Vulnerability Scan; Nessus ◼ Vulnerability Scan  Approaches  Realistic Expectations  Nessus NET 477, Network Security, Spring 2021 6-1 Vulnerability Testing FAQ’s ◼ What is it?  Using programs/tools/scripts to test a host (or range of hosts) for vulnerabilities. ◼ Why do it?  To Be Secure  To attempt to keep Hackers Out  Live an easier life ◼ Not filling out incident reports and dealing with authorities. NET 477, Network Security, Spring 2021 6-2 Approaches ◼ Administrative approach       From the perspective of an authenticated administrator Example: Microsoft’s Security Baseline Scanner Need credentials (user name and passwords) to detect missing patches, insecure configuration settings, potentially vulnerable client-side software Check registry information Advantage – usually does not adversely affect the tested systems. Disadvantage - uses standard Windows administrative channels. Vulnerabilities in systems configured with another authentication method may be missed. NET 477, Network Security, Spring 2021 6-3 Approaches (contd.) ◼ Outsider Approach  Take the perspective of a malicious outsider trying to break into the system  Good for networks with many different operating systems and devices.  If the system is behind a firewall, only exposed services will be tested.  May crash systems/networks  Standalone or Subscription ◼ ◼ ◼ E.g. Nessus https://www.tenable.com/products/nessus ; and Qualys https://www.qualys.com/subscriptions/ Hybrid Approach  Example: Nessus and Beyond Trust Retina NET 477, Network Security, Spring 2021 6-4 Realistic Expectations Performing vulnerability scanning may lead to network outage ◼ Consecutive assessment reports may be inconsistent – why??? ◼ False positives ◼ Manual security audits still provide better results than automated tools ◼ NET 477, Network Security, Spring 2021 6-5 Nessus ( http://www.nessus.org ) ◼ ◼ Free prior to Version 3. To Nessus 3 released under a proprietary license to meet market demands. Subscriptions remain free for home users and non-profit organizations. Formerly know as Nessus Home, now Nessus Essentials.  https://www.tenable.com/products/nessus/nessus- essentials  https://www.tenable.com/about-tenable/tenable-in-thecommunity/tenable-charitable-organization-subscriptionprogram  You will use Nessus for HW #4. NET 477, Network Security, Spring 2021 6-6 Results Once you finish scanning, what next? ◼ Distribute the results to either the system administrators, or patch for the vulnerabilities, according to the instructions. ◼ NET 477, Network Security, Spring 2021 6-7 Where to Scan From A dedicated machine(s) ◼ HIGH Network Throughput ◼ Some place that has access to ALL machines ◼ Inside your Firewall ◼ Outside your Firewall ◼ Be careful: may lead to application and network outages. ◼ NET 477, Network Security, Spring 2021 6-8 How Often? ◼ As often as possible  Administrators ◼ Whenever a new exploit comes out  Status ◼ will “kill” you at some point. of patch deployment As frequent as possible from outside your firewall.  Those are your most “vulnerable” machines  They have conduits to allow outside access NET 477, Network Security, Spring 2021 6-9 In “real-life” do we do vulnerability scans? Yes! Very often. ◼ Sometime mandated security audits, vulnerability scans, compliance review. ◼ NET 477, Network Security, Spring 2021 6-10 Nessus Components Nessus Client and Server (See diagram on the next slide) ◼ The Nessus Plugins – written in NASL – Nessus Attack Scripting Language, for creating custom vulnerability tests. ◼  https://www.tenable.com/blog/understanding-tenable- plugins ◼ The Nessus Knowledge Base – Store values gleaned by some Plugins which can be used by other Plugins NET 477, Network Security, Spring 2021 6-11 NET 477, Network Security, Spring 2021 6-12 Nessus Client/Server (Web Interface) NET 477, Network Security, Spring 2021 6-13 To Start or Stop Nessus Server The following is for Windows. It must be run with administrator privilege. For other operating systems, see the user manuals. C:\Windows\system32>net stop "Tenable Nessus" The Tenable Nessus service is stopping. The Tenable Nessus service was stopped successfully. C:\Windows\system32>net start "Tenable Nessus" The Tenable Nessus service is starting. The Tenable Nessus service was started successfully. C:\Windows\system32> NOTE: It’s recommended to install Nessus Server on a Windows Server for performance and scan reliability. NET 477, Network Security, Spring 2021 6-14
Purchase answer to see full attachment