Vulnerability Scanning

nickmartunas · 2017-02-27T12:49:46.000Z

Hey guys,

I need to start running quarterly internal vulnerability scanning. Any suggestions on a tool that is easy to use, and either low cost or open source for a non-profit?

Thanks.

maxsec · 2017-02-27T12:53:40.000Z

Alienvault’s OSSIM is a good place to start. Can be upgraded to the full commercial offering as well

kenlulue · 2017-02-27T13:02:51.000Z

You can also run OpenVAS - it’s free.

richardhall7 · 2017-02-27T13:03:38.000Z

You can look into firing up a basic Ubuntu VM with OpenVAS on it.
(but its pretty heavy stuff for non-linux background people).

Other than that we use Nessus Cloud scanning.
It’s a paid for, but very cheap for the ability to have scheduled and externally hosted Vulnerability Scan.

Tenable®

Advanced Vulnerability Assessment with Nessus Professional

Nessus Pro: The most widely deployed vulnerability assessment solution for identifying vulnerabilities, misconfigurations and out-of-compliance settings.

EDIT updated from “externally hosted pen-Test” to “externally hosted Vulnerability Scan”

Mike400 · 2017-02-27T13:15:51.000Z

nessus can also be hosted internally and configured to run against the internal network.

maxsec · 2017-02-27T13:18:21.000Z

richardhall7:

You can look into firing up a basic Ubuntu VM with OpenVAS on it.
(but its pretty heavy stuff for non-linux background people).

Other than that we use Nessus Cloud scanning.
It’s a paid for, but very cheap for the ability to have scheduled and externally hosted pen-tests.

Advanced Vulnerability Assessment with Nessus Professional | Tenable®

Vuln scan != Pen test

kate-att-cybersecurity · 2017-02-27T13:53:36.000Z

Martin2012:

Alienvault’s OSSIM is a good place to start. Can be upgraded to the full commercial offering as well

Thanks for the kind mention, Martin!

jackie-for-tenable · 2017-02-27T19:47:39.000Z

Thanks for the mention, Mike!

Hi Nick! We do offer a a free trial of @Tenable Network Security 's Nessus vulnerability scanner which you can find here . If you have any questions or need clarification on anything, feel free to reach out to me or Tony. =]

@tony-tenable-network-security

dustinlemp · 2017-03-02T16:21:20.000Z

Another vote for OpenVAS here. We use it and I really like it. I currently have all of my servers scheduled to be scanned once a week (during off hours, about 5 or 6 at a time.) It’s pretty memory intensive is the only drawback I see right now when scanning multiple servers at once.

naomi-it-central-station · 2017-03-07T07:56:38.000Z

Hi Nick, over at IT Central Station we have peer-to-peer reviews of several popular application security solutions that you may find helpful. For example, an Information Security Advisor who uses HPE Fortify on Demand commented that he finds it valuable that the solution “correlated static and dynamic results with detailed priority guidance and provided central testing program management for all applications.” This reviewer also points out that there is a free version of the tool that you can try out. (If you would like to read the rest of his review you can find it here .) I hope this helps.