Kane Security Analyst for Windows NT

Manually analyzing Windows NT security is tedious. Human errors can occur, leading to a breached system or network. To reduce this risk, you need to use software tools to assist in your security analysis.

Intrusion Detection (recently acquired by Security Dynamics) provides the Kane Security Analyst for Windows NT. KSA is a system security analyzer and assessment tool for NT and Novell networks that streamlines a security administrator's job. KSA uses built-in security intelligence to examine system configurations and find areas that pose risks or need adjustment. The tool is well suited for small shops and large enterprise networks.

A Closer Look
KSA assesses the overall security status of NT networks and reports on six areas: password strength, access control, user account restrictions, system monitoring, data integrity, and data confidentiality. According to Intrusion Detection, KSA performs the work of seasoned security specialists and streamlines the analysis process with built-in security practices. KSA's embedded knowledge lets the software analyze numerous aspects of system security, such as user and group permissions across domains, C2 security compliance, password strength, trust relationships, event logs, scripted passwords, audit policy compliance, excessive rights, Registry security settings, logon violations, and domain security.

KSA performs interactive Registry assessment, providing access control list (ACL) maps and investigating interactive file rights. KSA's file rights feature provides a simple interface for administrators to examine rights and privileges associated with users, groups, and directories. Without this functionality, administrators must manually examine rights and privileges.

Installation and Use
I installed KSA on a Small Business Server (SBS) system. SBS runs NT Server 4.0 with Service Pack 3 (SP3). I didn't alter NT or SP3's security configuration. Installing KSA was straightforward and took less than a minute. KSA operates from any PC workstation attached to the network, so it doesn't require server resources or system changes. Thus, the product has little effect on your environment.

I started KSA and configured it to run a security audit on the SBS system. The KSA interface is easy to use, and configuration went quickly. I had to select only a few checkboxes for the tests I wanted to perform. KSA performed the system audit in less than a minute and displayed the results on a report card, as Screen 1 shows. I was surprised that my test system failed in every area except Access Control.

KSA's report card lets you examine each risk area. Click List Risks to see explanations for each area. I reviewed the risks and discovered that 17 percent of the SBS users had no password, 17 percent of user passwords had expired, the account lockout feature was not active, system auditing was disabled, 28 percent of the accounts had administrative privileges, 83 percent of user passwords didn't expire, user accounts didn't expire, and the machine's OS/2 and POSIX subsystems were still in place. These configurations create security risks.

Fortunately, KSA's built-in expertise helped me secure the system. KSA provides stellar reporting capabilities. The software details each area of the system that needs attention, including risk level, current status, and suggested settings for tighter security. KSA furnishes more than 30 impressive itemized reports, such as the Account Policy Analysis, Audit Policy Report, Access Control Analysis, and Current Security Standards. Each report provides valuable information to help you secure your system.

Security Helper
The time KSA saved me inspecting my system justifies the product's cost. I loaded the software, configured it, ran audits, printed reports, and secured the system in less than an hour. Manually performing the checks and adjustments would have taken much longer. KSA is a fantastic security administration tool.