Web-based security audit tools offer useful feedback

A number of companies now offer Web-based auditing tools that will scan your network and report vulnerabilities free of charge. These tools are mixed in terms of their reliability, and the companies acknowledge that to get a true sense of how secure—or insecure—your Internet connectivity is, a full audit is still necessary.

But these freebie tools offer a quick snapshot of possible vulnerabilities and present some useful information you can act on to better secure your network. You have to view the information the audits display with some level of skepticism, however, because not all Web-based tools appear to be equally thorough. Even the ones that seem to do a more comprehensive job present the data with a sales pitch to entice you to invest in fee-based audit services. But despite the obvious marketing tactics, you can come away with some helpful feedback on your network if you use these tools.

Available options
I test-drove three Web-based security-audit tools: Shields UP, SecurityMetrics, and DataScope. Shields UP is an easy-to-use program from Steve Gibson’s Gibson Research Corporation and is aimed at Windows users. Gibson offers other security tools as well, including LeakTest, which tests firewall security.

DataScope is an IT consultant firm located in St. Louis. It offers a wide range of services in addition to a free Web-based security audit. SecurityMetrics, Inc., has a number of Web-based tools for auditing security and also offers a security monitoring appliance you can order from its Web site.

Differences in the approaches the three take to auditing Internet security were minor, but they returned some widely varying results and presented those results in various ways. In the end, the report from one tool left me skeptical, when compared to the results of the other two. The matter-of-fact presentation of one tool's findings made it appear the most reliable and thorough product.

Shields UP
Gibson’s Shields UP is the most streamlined and easy to use of the three tools. It’s also the only one that requires a download. Actually, the download isn’t really required, but a message on the site states that if you don’t use the utility, Shields UP may incorrectly identify your system’s IP address.

In fact, when I ran the test from my machine, which is on a private network hidden behind a firewall, Shields UP was unable to correctly determine the IP. So I downloaded and installed the IP Agent utility (Figure A), which is only 20 KB in size, and ran it to perform the test.


You can begin the test by running the IP Agent utility or by clicking one of two buttons to either test your firewall or probe your ports. Shields UP then displays a series of browser windows updating you on its progress.

The good thing about Shields UP is that it quickly performs its test and displays the results in your browser window. You don’t have to wait long to find out what the program has determined about your Internet security.

You’ll see a table like the one in Figure B showing what Shields UP tested and how well your Internet security fared. As you can see from the results, Shields UP found my system to be very secure.


Gibson’s tool recognized that my computer was on a private network, and the message it presented claimed that such networks are inherently safe because it would be difficult for potential hackers to actually find it. As you can see from the test results, Shields UP found that the ports it scanned were closed and that the computer was essentially hidden from outsiders. Figure C shows Gibson's explanation of private networks.


Most would agree with the idea that computers on private networks are more secure than others. Shields UP did display a disclaimer, however, stating that passing with flying colors doesn’t necessarily mean that you’re completely safe and can rest easy. Gibson acknowledged that he’s still working on Shields UP to ensure that it performs thorough tests and delivers accurate results, and he advised users to consider the newer version of the product in beta.

Similar tests using other utilities seem to indicate that Gibson is right to caution users not to feel too secure. SecurityMetrics, for example, had a different story to tell about my Internet security.