Tenable Blog

Announcements

• Tenable Network Security Certified as Approved Scanning Vendor (ASV) by PCI Security Standards Council.
• Available for download in the Tenable Support Portal: "The Tenable Event Correlation Paper."
• Check out our video channel on YouTube that contains the latest Nessus and SecurityCenter 4 tutorials. The "Top Ten Things You Didn't Know About Nessus" videos have been posted from #10 through #2, so check them out!
• We're hiring! - Visit the Tenable website for more information about open positions.
• You can subscribe to the Tenable Network Security Podcast on iTunes!
• Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make product and company announcements, provide Nessus plugin statistics, and more!
• Want to ask questions about Nessus, SecurityCenter, LCE, and PVS and get answers from the experts at Tenable? Join Tenable's Discussion Forum for custom scripts, announcements, and more!

Hosts

• Paul Asadoorian, Product Evangelist
• Carlos Perez, Lead Vulnerability Researcher
• Ron Gula, CEO/CTO

Announcements

• Tenable had a great presence at the recent RSA Security Conference. Several of us gave presentations, provided demos at the booth, and participated in panels. Check out the Tenable Blog for full coverage.
• Check out our video channel on YouTube that contains the latest Nessus and SecurityCenter 4 tutorials. The "Top Ten Things You Didn't Know About Nessus" videos have been posted from #10 through #2, so check them out!
• We're hiring! - Visit the Tenable website for more information about open positions.
• You can subscribe to the Tenable Network Security Podcast on iTunes!
• Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make product and company announcements, provide Nessus plugin statistics, and more!
• Want to ask questions about Nessus, SecurityCenter, LCE, and PVS and get answers from the experts at Tenable? Join Tenable's Discussion Forum for custom scripts, announcements, and more!

New & Notable Plugins

Nessus:

• DNSChanger Malware Detection
• HP Printer Firmware Signing Disabled
• Patch Management: SCCM Report

Passive Vulnerability Scanner:

• IBM iSeries FTP service detection
• Dropbear SSH Server Channel Concurrency Use-after-free Remote Code Execution
• Mozilla Thunderbird 10.x 10.0.2 'png_decompress_chunk' Integer Overflow

The idea of ‘fighting back’ against hackers is both scary and risky business. Most security professionals would strongly advise against it, in part because one false move could land you behind bars. But ‘fighting back’ doesn’t have to translate into attacking an attacker’s IP address, setting up lethal traps for hackers, or purposely damaging systems--it’s about defending your own networks, while working to identify and gather evidence of the attack and attackers.

Tenable’s Paul Asadoorian will be presenting alongside John Strand, Senior Instructor with the SANS Institute, on this topic at RSA today, March 1, 2012. They’ll share practical advice on how to responsibly integrate offensive measures into your network security strategies. They’ll also cover legal considerations, relevant case studies of people and organizations that strategically (and legally) fought back, sensible techniques, and strategies for determining if offensive countermeasures are right for you.

By Marcus Ranum, Tenable CSO

What do these four terms have in common?

Cyberwar, Cybercrime, Cyberespionage, and Cyberterror.

• They all start with the word ‘Cyber’
• They’re all bad stuff
• And they’re all consistently confused with each other, despite significant differences (and sometimes conflicts) between them

Many people already know my position on ‘Cyberwar’ but things have changed significantly over the past four years in IT and physical security, technology, the government, and the military. The actual ‘Cyber’ landscape is much more nuanced than many seem to realize, which has created an unnecessary public perception of extreme vulnerability (which can lead to fear, which can be dangerous).

In the last year, I’ve been part of a panel of security experts that has gathered at various security events to share what we’ve learned about stress and burnout in the IT security industry, and to help people identify when they, or somebody they know, are at risk. We’ve conducted surveys to find out more about these risks and their causes, but the heart of these sessions are the compelling anecdotes from the security professionals who share personal stories of depression or anger, as well as their scars, both emotional and physical.

Our presentations and discussions have been a developing project, each session building off of what we learn at every event before it. I’ll be moderating a panel again on this topic at RSA, and we will be revealing original research on career burnout and the causes of stress for security professionals.