Back again this year is our old friend Nessus from Tenable Network Security. For as long as most can remember, this has been a necessary tool in any vulnerability assessment toolkit. It is easy to see why. Nessus has become increasingly lightweight and easier to use over the years, and this version is no different. It can scan many devices on the network for vulnerabilities, and its device list is always growing longer. Nessus can scan Microsoft Windows and Linux systems, databases, web applications and Cisco routers and switches, among many others.
Installation is straightforward and only takes a few minutes. Initial setup is done by running a single installer, which, after a short setup wizard, installs both the Nessus server and a shortcut to the company's web interface. After installation is complete, the server can be engaged by entering an activation code. Once activated, it immediately begins pulling down the various plug-ins and updates for the scanner. All scanning and administration is done via the web-based management console, which relies on Adobe Flash. We find this console to be easy to navigate and intuitive to use.
The Nessus scanner uses vulnerability information from both Common Vulnerabilities and Exposures (CVE) and Common Vulnerability Scoring System (CVSS) v2, and can perform a multitude of compliance and configuration audits using various standards. This product also can generate reports in various formats, including HTML and Nessus XML. While this tool is strictly a vulnerability scanner, it can be a valuable addition to a larger vulnerability management plan, as it includes several auditing and scanning templates ready to go out of the box. Scanning policies also can be highly customized to meet the needs of pretty much any type of environment, and it can include both credential-based and null credential scans.
Documentation consists of installation and user guides, along with other supplemental materials, such as compliance and credential checks manuals. The installation guide provides detailed information on installing the Nessus scanner on either a Windows or Linux box, along with preinstallation and deployment option information. The user guide illustrates all other necessary details on configuration of the scanner and using the product.
Tenable offers email- and web-based support to customers who only are using the Nessus Scanner. Customers who integrate the tool into the full Tenable Security Center, at an additional cost, receive phone-based technical support as well. Customers can access an online area, which includes resources, such as product documentation, a user discussion forum and a knowledge base.
At a price of $1,200 per year per scanner, this product is a reasonable value for the money. However, users benefit a lot more if it is integrated into the Tenable Security application, which adds substantial vulnerability management functionality, but also adds cost. Overall, this product can be a useful tool and should be considered as a part of vulnerability assessment, but it's not a complete vulnerability management tool.
Installation is straightforward and only takes a few minutes. Initial setup is done by running a single installer, which, after a short setup wizard, installs both the Nessus server and a shortcut to the company's web interface. After installation is complete, the server can be engaged by entering an activation code. Once activated, it immediately begins pulling down the various plug-ins and updates for the scanner. All scanning and administration is done via the web-based management console, which relies on Adobe Flash. We find this console to be easy to navigate and intuitive to use.
The Nessus scanner uses vulnerability information from both Common Vulnerabilities and Exposures (CVE) and Common Vulnerability Scoring System (CVSS) v2, and can perform a multitude of compliance and configuration audits using various standards. This product also can generate reports in various formats, including HTML and Nessus XML. While this tool is strictly a vulnerability scanner, it can be a valuable addition to a larger vulnerability management plan, as it includes several auditing and scanning templates ready to go out of the box. Scanning policies also can be highly customized to meet the needs of pretty much any type of environment, and it can include both credential-based and null credential scans.
Documentation consists of installation and user guides, along with other supplemental materials, such as compliance and credential checks manuals. The installation guide provides detailed information on installing the Nessus scanner on either a Windows or Linux box, along with preinstallation and deployment option information. The user guide illustrates all other necessary details on configuration of the scanner and using the product.
Tenable offers email- and web-based support to customers who only are using the Nessus Scanner. Customers who integrate the tool into the full Tenable Security Center, at an additional cost, receive phone-based technical support as well. Customers can access an online area, which includes resources, such as product documentation, a user discussion forum and a knowledge base.
At a price of $1,200 per year per scanner, this product is a reasonable value for the money. However, users benefit a lot more if it is integrated into the Tenable Security application, which adds substantial vulnerability management functionality, but also adds cost. Overall, this product can be a useful tool and should be considered as a part of vulnerability assessment, but it's not a complete vulnerability management tool.
