Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For months now, when building websites for clients, I've come across virtually trillions of "Site Security Scanners" supposedly endorsed/approved by various shared web hosts who claim to run XSS, SQL injections, spam measures, and other checks, all for around $300 upwards if you want the plans that do more than one scan a year.

I'm not talking about PCI compliance scans like those offered by Comodo, McAfee, Symantec and the like, which normally cost thousands per year, but rather these vendors seem to be playing off the fear of less technical business owners by offering an affordable alternative to the PCI fims.

Although I could mention a few companies, I know of too many to list, so my main question is: Are these "affordable" scans a good alternative to a PCI scanner if you don't do eCommerce. What about if you're on a shared/managed plan -- shouldn't the host handle this?

As for sites with eCommerce, since some merchants processors mandate their own PCI vendors, or even cover the cost of PCI scans, is it necessary to have an additional scan happening?

Thank you very much to everyone for any insights as this has been on my mind for ages.

share|improve this question

2 Answers 2

up vote 4 down vote accepted

Sturgeon's Law of IT ("90% of everything is snakeoil") applies to this as much as it does to any other aspect of IT. We all know that PCI is just a flaming hoop/bag-of-dog-poo you need to jump through to process credit cards (a "cost of doing business", like paying off your local neighbourhood mobster for "protection"), and not an actual security audit; these automated scans are like walking up to someone random on the street and offering them $100 to not burn down your store.

The only time I might consider one of these places is as an insurance policy against really incompetent developers (that I had no ability to just get rid of). Make it a mandatory part of the acceptance testing that if their code failed one of these scans, they get paid nothing (and, preferably, they get beaten with a stick and set on fire). I can't imagine any sort of automated scan finding issues with the code of a competent web developer in 2011 -- it's not as though any of the issues aren't well-known, and hiring competent people is the most important aspect of running any business.

That being said, the best way to make money is to find suckers, and I'll bet these companies are making plenty of money. Just make sure you're not one of the suckers. To really gauge the effectiveness of any of these companies, just ask them what sort of guarantees they make about their product -- if they're not willing to provide some sort of written guarantee that they've found all the security problems (and that they're willing to be liable if you get hacked in the future), then not only are they selling snake-oil, they know they're selling snake-oil.

share|improve this answer
    
Excellent analogy for the scanners and great overall answer! I'm defiantly going to keep it in mind if I see a victim of those scare tactics because it's one thing for a techie to say "Oh, that service is BS" because to an expert sure, its snake oil, but your analogy defiantly relates to virtually any business owner. –  theonlylos Aug 4 '11 at 18:46

We have used netsol(watchdog scanner, I think) and Qualys and they are okay; Qualys much better than Netsol. Nothing special what a nessus scan doesn't give you. Only reason we would need to get external scan is for some customers who require it, otherwise I would just stick with nessus.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.