Web Commerce Security Design and Development

Tools to Verify Security

The first thing many system administrators and network architects do when considering the application of security principles is to analyze the security state of the target system. This may be to run built-in security testing tools that are designed for just this type of task. Next step is to do system hardening with the application of policies, hardening scripts and software-based security updates, host and network level firewalls, and so on.

To do this, you have to use different tools. Some tools, such as Lynx, Wget, and TeleportPro, are designed to test applications. We call them Application Survey tools.

They provide you with a very detailed insight into what the applications do, how they behave from a security perspective, and whether there are hidden vulnerabilities in them. In short, the Application Survey tools provide you with a view into individual system elements. Other tools are more geared toward checking the underlying network and its protocols. Examples of tools in this category are Nmap, Snort, Nessus, and Nikto, all of which enable you to discern security flaws in communication infrastructure and when individual applications exchange data.

While understanding these facilities is essential, you also need to note that security and verification tool development are very dynamic fields and the definition of what tool performs which task is not exact. Some tools are best run on Windows systems (such as Security Configuration and the Analysis ...