Fave raves

By Sandra Gittlen, Network World, 02/27/06

 Start a discussion    Print article

 Comments (1)    Print article

SPI Dynamics' WebInspect

IN THIS ARTICLE CIO, Priceline: Primavera IT director, University of Connecticut: Enterprise Policy Manager IT director, Lucasfilm Entertainment: Remedy Help Desk IT director, Costello & Sons Insurance: Mimosa NearPoint Server IT director, Pentair: WebInspect

“It took me a while to find WebInspect. The problem with most vulnerability tools is the false positives.”

Paul Samadani

• Title: Director of corporate technology services, Pentair, in Golden Valley, Minn.

• Years in networking: 23

We do a lot of development in-house and externally on our intranet and extranet sites. We have a global network of sites that spans to all countries. I want to make sure that these portals are secure.

It took me a while to find WebInspect. The problem with most vulnerability tools is the false positives. I demoed this product, and it found a lot of interesting items, but not a lot of false positives.

Some tools tell you there's a problem but don't tell you how to solve it. If you want to be hated in a development environment, point out to people that they have a problem but you don't know how to fix it. WebInspect points out the code and gives references on how to fix that code. Any developer can take my report and learn how to fix what's wrong. Everyone I've given a WebInspect report to has been impressed, because it was a learning experience for them.

We have two people in IT using WebInspect extensively to test sites across the company. We also tell the in-house developers we use WebInspect so they can test their sites against it. Some departments in the company like to work with [application service providers] for their sites. Our concern is that it's our intellectual property and personal information. We want to know how the ASP will handle that data. Before we sign up with an ASP, we run the WebInspect tool against them. We also do periodic checks using the tool. We can tell whether the ASP is secure or not. I have walked away from companies after seeing the results from WebInspect. I show them the vulnerabilities they have, and if they don't want to fix them, then we won't do business with them.

Related links

Testing, testing
04/16/03

In brief: SPI Dynamics announces vulnerability-assessment software
11/07/05

RSA show to highlight new security approaches
02/23/04

About Network World, Inc. | Advertise | Careers | Contact us | Terms of Service/Privacy | Reprints and links | Partnerships | Press room | Subscribe to NW

Copyright, 1994-2008 Network World, Inc. All rights reserved.