IT Security Audit Help!

[roadsweeper]

Hi

We have a client whose auditors have recommended that their new infrastructure is regularly scanned for security vulnerabilities. We're not talking about a public website so something like Scan Alert's Hacker Safe certification wouldn't be suitable I presume? Does anyone have any recommendations for reputable companies who provide these kind of recurring services? I do like the Hacker Safe approach of a daily automated scan, I'm just not sure it's suitable for the Terminal Services network (for client users only) which has the servers based in a datacentre? I could be wrong though...

Cheers,

roadie.

[rich1231]

pentest

[zumbruk]

Why not just run nmap and/or nessus at regular intervals & file the output somewhere? You could do it trivially with on of those evil Linux machines running on an old PC no longer shiney enough to put in front of the MD.

[sneakyneil]

There was a PH'er starting a pentest type business a while ago - I'm buggered if I can remember who it was though apgerbag: I'm sure it'l come back to me later.

[small]ps - sorry I haven't been back to you re. the online stuff - I haven't forgotten about it, just waiting for an application![small]

[Xenocide]

GFI NSS!

[agent006]

Have a full manual scan done by a proper (human) penetration tester now, and probably annually if not every 6 months. Then run automated tests in the meantime.