Uncovering network holes

Let’s face it: Network vulnerabilities are rampant, worm writers are looking for the next server application to exploit, and malicious hackers are breaching the moat and climbing up the castle’s walls. How does an organization defend itself? It finds all the network and server holes, using a new breed of vulnerability assessment tools, and plugs them.

We recently tested vulnerability assessment appliances from Qualys and Foundstone, which take fundamentally similar approaches to finding and reporting network and host vulnerabilities. Although neither product went the extra mile and fixed our problems, we did find great benefit in what they accomplished.

Qualys’ QualysGuard Enterprise Intranet Scanner appliance appealed to our minimalist sensibilities with a streamlined, small footprint appliance and clean Web site, where we configured scans and generated reports. Downsides included Qualys' storing all your network and host vulnerability information off-site at its facilities, and requiring an annual subscription.

Foundstone’s FS1000 Appliance is a high-performance appliance focused on the midsize to large enterprise. The FS1000 offers fast and accurate vulnerability scans with extensive and concise reporting functionality, and stores scanned vulnerability information locally. Although not as easy to manage and maintain as the Qualys solution, the FS1000 was exceptionally solid overall when it came to getting the job done.

QualysGuard Enterprise Intranet Scanner

Qualys' appliance was straightforward to set up and get running. The QualysGuard appliance connected via the Internet and SSL to the Qualys server, which stored our scans and subsequent reports on an encrypted database at Qualys' facilities.

We could use the Web-access capability to kick off a vulnerability scan remotely or schedule a scan for a predetermined time. The Qualys site proved extremely responsive during navigation, in some cases even more responsive than our in-house scanners. We didn’t like that we had to use file import to bring in a series of our network’s IP addresses, which we had to manually enter via cut and paste.

Each time we logged in, we were presented with a nice array of pertinent information, including our most recent vulnerabilities and our most vulnerable devices in order of priority, based on our most recent scans.

Qualys’ reporting was very thorough, and at times, verbose, to say the least. After comparing a Qualys report with Foundstone, Internet Security Systems’ Internet Scanner, Version 7.0, and the Open Source Nessus Project, Version 2.0.6, we found that Qualys’ report was overly sensitive to what we considered insignificant vulnerabilities, and it presented too much information.

Trending of historical scans was highly informative, and Qualys used well-placed graphics to illustrate important historical points. Qualys even used the most up-to-date vulnerability information to consistently reweigh our existing scans.

We liked that Qualys sent an e-mail to the manager and other assigned personnel with a password-protected hyperlink to the report every time a VA scan was completed.

Qualys is based on a hierarchical structure with a manager, scanners, and readers. We would have liked to have the ability to assign multiple managers to our Qualys account.