Tenable is proud to announce a newly formed partnership with the Univeristy of Maryland's Cybersecurity Center. The partnership will focus on preparing the future security workforce and collaborating on cybersecurity challenges.

"COLLEGE PARK, MD AND COLUMBIA, MD – The University of Maryland (UMD) and Tenable Network Security, the leader in Unified Security Monitoring and creator of the awardwinning Nessus vulnerability scanner, have announced a new partnership to establish collaborative activities in the area of cybersecurity. The partnership will promote cybersecurity education, research and technology development through UMD's newly established Maryland Cybersecurity Center (MC2, or MC-squared). UMD and Tenable plan to leverage one another's resources, knowledge base, and unique perspectives to develop innovative solutions to cybersecurity challenges."

Read the full press release.

Tenable has participated in several security challenges in the past, you can read more about our past experiences at these events here:

• The Mid-Atlantic Regional CCDC 2010 Event - Part I
• The Mid-Atlantic Regional CCDC 2010 Event - Part II
• Cyberdawn - A Diverse Cyber Exercise - Part I
• A Diverse Cyber Exercise - Part II
• NYC InfraGard Capture The Flag Event

Immunity Inc, (the makers of the CANVAS penetration testing tool), have partnered with Tenable Network Security and DSquare Security to offer a product bundle which is ideal for consultants who perform penetration testing, vulnerability analysis and compliance auditing services. The bundle includes:

• Immunity CANVAS
• Tenable Nessus ProfessionalFeed
• DSquare Exploit Pack

This bundle saves customers 20% off of the list purchase price for each of these products.

One of the things I am very excited about with this bundle is the integration between Nessus and CANVAS provided by the DSquare Exploit Pack. As you can see in this video here, you can perform your vulnerability scans with Nessus and then feed them directly into CANVAS for exploitation.This can minimize the amount of work a consultant needs to do when attempting to find an exploitable target. The DSquare technology makes great use of the Nessus 3 report format as well. This also means if you are a Security Center organization, you can extract all of your vulnerability data and feed it into CANVAS to rapidly provision a penetration test. 

CANVAS also has the ability to retrieve password LM/NTLM hashes. This information can be fed into Nessus 3 to perform a patch or configuration audit of a system that has been compromised. As a consultant, this allows you to identify systems which can be compromised with CANVAS and then further test them with Nessus by performing patch audits, CIS/PCI/FDCC and other patch audits and to even scan them for sensitive data.

Today Tenable announced a partnership with Enterasys Networks that enables customers of both companies to operate Nessus and/or the Passive Vulnerability Scanner (PVS) directly on the Dragon sensor. Customers who have existent or planned Tenable and Enterasys security solutions should consider this deployment option. This blog entry discusses several deployment scenarios as well as interaction between Tenable and Enterasys security solutions.

Ease of Deployment and Integration

If your organization has multiple Dragon sensors in place, both Nessus and the PVS can be deployed on these devices. Typically, a Dragon IDS sensor is optimally deployed for passive network monitoring with a PVS as well as active vulnerability scanning with Nessus.

If your organization has a Tenable Security Center, Nessus scanners and Dragon sensors, but has not deployed the Passive Vulnerability Scanner, deploying them on the Dragon sensors can provide immediate benefits. Adding passive vulnerability data to your Security Center will increase the accuracy of your discovered assets and vulnerabilities. It will also increase the accuracy of the correlation between the IDS events detected by Dragon and the vulnerabilities on your network.

If you organization is engineering a network monitoring solution, deploying Dragon, Nessus and the PVS on one platform simplifies the architecture and maximizes your resources.

Tenable engineers have developed unique installation packages for Nessus and the PVS which install directly onto the Dragon IDS appliance. Enterasys customers should contact Tenable's sales staff to obtain download information for these packages.

Performance

The ideal use case is to deploy the PVS and/or Nessus on a Dragon sensor in passive mode which isn't currently reaching maximum CPU usage. If your Dragon sensor is inline in "prevention" mode, adding on Nessus and/or the PVS is not advised. Neither Nessus or the PVS were designed for inline analysis.   
Enterasys and Tenable Product Interaction

The Security Center receives IDS events from the Dragon management console. These events undergo realtime vulnerability correlation such that real attacks that are likely to succeed are immediately highlighted. The accuracy of this correlation is greatly enhanced with realtime network vulnerability monitoring by the PVS.

The Security Center can also extend the information discovered by Dragon securely to different political or business groups within your organization. This allows groups to gain access to IDS events targeting just their network or assets without the need to deploy a dedicated sensor. Each group can view their security data through a web interface, create custom reports and produce animations and visualizations in a three dimensional user interface. 

For even greater event correlation, the Tenable Log Correlation Engine (LCE) accepts IDS events from Dragon sensors and can correlate these with netflow, system logs, firewalls and many other devices. The LCE has many specific TASL correlation scripts which correlate IDS events with network change, new device behaviors, known hacker compromise techniques and worms/botnet communication patterns.

For More Information

Tenable has several webinars and white papers available online which discuss VA/IDS correlation and well as event correlation in general.

• Correlating IDS events with Vulnerabilities Webinar
• Good and Bad uses of Vulnerability Data for IDS Event Correlation Blog
• Network Based Anomaly Detection Webinar
• VA/IDS Correlation White Paper
• Event Correlation White Paper

Please contact Tenable's sales and support groups for more information on obtaining the Nessus and PVS builds for the Dragon appliances.