Thawte on Scanning your Network Security

[03
September 2001] - Morgan Collett,
Security and IS Manager for Thawte,
spoke briefly with us about Thawte’s latest security offering, a
penetration test that they offer on behalf of Qualys.

Citing
a string of exploits, Collett said that an attitudinal shift in security
thinking is taking place: a realization is dawning that a network must
constantly be monitored to ensure security. He compared network security
to a bank vault – vaults are rated by the amount of time it takes to
pierce them using specified equipment. In other words, someone actually
tries to break them.

This
is the concept behind Qualys. They remotely scan your network, looking for
ways in. Whatever vulnerabilities are discovered are then reported to the
paying customer.

Collett
admits that the scanning and exploit discovery software are freely
available on the Internet. A few hours searching and you could have all
the tools to scan your own system. According to Collett, one would use
Qualys because it integrates the different software, it provides an easy
to read graphical reporting service and it can be scheduled, so that their
systems automatically test yours against the latest exploits and inform
you of vulnerabilities.

There
has been significant interest from Asia, India and Eastern Europe, says
Collett, although local demand has been minimal. He believes the reason
for this is mainly a lack of awareness.

While
“unable to comment” on future offerings from Thawte, he says future
offerings will focus on security, offered via the Net. These offerings
will all be developed for the international market, only incidently
benefiting the local market.

The
Thawte/Qualys combination came about through Thawte’s parent company, VeriSign,
which has been offering Qualys products for the last year.