Do you know where all of your organization’s SSL certificates are and if they are providing enough protection to you and your customers? Nessus can be used to identify all SSL certificates in use, test if they are expired and with the advent of plugin # 51192, test that they have been securely signed by a valid certificate authority. This blog entry will review Nessus’s SSL certificate auditing ability and describe how plugin #51192 can help monitor your network for untrustworthy SSL certificates.

Tenable Network Security is pleased to announce that SecurityCenter 4 has recently been validated by the National Institute of Standards and Technology (NIST) as conforming to the Security Content Automation Protocol (SCAP) and its component standards. As of December 16, 2010, SecurityCenter 4 is SCAP validated for the following capabilities:

• FDCC Scanner
• Authenticated Vulnerability and Patch Scanner
• Authenticated Configuration Scanner
• Unauthenticated Vulnerability Scanner

SecurityCenter and the Nessus vulnerability scanner both support SCAP by integrating each aspect of OVAL, CVE, CVSS, XCCDF, CPE and CCE to help organizations accurately test their infrastructure and ensure that systems are configured in compliance with security policies and standards. Tenable’s customers use the SCAP-compatible xTool to produce audit policies for SecurityCenter and Nessus, which are used to perform configuration audits of target systems, analyze them for FDCC compliance and provide reports to system administrators and management. SecurityCenter also performs remediation scanning to help ensure that systems with known vulnerabilities are patched and that compliant settings are not reverted to a non-compliant state.

For more information about how Tenable’s solutions can help your organization, contact our Sales department for a copy of our Real-Time Compliance Monitoring whitepaper. Tenable’s product validation information for SecurityCenter can be found on NIST’s web site at http://nvd.nist.gov/validation_tenable.cfm and validation details can be found here.

The following video is a demonstration of Tenable's latest 3D Tool Beta, visualizing network topology and security events:

The 3D Tool reads data from SecurityCenter and allows you to present it in an interactive visual console. For more information see Ron Gula's post to the Nessus Discussion Portal titled "3D Tool Creation and Walk-Through" (Login required). The 3D Tool beta works with SecurityCenter 4 and can be used to visualize Nessus information and topologies, passively discovered vulnerabilities and communications with the Passive Vulnerability Scanner and any series of connections or events from intrusion detection, firewall, netflow and other sources normalized by the Log Correlation Engine.

Welcome to the Tenable Network Security Podcast - Episode 63

Hosts: Paul Asadoorian, Product Evangelist & Carlos Perez, Lead Vulnerability Research Engineer

Announcements

• Several new blog posts have been published this week, including:
  • Microsoft Patch Tuesday Roundup - December 2010 - "Bad Santa" Edition
• Check out our video channel on YouTube that contains the latest Nessus and SecurityCenter 4 tutorials, including the new 3D Tool Beta.


• We're hiring! - Visit the Tenable web site for more information about open positions.


• You can subscribe to the Tenable Network Security Podcast on iTunes!


• Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make various announcements, provide Nessus plugin statistics and more!

Attackers have been very naughty, IT departments have been mostly nice and Microsoft has fulfilled the role of “Bad Santa”. This holiday season, Microsoft has filled your stockings with 17 security bulletins fixing 40 vulnerabilities. But where does that leave us?

What Else Could You Say?

Note: The word "could" appears in the title of all 17 security bulletins this month

I could say a lot of things about this month's Microsoft Patch Tuesday release. I could say that you should apply patches (except that my boss hates the word “should”). I could say that despite all of the patches released, there are still most likely to be 0-day exploits for several unpublished vulnerabilities. I could also say that your organization needs a solid patch management program. I could say, well, you get the point. After more than a year of writing up each one of the Microsoft Security bulletins, there's a lot I could say. The fact remains that several trends continue in the Microsoft "Black Tuesday" madness:

Welcome to the Tenable Network Security Podcast - Episode 62

Hosts: Paul Asadoorian, Product Evangelist

Announcements

• Several new blog posts have been published this week, including:
  • Using Nessus For Host Discovery
  • If an exploit falls in the forest, does anyone hear it being patched?
• Don't forget to sign up for Advanced SIEM Webinar Series - November through December


• Be certain to check out our video channel on YouTube that contains the latest Nessus and SecurityCenter 4 tutorials, including the new Nessus Perimeter scanning service.


• We're hiring! - Visit the web site for more information about open positions.


• You can subscribe to the Tenable Network Security Podcast on iTunes!


• Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make various announcements, provide Nessus plugin statistics and more!

A Nessus user recently contacted me about performing a scan that would simply discover hosts on the network. This is a very low impact scan that does not look for vulnerabilities or enumerate ports. There are a few good reasons to run this type of scan:

Systems protected by a network or host-based firewall may only respond on a single port or to an ICMP echo request. Hosts that only respond to an ICMP ping will not show up in the default Nessus scan report. By enumerating these hosts you can include them in the report to show that scans were attempted but did not find any results, then determine if this is normal behavior or not.

Your internal policies may provide specific time windows when vulnerability scanning can occur. By tuning a scan that only discovers live hosts, you can check that your Nessus server is set up properly, collect a list of hosts to scan and stay within your vulnerability scanning policy guidelines.

To configure a scan that will only test if hosts are alive, use the following policy settings:

Click for larger image

Recently, Tenable added exploitability reporting for Nessus. After performing a scan, results can be filtered to see which vulnerabilities have exploits available for them. In the report, you can even see which common exploitation tools have payloads for these vulnerabilities. This is a great way to help prioritize which vulnerabilities to fix first. However, it is not a great way to manage your network or decide whether to patch a system or not. Consider the following conversation that represents many I’ve had on this topic: 

Welcome to the Tenable Network Security Podcast - Episode 61

Hosts: Paul Asadoorian, Product Evangelist & Kelly Todd, Compliance Analyst

Announcements

• Don't forget to sign up for Advanced SIEM Webinar Series - November through December
• Be certain to check out our video channel on YouTube that contains the latest Nessus and SecurityCenter 4 tutorials, including the new Nessus Perimeter scanning service.
• We're hiring! - Visit the web site for more information about open positions.
• You can subscribe to the Tenable Network Security Podcast on iTunes!
• Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make various announcements, provide Nessus plugin statistics and more!

Have you ever wanted to run an external Nessus vulnerability audit of your DMZ but didn’t have access to a Nessus scanner located on the outside of your network? Tenable Network Security now offers the Nessus Perimeter Service, offering unrestricted and unlimited vulnerability scans through annual and thirty day subscriptions. 

Scan any number of Internet facing sites you are authorized to scan from your desktop computer, mobile laptop, iPhone, customer network or wherever is convenient, as often as you want, all for a flat fee. And best of all – if you are a Nessus user, you already know how to use our service. Subscribers of the Nessus Perimeter Service are logged into the Nessus scanners hosted in Tenable’s secure datacenter. 

The Nessus Perimeter Service supports all of the major features of Nessus including:

• Rapid and Accurate Discovery of Systems and Vulnerabilities
• Vulnerability Scan Scheduling
• Support for the Nessus iPhone App
• Preparing for PCI-DSS Vulnerability Audits
• In-depth Web Application Scanning
• Highlighting vulnerabilities which have public exploits
• Patch and Configuration Auditing for web servers and many other devices
• Executive, Detailed and Differential reports
• Sharing results with Tenable’s SecurityCenter and 3^rd party SIEM and GRC solutions 

Pricing for the annual and thirty day subscriptions to the Nessus Perimeter Service set a new benchmark for value in the managed scanning industry:

1 Year Nessus Perimeter Service Subscription Unlimited Scans $3600

30 Day Nessus Perimeter Service Subscription Unlimited Scans $995

Both services can be purchased on Tenable’s Online store. 

The service includes access for one user account to perform scans and analyze results. Access to Tenable’s ticketing system for world-wide Nessus support is also available 24x7. The Nessus Perimeter Service also makes use of the very latest Nessus plugins developed by Tenable’s world renowned Research team. 

To learn more about this offering, please contact our sales staff, read the Nessus Perimeter Service FAQ or watch this introductory video. If you would like to run Nessus on your own hardware, commercial organizations should consider the Nessus ProfessionalFeed. If you are a large organization and are considering SIEM or GRC solutions, you should also consider the Tenable SecurityCenter.