigation, it creates unreliable results from scanners. By returning a successful response code, vulnerability scanners are deceived into believing that what they are checking for is really there, when in fact it is simply a custom error page. The Advanced Page Proofing technology in Fire & Water can determine whether a requested resource is really on the target, or whether it has been designed to return such custom error messages.

Smart Vulnerability Selection – By accurately identifying your web server platform, Fire & Water is able to select and execute only the vulnerabilities relevant to each target. This reduces traffic from each scan and eliminates errors and false positives due to bad server responses

Erik Caso, Director of Product Strategy at NT OBJECTives said: “We are working with a few very large beta testers like Intel and General Electric. The response has been very positive so far.” What has improved as a result of the feedback from the beta testers is the reduction in the usage of resources the toolkit uses. What users can do now is choose how much resources they want to use, this gives them complete customization.

What differences NT OBJECTives from companies like Foundstone and ISS is that their target audience is everyone from the only IT person at a small business to a security administrator at a large financial institution. This gives them quite a larger market of security professionals. Here’s a brief overview of their competition:

• Expensive Software (FoundScan, Internet Scanner) – lacks web fingerprinting, native XML based data, web focus, and ease of use for simple repetitive tasks.
• Freeware (nmap, Cheops, Nessus) – lacks tool integration, trending, web fingerprinting, advanced page proofing, XML based data, and html reporting.