I'd venture to say that few of us who make our living in software development hold much truck with system crackers. Far from the romantic stereotype put forth by mainstream media, most intrusions are accomplished from the inside, in a simple, sordid breach of trust, rather than by the talents of some lone genius Out There. And if you've ever had to clean up the mess after a break-in from the outside, you probably know the shining truth: Most of those are perpetrated by dolts—dolts who've downloaded sophisticated cracking tools, yes, but dolts nonetheless. (And, yes, I think that "The Dolt Awards" would be an excellent addition to Software Development West 2003. Bring tomatoes and nominate your least-favorite script kiddie.)

The geniuses are out there, though (after all, somebody had to write the tools for the kiddies), and sometimes it'd be nice to have one on the payroll. No, not to sic on your cubemate's Web site—wouldn't it be nice to have someone pounding at the gates, checking your systems for vulnerabilities? Of course, that raises the trust issue again.

Which is why Sanctum goes with software. Can't be bribed, isn't tempted … never doltish. AppScan has been in system admins' toolboxes for quite some time, and it's worth considering for Web application developers. AppScan 3.0 is now out, and offers enhanced reporting, more scans and better performance than previous versions. It's configurable from "attack everything" down to specific vulnerability scans (Can you say "buffer overflow"?), and Sanctum claims less than 1 percent false-positive results. (This, by the way, is where many tools I've tried fall by the wayside: They cry wolf so often that I can't tell the sheep from the goats.) And AppScan can be set up to do both external audits (posing as that mythical Lone Cracker) or internal ones, looking for vulnerabilities from inside the firewall. Contact Sanctum for pricing.

Sanctum Inc., 2901 Tasman Dr., Ste. 205, Santa Clara, CA 95054, Tel: (408) 352-2000, www.sanctuminc.com.

Article Link: Software Development (user registration required)