The document discusses security vendor tools, with participants sharing their opinions on popular free and vendor tools via a Twitter-like format. Several free tools are called out as particularly useful, such as nmap, Metasploit, and Burp Suite. Paid tools that received praise include LogLogic and Qualys, while tools like Cisco IDS, Fortify, CA, and Microsoft SCCM are criticized. The discussion includes humor and opinions on the relative satisfaction rates of free versus paid tools.

1. Collective Wisdom Vendor Tools Security BSides Austin 2011 3/12/2011 1 www.securityscoreboard.com

2. 3/12/2011 2 www.securityscoreboard.com #1 We don’t like homework

3. 3/12/2011 3 www.securityscoreboard.com 28% Response Rate

4. 3/12/2011 4 www.securityscoreboard.com #2 We are funny

5. 3/12/2011 5 www.securityscoreboard.com Favorite security vendor tool? Charlie Sheen This service is a bi-winning solution to our security needs. I think he works for FoundStone.

6. 3/12/2011 6 www.securityscoreboard.com #3 We like open source (or just free)

7. 3/12/2011 7 www.securityscoreboard.com 50% free tools 50% vendor tools

8. 3/12/2011 8 www.securityscoreboard.com Satisfaction Rate Free tools 71% Vendor tools 41%

9. 3/12/2011 9 www.securityscoreboard.com #4 Awesome ‘free’ tools 3. nmap 2. Metasploit Burp Suite Also: snort, sys internals

10. 3/12/2011 10 www.securityscoreboard.com #5 Antique‘free’ tool (Tenable) Nessus (2x) (out-of-date, useless, bloated, slow) Also: Tamper Data (Firefox http proxy plugin)

11. 3/12/2011 11 www.securityscoreboard.com #6 Awesome vendor tools LogLogic McAfee SECURE (HackerSafe) Qualys Also: Tippingpoint (HP/3Com), Encase (mixed)

13. Fortify

14. CA

15. Microsoft SCCM

17. 3/12/2011 14 www.securityscoreboard.com Research. Compare. Review. www.securityscoreboard.com