Articles
Blogs
Kits
ForumsThe following is a paid review. However, it completely of my own opinion and is not influenced by being paid.
GFI LANguard is a network scanner designed to make the jobs of network administrators easier. Basically, GFI LANguard will search a network for any computers (both Windows and Linux) and then scan them for any vulnerabilities like missing Windows updates, lack of administrator passwords and unauthorized application installs.
Once it has finished scanning, it will create a report for each computer and rate how vulnerable each machine is. In this report, it will list the problems with the computer such as a missing Windows updates and list the solution (such as installing that update). What makes this application particularly nice is if you right click on a certain problem like the missing Windows update, it allows you to download that patch and deploy it remotely. As you would expect with an application like this, it is quite scalable allowing you to fix all security issues it found across all detected computers (that you have the correct permissions to of course) with just a few clicks. With the ability to do local scans, network scans and create custom scans, the software was quite flexible throughout my testing.
Just recently, GFI LANguard has been released as a freeware version for up to 5 IP addresses so it wouldn’t be a bad choice for watching over a small business. Of course, if you want to use it on more than 5 IP addresses you will have to use the paid version. The application has a “This is a 10 day Trial” message when you load it but after 10 days it will switch to the fully functional 5 IP adress freeware version. Personally, I believe that the 5 IP address limitation for the free version is a little low since its not too hard to manage 5 computers manually. I think 10 would have been a nicer number.
Anyway, if its your job to baby-sit a handful of computers, this application is worth checking out. You can download the free version here: http://www.gfi.com/lannetscan/free-network-security-scanner
Spiceworks does pretty much the same thing and is free.
Although these push button tools are good for very basic needs, there is no substitute for real network security audits done by a certified professional with a multitude of misc tools, scripts, skills, and knowledge.
Tools Like GFI languard will give you a basic understanding of your network situation, but the scans are only as good as it’s updated database of vulns, as well as the user pushing the buttons and ultimately reading, the results, then determining the best way to go about fixing it, despite the results holding your hand. There can be false positives, false negatives, and a slue of other mismatching or misleading results that in some cases have caused the network security to become weaker. This is where knowledge and the other tools, scripts, and other misc items come into play.
Attacks are so common place these days, it’s amazing. The thing about it is that a vast majority of attackers are what we like to call script kiddies AKA “Skiddies”. These types of attackers are much more dangerous, because they tend to use the “spray and pray” method, which means they blindly fire off attacks, scripts,etc without any real knowledge about how, who, why, or what. These guys are more likely to stumble on something by accident that no one has seen before.
As Network Security Specialists, it’s our job to keep a watchful eye on all things Network Security. Everyday, hundreds of new threats and statistics come across our desks. It’s no surprise that the majority of the attacks are aimed at windows and targeting un-suspecting users by tricking them into self inflicted issues.
I am sure I can(and Have)go on for hours about network security, attacks, preventions, enumerations, protocols, techniques, auditing, etc etc, but I am sure it will be boring, well maybe to some
. If you want more info, please contact me, I will be happy to discuss it in more detail, and field any questions that you may have.
It seems like most software of this type is priced like they are selling the Dead Sea Scrolls.
At $640 for a 20 IP version it is out of range for many, if not most, of us – unless you work for the government, of course.
Search on Google for “BackTrack 3″ and like the first poster said, it is only a basic scanner and it is no substitute for anyone with real tools and knowledge how to use them.
it seems no testing has been done on linux clients, or does the product not support as many features and actions on linux machines as it does on windows?
@Diabolic Preacher
I’ve not used the product this post is about, but my guess is that it’s basically for Windows. There are much better tools for Linux that are free. Some of those you can probably port over to Windows by using the CygWin compiler, but ya know how that is, it never quite works exactly the same or like it should. A good example of that is nmap.