Disclaimer:

These links are provided as a free service to those seeking commercial information security products or shareware tools. The fact that a product is listed here is not an indication that Timberline Technologies LLC has evaluated it nor that we recommend it. The descriptive text is generally taken from the vendor's own product literature. The buyer has the ultimate responsibility to ensure that the information security product is suitable for its intended use. Please follow the links to the vendor pages to obtain more detailed information on a particular product. Additional guidance on product selection can be found in the On-Site Security Workshops.

Vendors Please Note: If your product does not appear in this index or if you feel that it has been incorrectly categorized please contact webmaster@timberlinetechnologies.com and the error will be corrected.

Important Note to Surfers: Timberline Technologies takes strict precautions to provide "safe" links. We will not knowingly provide a link to a site with dangerous active content or questionable privacy policies. Nevertheless, we can not guarantee the safety of all links provided. Those who are concerned about browsing securely are advised to use the facilities of BeHidden, safeWeb, Anonymizer or similar service.

Product Name	Description
CA-Examine (Computer Associates)	Helps identify and control MVS security exposures, viruses, trap doors, Trojan horses and logic bombs that can destroy production dependability and circumvent existing security mechanisms. Through the use of expert system techniques and an English-language interface, CA-Examine instantly provides information that is difficult or impossible to obtain from other sources. It also identifies potential problems, makes suggestions and answers questions. CA-Examine supports the new Product Verification Interface (PVI) that establishes traceability of system software products and identifies proper installation requirements for a growing number of Computer Associates systems products. The CA/Examine analysis and display functions save valuable time for data center managers, security administrators, operations people, quality assurance personnel and others who need to know current MVS system options, parameters and status information.
CARP (CERIAS)	Free report summary software. Produces summary output from distributed COPS reports.
Chkpwd (CERIAS)	Free software used to check for easily guessable passwords. Based on the 1988 Internet worm.
Cisco Secure Scanner (Cisco Systems)	An enterprise-class software tool offering superior network system identification, innovative data management, flexible user-defined vulnerability rules, comprehensive security reporting capabilities, and Cisco 24x7 worldwide support. Cisco Secure Scanner is a key component in Cisco's comprehensive network security solutions.  NetSonar allows users to measure security, manage risk, and eliminate security vulnerabilities enabling more secure network environments.
COPS (CERIAS)	Free software to automate the process of performing a number of security checks on UNIX systems.
Database Scanner (ISS)	Specifically for protecting database applications via security policy creation, compliance and enforcement. Database Scanner automatically identifies potential security exposures in database systems, ranging from weak passwords to Year 2000 compatibility to Trojan horses. Its built-in knowledge base, directly accessible from easily-understood reports, recommends corrective action for violations and non-compliance. Available for Oracle, Microsoft SQL Server and Sybase databases, Database Scanner facilitates ongoing database security improvement within a familiar ISS Adaptive Network Security framework.
GamaScan (GamaSec)	GamaSec's assessment delivered via SaaS (software-as-a-service) identifies security weaknesses in web applications. Gamasec's web application vulnerability scanning does an automated search for security weaknesses in web applications and produces a detailed security report with recommendations for optimally matched solutions. The GamaSec report provides a list of the number of vulnerabilities found, the severity level of each one and the appropriate courses of action.
HackerShield (Bindview Development)	Find holes that a hacker will use to break into your network. Find security holes that are created with network changes. Always be up-to-date with the latest security threats. Get detailed, step-by-step instructions for closing security holes. Prepare for a security audit.
Hobgoblin (CERIAS)	Free software that checks for changes in UNIX file attributes.
I.C.U...MVS (Janus Associates)	Determines where access control rules may be set in conflict or where some singular change in the complex structure may have created an exposure. It allows the user to work at either a summary or detail level, quickly determining if any problems might exist, or to "peel back the layers of the onion" down to the actual code level -- becoming more and more detailed, as the situation requires. When an immediate need arises, use the real-time capabilities. When time is no problem, submit a batch job for later.
Internet Scanner (ISS)	Performs scheduled and selective probes of your network's communication services, operating systems, key applications, and routers in search of those vulnerabilities most often used by unscrupulous threats to probe, investigate, and attack your network. Internet Scanner then analyzes your vulnerability conditions and provides a series of corrective action, trends analysis, conditional, and configuration reports and data sets.
IP360 Vulnerability Management System (nCircle)	The nCircle IP360 Vulnerability Management System protects your networks from security threats and exposures. IP360 enables IT teams to: Reduce business risk. Quantify risk by asset value or class, then prioritize your remediation efforts Comply with security and regulatory policies. Automatically generate reports demonstrating compliance Discover devices, services, applications, and vulnerabilities. Find out what's on your global networks using IP360's next-generation profiling technology.
Kane Security Analyst (Intrusion.com)	A network security assessment tool that provides a fast, thorough analysis of network security for Windows NT and Novell NetWare. The KSA compares your network security configuration with industry best practices or your own organizational security policy. In minutes, you can discover your network’s areas of vulnerability and take corrective action. The KSA includes customizable reports that can be compiled into an attractive audit presentation for your management team.
Nessus (Nessus)	Free, up-to-date security scanner.
NeXpose (Rapid7)	NeXpose is an enterprise-level vulnerability assessment and risk management product that has been designed to accurately identify security weaknesses in a networked environment for all businesses with a network, no matter how large or small. It delivers advanced, automated features and artificial intelligence technology in one software package to enable non-stop, flexible protection from network security threats. As one component of your overall security plan, NeXpose can help you find the weakest link in your network, showing where firewalls, routers, and clients have left the door open for unwanted access.
Nfsbug (CERIAS)	Free software that checks for common NFS vulnerabilities.
NMAP (CERIAS)	Free port scanning software.
NTCrack (CERIAS)	Free software to check for weak passwords in Windows NT.
NTellect (nCircle)	IDS nTellect for Cisco, our first nTellect family offering, taps the power of nCircle's IP360 Vulnerability Management System to greatly improve the accuracy and effectiveness of Cisco IDS/IPS. This appliance-based solution makes threat-aware products such as IDS/IPS systems far more effective with "target awareness." nTellect for Cisco leverages nCircle's Actionable Intelligence™, enabling your security ecosystem to continuously adapt to the changing threat environment.
PanSec (PanSec)	PanSec provides vulnerability assessment as managed services on a weekly, monthly or daily basis, which complement and enhance existing security measures. Customers are afforded significant security benefits, from regular online tests that probe and validate internet-facing systems, which in turn help reduce the threat of infiltration or disclosure.
PhoneSweep (Sandstorm Enterprises)	Designed to help organizations detect dial-in modems that can violate your security policy. Many break-ins in recent years have come not through the Internet, but through unauthorized dial-up modems. PhoneSweep lets you find these modems and shut them down before the bad guys use the same modems to break into your systems. PhoneSweep is an important tool for managing increasingly complex telephone systems.
Pmutil (CERIAS)	Free software to detect promiscuous mode interfaces.
Policy Compliance Manager (Computer Associates)	Identifies potential security problems in your system and provides reports and scripts to correct them. It can be customized to generate high-level or very detailed reports, for areas as specific as a single server or as broad as your entire enterprise.
Quickinspector (Shavlik Security Technologies)	Searches out unauthorized Administration Accounts.  Hidden accounts may have been set up by employees or contractors, that serve to allow access. Seeks out passwords that are over 30 days old.  Locates failures to change passwords regularly, and especially when an employee leaves the company or a contractor service technician changes jobs. Finds dormant accounts that are over 30 days old.  Finds and reports these accounts which indicate if someone has left the company and their account remains active.
Retina (eEye Digital Security)	Retina is designed scan any machine on an internet, intranet, or extranet network in order to identify existing vulnerabilities and check adherence of established security policies. Retina provides help on fixing identified vulnerabilities, and produces a comprehensive report of each scan.
S10SCAN (CERIAS)	Free port scanning software.
SAM Internet Scanner (Schumann Security Software)	Provides automated security vulnerability detection and analysis for devices on a network and supports the security risk management process from policy development through implementation. In addition, SAM/IS performs scheduled or event-driven probes of network communication services, operating systems, routers, e-mail, Web servers, firewalls and applications to identify weaknesses that could be exploited by intruders to gain access to the network.
SAM System Scanner (Schumann Security Software)	A host-based security assessment system that helps manage network security risks through comprehensive detection and analysis of operating system, application and user-controlled security weaknesses. SAM/S2 identifies potential security exposures by comparing security policy with actual host computer configurations. Potential risks include missing security patches, dictionary-crackable passwords, inappropriate user privileges, incorrect file system access rights, insecure service configurations and suspicious activity that might indicate an intrusion.
SATAN (CERIAS)	Free vulnerability scanning software. Dan Farmer's classic tool.
SARA (Advanced Research Corporation)	Security Auditor's Research Assistant. A third generation Unix-based security analysis tool that is: SANS/ISTS Certified; CVE standards support; Enterprise search module; Sandalone or daemon mode; Free-use open license; Updated twice a month; User extension support; Based on the SATAN model.
SECURED (Computer Associates)	Keeps Netscape, Apache, Sendmail, FireWall-1 and other critical application servers safe from hackers and system vulnerabilities. Pre-configured policies take the guesswork out of security by protecting the critical system and application resources. SECURED's patent-pending STOP (Stack Overflow Protection) technology protects Internet servers from common attacks that threaten uptime, content and configuration.
Security Analyzer (NetIQ)	Security Analyzer is an award-winning multi-platform vulnerability scanning and assessment product that discovers and identifies fixes by providing more than 2,300 tests for Microsoft Windows 9x, Windows NT, Windows 2000, Sun Solaris and Red Hat Linux. Systems are analyzed on demand or at scheduled intervals. The results are used to generate comparative reports, recommend security fixes and prioritize responses.
Sentinel (Subterrain Security Group)	Free software download. The Sentinel project is designed to be a portable, accurate implementation of all publicly known promiscuous detection techniques. Sentinel currently supports 3 methods of remote promiscuous detection: The DNS test, Etherping test, and ARP test. Support for the ICMP Ping Latency test is under development.
SFProtect Mobile (Agilent)	Resides on a laptop computer to provide you with the same scan-and-fix functionality of SFProtect-Server in a portable toolkit for consultants or systems administrators who need a fly-away capability. The comprehensive reporting features allows you to tailor your reports to a variety of audiences that include auditors, IT directors, systems administrators, and corporate executives.
SFProtect Server (Agilent)	Used to build your security policy, scan the server for vulnerabilities, and then automatically fix these vulnerabilities with its convenient and intuitive user interface.
System Scanner (ISS)	Provides host-based security assessment analyzing security weaknesses not visible to network scanning. While the Internet Scanner determines vulnerabilities by scanning devices at the network level, System Scanner detects vulnerabilities internally on the system level through an System Scanner agent resident on network devices. These System Scanner agents allow a security policy to be implemented, managed and controlled across an enterprise from a central point. Each security risk is prioritized by System Scanner based on its relative severity. Once a system has been secured, System Scanner locks down that system's configuration with a digital fingerprint, making it easier to detect unauthorized tampering. System Scanner agents are available for Windows NT and many popular UNIX platforms.
Tiger (CERIAS)	Free system security scanning tool.
Trojan (CERIAS)	Free trojan horse checking program.
VAM (StillSecure)	The StillSecure® VAMTM vulnerability management platform identifies, manages, and repairs network security vulnerabilities. VAM manages the vulnerability remediation process from end to end, allowing you to quickly and systematically fix vulnerabilities that expose you to attack. With its extensible, open architecture – the VAM Enterprise Integration Framework™ (shown below) – VAM integrates within your IT environment and serves as a central command and control center for all vulnerability-related activities on your network.

© 2009 by Timberline Technologies LLC