Recently a new tool for security assessment and defense was announced: The Fire & Water Toolkit - a collection of cohesive, interactive command line tools that perform network discovery, mapping, assessment and reporting, as well as strong web server defense.

The company behind this software is NT OBJECTives and they are focused on securing web services. JD Glaser, CEO of NT OBJECTives said: "It's so much more challenging with the number of web services coming out, the number of web applications and all that is going on the webserver level."

What everyone is concerned when talking about new security software is money so let's address that issue at the very beginning. Glaser said: "We realized that people in the industry don't want to pay incredibly high prices for security tools anymore." And that's exactly where Fire & Water comes into play. The price for the toolkit is very competitive - $199 per user, $999 per enterprise. But that's not all, Fire & Water is freeware for personal use. Glaser noted: "I always believed in giving out free tools to the security community. We want people to be able to use the Toolkit to solve a lot of their problems quickly and for free, that's the purpose of the Toolkit."

People who use the Toolkit for personal use can still download all the updates but the subscription includes CD-ROM distribution of the toolkit, quarterly CD updates via mail, and email notification and downloads of updates, fixes and enhancements.


As for the toolkit itself, it's not a comprehensive solution, but it rather focuses on overall security checks of the most dangerous vulnerabilities. Glaser added: "We want the users to find the big vulnerabilities and take care of them first." Just as an example, the toolkit contains checks for over a 100 IIS and 100 Apache vulnerabilities. The number of addition grows on a regular basis as the Toolkit is constantly updated.

All the tools are designed to handle scans of large networks and as "bin" tools, Fire & Water can be uploaded to remote servers without installation, and can be tailored to provide customized data through the use of command line switches.

The real power of Fire & Water lies in it's robust reporting features that give you a lot of control with the results. By using XML output interactively, Fire & Water can easily and effectively manage multiple scans and their resulting data via standard (command line) output, CSV, HTML reports (created via XSL templates provided with the tools). Custom report formats can be used by creating your own XSLT templates.