When I found this out I was astounded. I absolutely couldn’t believe that they were using tools that I can download for FREE to scan for security problems.

I found this out when they found a weak SSL cipher on a website of mine. The hosting company was trying to fix the problem but for some reason hackersafe didn’t recognize the fix. So they asked me to contact support and find out, if possible, what tool they were using. I called support and spoke to a very helpful gentleman that was more than willing to show me what they use. He sent me to the free tools page on the Foundstone website. Obviously I questioned the use of free tools. It astounded me! He said that the vast majority of the tools they use are free. I couldn’t believe that I was paying $1800 a year for free tools. This boils down to paying for a name and nothing else.

It has to be said that McAfee bought Foundstone a few years back, late 2004 I believe. If you search for McAfee purchases Foundstone I’m sure you’ll pull up some articles on it.

One of  the questions this raises is how many of these “web security” companies are using free tools and charging butt loads of cash for it? The next question that comes to mind is why not download the tools and do the scans yourself and not pay for the use of an overly expensive logo & name?

It’s quite obvious that the tools work extremely well and that most people don’t know about them. If you’re a business just starting out and are worried about the security of your website, and you should be, I would say download the tools and do the checks yourself. If you find problems contact your hosting company to get them fixed.

Now paying for the service can bring a boost to your business because it associates you with a well know name and brand, which in turn can boost customer confidence. Boosting customer confidence usually leads to an increase in sales. If it doesn’t then it’s not worth the money. Period. There are plenty of services out there that boost customer confidence even if it doesn’t really amount to anything. Kinda like the Better Business Bureau. They are a reporting agency that facilitates dialog between customers and retailers. But in the end they have no power and can change nothing. You pay them to display their logo and have your company associated with them.

The question boils down to one simple thing – is it worth the extra expense to have your website associted with a well known name in the hopes that it boosts customer confidence? The only way you can find out is through testing. each website and customer base is dfferent.

Most companies offer some type of trial basis and have a guarantee that their logo will boost conversion rates by a certain percentage. If you can spare the extra cash and are willing to run a test for the trial period you can find out if it will increase your conversion rate. Then you need to figure out if the ROI is worth it as well. My take on these logos is if they dont bring at least double their cost in profit then it’s not worth the extra expense. I know some people that believe it’s worth it if you break even. I don’t see how it can worth it if you break even while adding extra work that you don’t get paid for. The whole idea of a business is to be profitable and increase the bottom line.

I got an email newsletter and in it was an article talking about a new SQL injection tester from HP. It’s called Scrawlr. Basically it runs through your site testing to see if you have some basic SQL injection vulnerabilities. Not a bad idea actually. It’s kind of surprising how little some people take security into account these days.
Anyway the usefulness of this tool is 2 fold:
Obviously to test your site against some common SQL injection attacks. Not a bad thing if you just set it up and want to see if it’s at least somewhat secure.
As far as SEO goes it allows you to see how a less sophisticated spider can and does crawl your site. If you run this tool and it only shows a couple of links even though you have a bunch then you have big issues as far as search engine friendliness goes.
In the case of one of the sites I work with it found 4846 URL’s no vulnerabilities.
4846 URL’s is way above what is actually there so it seems to be registering session ID’s as unique URL’s. Though there could be some linking issues as well. Needless to say I am looking into it. Anyway duplicate content can be a big problem for sites that have multiple links with different url’s and anchor text leading to any given page. That type of onsite linking structure immediately set’s up dup content issues.

You have to keep in mind that a spider only registers a piece of content by the url’s it found by. If it finds the exact same content under several different url’s it forces the SE to figure out which one is the original and then discount and/or filter out the rest. What it boils down to is that the less you give the spiders and search engines to think about and compare the better.

When it comes to onsite linking structure 1 link and url (same anchor text and url) pointing to a given page or piece of content is the best way to go. You don’t want a link in your nav bar pointing to something and then another link somewhere else, like the footer, pointing to the same thing with a different url and anchor text. Something I see a far amount of is people using their sites search function to find a product and then copying that url into the href tag. That is one of the easiest way’s to get duplicate content.
So If you want another way to look your site over as far as crawlability goes and to check some basic security issues then this can be a somewhat useful tool. It’s free and can be found here