Hi all,

My first post so please be gentle.

I've just taken up a post as an Information security officer. It's not as purely technical as some of the security posts that other on AO have.

My boss has asked me to look into way to carry out vulnerability testing on our network particularly the 2003 servers but just to develop an ongoing program of network testing.

At the moment it's just theory, extra reading and advice I'm looking for. There will be a test network set up to start with so that I don't cause mayhem on the live network but that will be into the new year.

I'll probably be setting up a spare box at home just with a cross over cable to try things out there.

I'm after any (other) rcommended websites with articles/tutorial, any books worth reading.
Any tools that would be useful for testing the network both free/open source and commercial.
Any general advice as to how you go about testing networks that you secure. Any company policies/proceedure that your sysadmins follow on their networks to maintain a handle on vulnerabilities.

I've been tinkering with Snort, Ethereal, GFI and a few others but only on my local machine or on the loop back.

My background is in desktop support at a school but I also carried out some work on NT4 servers, 2000 servers and 2003 servers. I've also got a bit of linux experience Red Hat mostly.
My programming is weak I know Asp but I've no formal IT training. I used to be a biochemist but fell into IT a while back.

Thanks in advance.