NT OBJECTives - focusing on securing web services
by Mirko Zorz - Thursday, 19 December 2002.
The Fire & Water Toolkit includes:
  • ntoscan - a fast, accurate port scanner that discovers live hosts and their open ports, capable of banner grabbing, randomized scanning, and a powerful host and customization syntax
  • ntoweb - a simple, accurate web server scanner that checks for known, common, high-exposure vulnerabilities
  • ntoroute - a traceroute tool that collects data from each of the hosts to identify network architecture
  • ntomap - a map generator that graphically documents the scanned network and quickly points out vulnerabilities, includes drill-down capabilities to quickly review host characteristics
  • ntotrend - an analysis tool that compares data from multiple scans to track changes in network architecture and security posture
  • ntowire - an Internet Information Server ISAPI filter that dynamically enforces strong security policy on web servers, capable of being updated with Snort signatures for greater security
There are a few features in Fire & Water that help ensure accurate data and reduced false positives:

Web Server Fingerprinting - The toolkit accurately identifies web server platforms regardless of banner or stack manipulation, even if a third party filter is obfuscating the information.

Advanced Page Proofing - While the rapid proliferation of "Custom 404 Pages" on today's sites encourages more user-friendly navigation, it creates unreliable results from scanners. By returning a successful response code, vulnerability scanners are deceived into believing that what they are checking for is really there, when in fact it is simply a custom error page. The Advanced Page Proofing technology in Fire & Water can determine whether a requested resource is really on the target, or whether it has been designed to return such custom error messages.

Smart Vulnerability Selection - By accurately identifying your web server platform, Fire & Water is able to select and execute only the vulnerabilities relevant to each target. This reduces traffic from each scan and eliminates errors and false positives due to bad server responses

Erik Caso, Director of Product Strategy at NT OBJECTives said: "We are working with a few very large beta testers like Intel and General Electric. The response has been very positive so far." What has improved as a result of the feedback from the beta testers is the reduction in the usage of resources the toolkit uses. What users can do now is choose how much resources they want to use, this gives them complete customization.

What differences NT OBJECTives from companies like Foundstone and ISS is that their target audience is everyone from the only IT person at a small business to a security administrator at a large financial institution. This gives them quite a larger market of security professionals. Here's a brief overview of their competition:
  • Expensive Software (FoundScan, Internet Scanner) - lacks web fingerprinting, native XML based data, web focus, and ease of use for simple repetitive tasks.
  • Freeware (nmap, Cheops, Nessus) - lacks tool integration, trending, web fingerprinting, advanced page proofing, XML based data, and html reporting.


Credential manager system used by Cisco, IBM, F5 has been breached

Pearson VUE is part of Pearson, the world's largest learning company. Over 450 credential owners (including IT organizations such as IBM, Adobe, etc.) across the globe use the company's solutions to develop, manage, deliver and grow their testing programs.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Wed, Nov 25th