Attack Surface Analyzer takes a snapshot of your system state before and after the installation of product(s) and displays the changes to a number of key elements of the Windows attack surface.

This allows:

• Developers to view changes in the attack surface resulting from the introduction of their code on to the Windows platform
• IT Professionals to assess the aggregate Attack Surface change by the installation of an organization’s line of business applications
• IT Security Auditors evaluate the risk of a particular piece of software installed on the Windows platform during threat risk reviews
• IT Security Incident Responders to gain a better understanding of the state of a systems security during investigations (if a baseline scan was taken of the system during the deployment phase)

System Requirements

Supported Operating Systems: Windows 7;Windows Server 2008;Windows Vista

Collection of Attack Surface data: Windows 7, Windows Vista, Windows Server 2008 R1 or Windows Server 2008 R2

Analysis of Attack Surface data and report generation: Windows 7 or Windows Server 2008 R2 with Microsoft .Net 3.5 SP1

You can download Attack Surface Analyzer here:

64-bit – Attack_Surface_Analyzer_BETA_x64.msi
32-bit – Attack_Surface_Analyzer_BETA_x86.msi

Or read more here.

OpenFISMA is built on a modern, standardized platform called Zend Framework, which is an open source, object-oriented web application framework with a flexible architecture.

The OpenFISMA project is unique in several ways.

• Open source – OpenFISMA is the largest open source project for the U.S. federal government. See the open source section for an explanation of the advantages of open source.
• Highly customizable – OpenFISMA is highly customizable through our web-based administration interface. The branding can be changed. The workflow can be changed. The roles and privileges can be changed. New reports can be added to the system without writing a single line of code.
• Easy to deploy – OpenFISMA comes with built-in security controls that allow you to easily C&A your OpenFISMA implementation with ease. OpenFISMA also provides configurable security policies so that your implementation will fall in-line with your agency’s specific security policies as well.

Features

• Track security weaknesses to closure

  OpenFISMA provides a proven business process for tracking the remediation of security weaknesses. This business process enforces quality controls and segregation of duty, pulling together individuals from different areas of the organization to plan, execute, and review all remediation actions.

• Role-based access control

  Access control is based on roles; each role has fine-grained access to certain privileges on each information system that is being tracked. The roles are completely customizable.

• Active Directory/OpenLDAP Authentication

  Authentication in OpenFISMA can be handled by any LDAP-compatible service, such as Microsoft Active Directory (AD) or OpenLDAP, in order to provide single sign-on convenience for your agency’s users.

• Scan Injection

  If you run automated scans as part of your C&A process or as part of a continuous monitoring program, you can upload your scan results in XML format directly into OpenFISMA. OpenFISMA uses the information in scans to create new findings, assess risk exposure, and even update your asset inventory.

  The scan injection provides some smarts, too. OpenFISMA matches new scan results against past scan results. Based on a simple set of rules, it decides whether to supress duplicate findings or to flag multiple, similar findings for human review. This reduces the overhead of redundant findings and can also help your organization identify systemic weaknesses that could be addressed more efficiently at the enterprise level.

• E-mail Notifications

  OpenFISMA sends notifications directly to users’ inboxes when action is needed from them. This automated notification system relieves security managers of the burden of manually monitoring the workflow. The notification system also reduces turn-around time by alerting users quickly when their action is needed.

• Rich Text Editing

  Data about findings is entered using a rich text editor that allows for formatting (bold, italics, underline, and outline formats) as well as spell checking.

• Plug-in Reports

  Reporting is one of the most critical requirements for any process management tool. OpenFISMA provides the ability to “plug in” a report without writing any code. These reports are created by writing SQL and updating a configuration file. OpenFISMA then creates the interface and data export features on-the-fly. The plug-in architecture drastically reduces the cost and time involved in creating custom reports.

• NIST SP 800-53 Rev. 2

  OpenFISMA contains many of the NIST SP 800-53 security controls required for a FIPS-199 “high” impact information system. This helps you get your OpenFISMA instance authorized to operate quickly. The built-in controls include system use notification, rules of behavior, electronic privacy policy (p3p), and many, many more.

  OpenFISMA also contains a catalog of all NIST SP 800-53 Rev. 2 controls built-in. Findings in OpenFISMA can be matched against these security controls to provide supplemental information for remediation and planning. The catalog includes descriptions of the controls, scoping, and supplemental guidance.

You can download OpenFISMA here:

OpenFISMA (registration required)

Or read more here.

Redseal is launching a free offer next week for security consultants, pen testers and auditors.

Redseal develops a product called Security Risk Manager (SRM), it does the following – (non sales overview)

1. Imports firewall and router configuration files
2. Audits and checks them for errors, mis configurations, redundant rules, checks against best practices etc
3. Draws a network topography map from the configs (you can move this around, save layouts, export to Visio)
4. Builds a network blueprint of all permitted traffic flows which you can query (i.e. can traffic from internet get to my PCI servers etc)
5. Built in “inference intelligence” auto populates what applications are running on the network and gives them asset values (you can customize and define as much as you want)
6. Has a built in Threat Reference Library to provide vulnerability info, currently over 23,000 and updated on a weekly basis (you can also load in Nessus, Qualys and Foundstone scan data if you have it as well)
7. Analyzes the network and security data to identify what vulnerabilities are the most important to fix based on network access and importance.
8. Shows unique graphical ways to quickly view and drill down through huge sets of data to find the most important information.

The product has been referenced by some consultants as the first way to perform a passive pen test as it is completely unobtrusive, you just need to load in configs, no scanning required.

Redseal has launched a license for Consultants to use out in the field and to promote it they are offering security consultants and auditors free and full use of the product for 30 days. They are keen for consultants to use the product and prove out it’s capabilities and values in the field and they want to hear feedback and so if anyone would like to take us up on this offer please email consultants@redseal.net to sign up for the program, it’s quick, easy and free.

Some of the latest news is below:

Red Seal Press Releases

There is also a short white paper here.