Network Computingwww.networkcomputing.com

	Issue TOC Print full article Print this page E-Mail this URL Discuss this article Flame the author     In this article Introduction Wants & Needs Foundstone Enterprise and FoundScan Engine 2.6 Qualys QualysGuard Intranet Scanner Harris Corp. STAT Scanner Professional Edition 5 eEye Digital Security Retina Network Security Scanner Vigilante.com SecureScan NX 2.6.50 SAINT 4.3 nCircle Network Security IP360 Vulnerability Management System 5.3 Other Products Reviewed How We Tested Web Links Report Card

Harris is on to something with STAT Scanner--it not only scans a very wide array of vulnerabilities but also incorporates policy/registry checking and remediation. This product lets an administrator set registry, log and user policies that can be manually or automatically updated upon detection.

One area that sets STAT Scanner apart from peers is its noninvasive nature. This product doesn't offer a "safe scan," because it doesn't need it. However, this design is both an asset and a liability. Because there are no unsafe scans available, the risk of target meltdown is almost completely mitigated (we still recommend caution because we did encounter a few application issues); however, this product does require authentication for each and every target, and failure to provide such authentication will result in a tremendous number of false positives and false negatives.

We attempted scanning without any authentication parameters on several hosts; the system simply indicated that the open port might be a Trojan. This could be a serious problem for large organizations, particularly those with varied administrative realms. This limitation hinders the ability to scan a large number of nonsimilar networks without a great deal of intervention and departmental cooperation. Although administrators can create authentication groups and assign those groups usernames and passwords, we still see this as crippling.

Finally, STAT was incapable of assessing our NetWare servers. Although STAT will attempt to assess other system types, it is best-suited for Microsoft and Unix environments.