Posted by simone on May 13th, 2011
WatchMouse is mainly known for it’s great monitoring service, the quality of it’s checkpoint grid and it’s accurate testing methodology; no question about that. Though, WatchMouse bundles a few more services together with it’s main product, that are sometimes well hidden. One of these services is the Vulnerability Scanner and this is what I’d like to introduce with this blog post.
Most probably, your online business infrastructure includes a few web servers, maybe some ssh and ftp servers, definitely some web applications, web services and who knows what else! All of these services are usually well-guarded gateways to your business. On the other hand, they are just applications written by humans and, most probably, not bug free. Some of their bugs can cause vulnerabilities that hackers may discover and try to exploit with unknown consequences. I guess you are already aware of all this; your business is probably protected by firewalls and intrusion detection systems; you are also likely to have launched a few security tests and your sure you’re fine! Sure..but for how long?
If you take a look at this page you will see that vulnerabilities are discovered every day. You should be monitoring the security of your online business quite often if you really want to feel safe.
WatchMouse Vulnerability Scanning offers exactly that; we make sure we track all known vulnerabilities and we provide tests for each one. We do this by keeping a large database of vulnerabilities and we update it every day; then for each known vulnerability we install a scan module that can detect the new vulnerability and we silently introduce it into the next run of your scan-monitor. Take a look at this page for a list of all scan modules WatchMouse Vulnerability Scanner includes. You could think of our scanner as a hacker emulator.
Setting up a vulnerability scan monitor is quite easy. If you have a WatchMouse account and haven’t tried the Vulnerability Scanner yet, you can activate a trial here. Ten Scan Credits will be added to your existing account, allowing up to 10 standard scans.
| If you don’t have a WatchMouse account yet, go ahead and take a 30 day trial which enables you to try all features offered by the WatchMouse website monitoring services. |
Next you need to create a scan monitor; you can do that on the Vulnerability Scan Settings page. Click on the “Add scan” button at the bottom of the page and a simple form should appear. When setting up or editing a vulnerability scan, you can choose the type of scan to be performed (see field “Scan type”). Also, don’t forget to click on the little question marks next to each form element as they will provide some useful tips!
The available scan types are:
- Standard (available in 30 day trial)
- Intrusive
- Intrusive with Denial of Service attacks
- Standard – WEB (available in 30 day trial)
- Intrusive – WEB
- Intrusive with Denial of Service attacks – WEB
The scan types with the “WEB” suffix will scan only the web-server and web applications on your server for XSS and SQL Injection vulnerabilities.
Each scan type consumes a different amount of scan credits with “standard” needing only 1 scan credit. The check interval of your scan monitor can be set to once per week and up to once per day. If, for example, you scan a server once per week (say every Sunday) with a standard scan, then you would need about 4 credits per month. With the current credit prices, you can scan your server on a weekly basis for less than 15 US Dollars per month!
| You can always obtain more Vulnerability Scan Credits on this page. |
Finally, don’t forget to add an alert contact! That will be used to send alerts when new vulnerabilities are discovered!
After you save your scan monitor, you need to confirm it before you can really use it. This is a security procedure that ensures that no one other than you can test your servers using the WatchMouse Vulnerability Scanner. It requires you to add a confirmation ticket in a file and place that file in your root folder of your web server. For larger companies or for individuals that need to scan a large amount of servers, WatchMouse can pre-activate a fixed number of IP addresses if you provide us with papers that certify the ownership.
Right after you activate your monitor, you will be able to either launch scans directly through the console or wait until the scan scheduler picks it up. After the first run, you will get alerted (via the alert contact you’ve setup earlier) if the scanner detects any important issues. We classify the issues as “informational”, “warnings” or “holes” with the later two considered as important.
Finally, the reporting console provides all the tools you would need to learn and manage all discovered issues. A live demo of this console can be seen here. So what are you waiting for? Go ahead a give it a try.
Written by Dimitris Balaouras
‘WatchMouse Weekly’ tweets and corresponding blog posts aims to be an introduction with tips and tricks for getting the most out of your WatchMouse monitoring. For all ‘WatchMouse Weekly’ blog posts go here.
