Software:SekChek Classic
| Developer(s) | SekChek IPS |
|---|---|
| Stable release | 5.1.3
/ 24 May 2016 |
| Operating system | Windows, OS/400, UNIX, NetWare |
| Size | 10.0 MB |
| Type | Computer security |
| License | Proprietary |
| Website | sekchek |
SekChek Classic comprises a set of automated computer security audit and benchmarking tools for non-mainframe platforms developed by SekChek IPS in 1996. The product analyses the effectiveness of security controls on host systems supporting organisations’ applications and produces reports highlighting strengths, weaknesses, and recommended corrective actions, relating to security controls on a host or domain. Reports are offered in user selectable formats, including Microsoft Word, Excel and Access. The product comprises four security analysis modules: Windows, AS400, UNIX and NetWare as well as SekCrypt, a symmetric encryption/decryption module.
Supported platforms and technologies
Operating systems:
- Microsoft platforms: Windows NT4 to Windows 2012 R2, Active Directory, MS-Exchange
- UNIX platforms: HP-UX (including C2/TCB), AIX, Solaris, OSF/1, DG/UX, OpenServer, UnixWare, DYNIX, BSD, HI-UX, Nokia IPSO, Linux
- NetWare Platforms: NetWare 4.x, 5.x, 6.x
- OS400 platforms: iSeries (V2R3 to V7R1)
Encryption technologies
- PKI (public key cryptography), RC4, DES, Triple DES, AES, RSA, S/MIME, TLS/SSL (Transport Layer Security / Secure Sockets Layer).
Microsoft Office versions:
Features
The audit tools scan security policies, control settings and values from the enterprise’s host operating system. The security settings and values are benchmarked against data points contained in a statistics database and mapped against various industry types, geography, operating platform and number of system accounts.
The statistics database contains over 30 million anonymous security measures retrieved from over 80,000 analyzed systems located in 140 countries. The reports are offered in Microsoft Word, Excel and Access and contain technical and high level summaries. The developers of the software designed the reports to assist IT and Audit professionals determine the effectiveness of host security and provide formal evidence of auditing for inclusion in working papers.
The Windows, OS400, UNIX and NetWare tools scan a system for security policies and objects defined on the target host or domain. The product analyses the host’s details, User and Group accounts, Group memberships, Account Rights, Administrative privileges, Security policies, Security properties, Services, Audit Events, Network Shares, Disks and Host Properties.
The SekCrypt utility is a symmetric encryption tool that can encrypt and decrypt files using encryption algorithms 3DES and AES (Rijndael).
Distinctive characteristics
- The server extract tools do not have an installation procedure.
- The extraction products do not depend on agent software.
- Data is encrypted with PKI prior to submission for report processing.
- Includes embedded utilities: A PC Audit tool that performs a basic analysis of a client PC; Windows Firewall auditor; Encryption software; an Active Directory query tool; an Event Log query tool; a file hasher; SID resolver; Orphaned SID locator; and Ping.
Criticism
Clients, with company policies against exporting sensitive corporate data, were concerned about using SekChek Classic. Some of these concerns were dissipated with the development of the SekChek Local tool – a product utilized for on-site assessment of Windows systems.
References
Sources
"Audit Programs & ICQs" (Fee required). isaca.org. http://www.isaca.org/Template.cfm?Section=Home&Template=/gir/catDspl.cfm&catID=2&catName=IS%20Audit%2C%20Control%20%26%20Security%20-%20Specific%20Environments.
"IT Security Review Services". Deloitte. http://www.deloitte.com/dtt/section_node/0,2332,sid%253D34783,00.html.
"AD Product Specifications" (PDF). SekChek Local. http://www.sekchek.com/downloads/product-specification-sekchek-local-active-directory.pdf.
"SAM Product Specifications" (PDF). SekChek Local. http://www.sekchek.com/downloads/product-specification-sekchek-local-sam.pdf.
"Compare Classic Software" (PDF). SekChek Classic. http://www.sekchek.com/compare-local-classic-tools.htm.
Carroll, Mariana (November 2006). "An Information Systems Auditor's Profile" (PDF). UNISA Dissertation. http://etd.unisa.ac.za/ETD-db/theses/available/etd-06182007-143905/unrestricted/dissertation.pdf. "These reports can be used to identify weaknesses as well as risk ratings and suggested corrective actions. These statements are supported by Mookhey (2004) when he asserts that "the use of these tools for security auditing is prevalentand driven mainly by the inherent complexity within information systems.".
"Annual Specialist IT Audit Activity Report 2004/5" (PDF). LB Bromley Internal Audit Report. November 2006. http://sharepoint.bromley.gov.uk/Public%20PDF/08-AppC-ASC-2906.pdf.
Kearns, Dave (October 5, 2006). "SekChek evaluates security". Network World (IDG - International Data Group). http://www.networkworld.com/newsletters/nt/2006/0508nt1.html. Retrieved May 20, 2009.
Bosavage, Jennifer (June 7, 2006). "New Service Seeks Out Security Gaps". Dark Reading. TechWeb (United Business Media). http://www.darkreading.com/security/vulnerabilities/showArticle.jhtml?articleID=208804683. Retrieved May 20, 2009.
"SekChek Provides Independent Reality Check of OS Security" (Press release). Tippit Inc. June 27, 2006. Independent, objective, and reliable evaluation of a company's computer security is the key deliverable of SekChek
External link in |publisher= (help)
"Computer Security Evaluator SekChek Announces Brand New Product for On-Site Security" (Press release). Reuters. March 17, 2008. External link in |publisher= (help)
"Computer Security Evaluator SekChek Announces Compatibility with Microsoft Windows Vista" (Press release). DABCC. Oct 5, 2007. External link in |publisher= (help)
External links
 |
