Citation[]
National Institute of Standards and Technology, Automated Tools for Testing Computer System Vulnerability (NIST Special Publication 800-6) (Dec. 1992) (full-text).
Overview[]
This document discusses automated tools for testing computer system vulnerability. By analyzing factors affecting the security of a computer system, a systems manager can identify common vulnerabilities stemming from administrative errors. Using automated tools, this process may examine the content and protections of hundreds of files on a multi-user system and identify subtle vulnerabilities. By acting on this information, system administrators can significantly reduce their systems' security exposure.
Automated vulnerability testing tools are available for a wide variety of systems. Some tools are commercially available; others are available from other system administrators. Additional tools may be developed to address specific concerns for an organization's computer systems. This document examines basic requirements for vulnerability testing tools and describes the different functional classes of tools. Finally, the document offers general recommendations about the selection and distribution of such tools.