The True Identity of These "Secretive" Bloggers is Now Revealed!

2009-08-14T08:01:00.000-07:00

2009-08-10T20:51:00.001-07:00

We're gone - But will never be forgotten!

2009-07-10T06:47:00.001-07:00

2008-04-05T15:07:00.000-07:00

2008-02-06T10:16:00.000-08:00

2008-01-20T16:21:00.000-08:00

2008-01-04T13:24:00.000-08:00

2008-01-01T22:38:00.000-08:00

2007-12-19T19:32:00.000-08:00

2007-12-17T10:28:00.000-08:00

2007-12-14T12:13:00.000-08:00

2007-12-12T14:39:00.000-08:00

Immunitysec ( A- )

2007-12-10T15:06:00.000-08:00

We received a request directly from Dave Aitel to review his company, Immunity. We thought that this request was a bit odd as Immunity appears to be a Software Provider and not a Consultancy. We normally only review Professional Security Service Providers. At any rate, we decided to make good on the request and as such reviewed the Immunity website and placed a call into Immunity and spoke with Dave's wife (very nice, polite woman). Here's how we feel about Immunity.

Immunity is for all intents and purposes a Security Software company. They sell a very powerful tool called CANVAS, which is an advanced framework for penetration testing. CANVAS is particularly useful for Professional Security Service Providers (consultants) who perform penetration testing services. Other companies like Core Security compete with CANVAS. Core Security has another very powerful tool called Core Impact.

Immunity does have a software research and development team, or at least that is what we were told. The team does not release any advisories for any of the issues that they discover, and they only add the issues to CANVAS if they are discovered by a third party first. If not, it is our understanding that the issues remain 0-day and held by Immunity (or potentially sold to legitimate exploit brokers, but we don't know that for a fact.) We do know that Immunity will purchase vulnerability information from brokers. This information is mostly incorporated into CANVAS from what we understand.

One thing that we are fairly certain of is that Dave Aitel is a high talent individual. As a result we automagically assume that he surrounds himself with other high talent people. We couldn't picture Dave surrounded by idiots, it would drive him nuts. Anyway, we feel that its safe to say that Immunity has a very capable team with very advanced skills that could be very useful for performing Professional Security Services. Having said that, they really don't offer much in the way of Professional Security Services on their website... and we think we know why.

While talking to Dave's wife we secretly realized that it would be a conflict of interest for Immunity to offer Professional Security Services in conjunction with selling software used by Professional Security Service Providers. In short, if they offer Professional Security Services then most providers wouldn't buy their Professional Security Service testing software (CANVAS). On the other hand, if they sell the software and do not fully flaunt their services, then they'll probably make a good buck.

We think that is why the Immunity website is so focused on CANVAS and not on the offering of Consulting Services. There is a tab on their website that talks about their service offerings, but it is very, very, very, lame. The entire services page is literally one paragraph long. You can check it out here. With that said, we are certain that Dave has an A+ team that is very capable of offering seriously hardcore services... but we can't give them an A+.

One reason why we can't give them an A+ is because they are a software vendor and are not focused strictly on the offering of services. The other reason is because of the aforementioned conflict of interest, their technology is purchased by Service Providers. In conjunction with that they do not release advisories to the public, and their core focus is not protecting their customer networks, but instead is building CANVAS.

So, our opinion is that while we have a great amount of respect for Dave Aitel and the folks at Immunity, we need to be honest and give them a B. We think that their software is totally kick ass, we love reading Daily Dave, and we know that Dave could probably crack anything... but we just can't give Immunity an A.

Oh and hey... GO BUY CANVAS!!! We did and we love it!!

Score Card ( Click to Enlarge)

Netragard ( F--- )

2007-12-05T09:25:00.000-08:00

Netragard ("http://www.netragard.com") tries to be a Professional IT Security Services Provider that offers a wide range of services including by not limited to, Vulnerability Assessments, Penetration Tests, Web Application Assessments, Computer Forensics, etc. At first glance we were expecting to poke holes in Netragard because of their "Got Milk" like introductory page. Theirs reads "Got Hacked" and we thought it was a bit dorky. But we were certainly surprised. They are more "fluff" than anything! IN FACT.....

After further research, we also noticed that this "Security Review" site was built by Adriel Desautels himself. Kinda cool, eh? If you don't believe me, check the blog on his company web-site, http://snosoft.blogspot.com/ - Could you have at least used a different font or different Blog platform? Was business that tough that you had to start a blog and publicly humiliate people, their reputations and their livelihood Mr. Adriel T. Desautels?

Perhaps it was the absolute "stellar" review you gave yourself, that gave yourself away?

We, the new and improved SECReview team would like to officially rename the SNOsoft team to BLOWsoft and formally apologize to the people and the companies that Adriel Desautels and David Morris insulted and defamed.

Please read these reviews from the mind of a jealous, manipulative and calculating competitor. Certainly not an unbiased third party that provides a community service to the public...

All of our researchers here at the new SECreview team are trying to determine if there is a Grade that is less than an F for this so-called company Netragard, since giving them an F- is still too nice!

2007-12-04T09:47:00.000-08:00

Sword and Shield ( A )

2007-11-30T09:33:00.000-08:00

Sword and Shield Enterprise Security ("SSES") offers a wide range of quality Professional Security Services that include Enterprise Security, Compliance/Governance, Penetration Tests, Payment Card Data Security, Incident Handling/Forensics, and Managed Services. When we browsed through their website, we found it to be accurate, well written and truthful.

In fact, we were so impressed with the technical depth and content of their website that we decided to call them while posing as a prospective customer to see what kinds of services they could truly deliver and to see if we could stump them. This usually works because websites often advertise services that can't be delivered in full, but this was not the case with Sword and Sheild. They were actually more impressive on the telephone than they were on the web!

Not only were we impressed by their service offerings, but we were also impressed because of the technical depth of the conversation that we were able to have with the Sword and Sheild Account Manager. (Its not often that you get a technically capable Account Manager.) We called them asking to remain anonymous, claiming that we were trying to decide on three vendors of interest. This anonymity would turn most vendors off, but not Sword and Shield. They treated us in a respectful manner answered all of our questions quickly and honestly, including pricing questions! In fact, they even sent us sample reports (which looked pretty good).

When we threw terms at them like evasive testing, distributed metastasis, etc, they didn't even blink. They knew what we were talking about immediately which is far more than we can say for most Professional IT Security Service Providers. They also have their terminology right. When we asked them for a price quote for a Penetration Test they asked "Are you sure that you want a penetration test? Penetration tests will actually compromise computers." This amazed us because they are the first vendor that we've talked to that properly differentiates Penetration Testing and Vulnerability Assessments. Most vendors sadly don't know the difference.

When focusing on the Sword and Sheild homepage we noticed that the writing was professional, clear, technical and accurate. Again that is more than we can say for most of the Professional IT Security Service Providers. Many providers try to use complex and unclear sentences mixed with technical jargon so that they sound like they know what they are talking about when they really don't. Sword and Sheild don't do that, they actually know what they are talking about and take the time to educate their customers and prospects.

The only gripe that we have with Sword and Sheild is that they did not fully respect our request to remain anonymous. Shortly after we talked with them and received their sample reports, we received a second email from the Account Manager. He made an attempt at identifying us by searching for "vocovi" on google, ebay and other places. While we appreciate the fact that he's technical enough to do that, he should have done more homework before jumping to conclusions about who he thought we were. That being said, he did give us another good company to review, which we'll do later.

All in all, we'd recommend Sword and Sheild despite their almost impulsive attempt to figure out who we are. They are a capable security company that offers real services and they have the ability to deliver. So Sword and Sheild, keep up the good work!

Score Card (Click to Enlarge)

2007-11-29T21:44:00.000-08:00

2007-11-27T20:38:00.000-08:00

2007-11-26T19:16:00.000-08:00

2007-11-24T22:58:00.000-08:00