From: Shawn Edwards (shawn.edwards@nokia.com)
Date: Thu Apr 22 2004 - 05:17:08 EDT
ext Mike Murray wrote:
>>I know for a fact that they have some very skilled persons
>>doing dev there. ... Just check some of their development
>>discoveries that's gotta count for something!
>>
>>
>While this is definitely an argument for the fact that a company has
>very smart people working for it (which is definitely not in question in
>eEye's case), I question the validity of the argument as far as the
>evaluation of a network VA tool.
>
Agreed. And maybe my formatting of the email was mistaken. I was moreso
coming to the defence of the company on the blanket statement of not
being 'impressive', but it was not meant as an exclusive criteria for
evaluation of their products. My evaluation discussion (albeit brief
and somewhat thrown together) was moreso on three previous points.
>we'd all be
>buying something that Dave Aitel wrote.
>
>
No doubt.
>While it is often given as a reason that one tool is better than
>another, it simply doesn't follow that an aptitude for discovering new
>vulnerabilities in code is the same as an aptitude for discovering known
>vulnerabilities in running services in the real world.
>
And of course this is one of the strong points of nCircle's product (in
my so far somewhat limited evaluation). The statement I made on "Some
may have better methodologies on enumeration" was with your methodology
in mind. Of course I digress and won't bother touting one product over
another as there are very many points of contention, and was hoping to
keep my contribution to the conversation a little more 'high-level'.
Thanks for the comments Mike!
br,
s
-- Office Website: http://linux.nokia.com/~shards Personal Website: http://%6A%6A%6A%2E%78%65%6C%63%67%30%74%33%33%78%2E%62%65%74 ------------------------------------------------------------------------------ Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off any course! All of our class sizes are guaranteed to be 10 students or less to facilitate one-on-one interaction with one of our expert instructors. Attend a course taught by an expert instructor with years of in-the-field pen testing experience in our state of the art hacking lab. Master the skills of an Ethical Hacker to better assess the security of your organization. Visit us at: http://www.infosecinstitute.com/courses/ethical_hacking_training.html -------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:52 EDT