Tenable Blog

Another ShmooCon has come and gone. Tenable had the opportunity to run our products on the ShmooCon network. We deployed two blades which ran Nessus, the Passive Vulnerability Scanner, the Security Center, the Log Correlation Engine and a few agents for monitoring network traffic.

Myself and several Tenable Network Security employees will be attending Shmoocon later this week.  As a conference sponsor, we'll be giving away cool items at our table such as iTunes gift cards and chocolate covered espresso beans. We'll also be working in the labs and will be running all of our products to perform logging, network monitoring and scanning.

Many IT security managers I speak with want to produce some sort of graph or statistical data that records the amount of security incidents occurring on the network. This data is used to not only inform management of business risk, but to also justify budget for ongoing security and compliance activities. In this blog, we will consider several high-level sources of "incident data" and discuss their relevance for tracking in the enterprise.

Tenable's research group recently added support to all SSH enabled UNIX configuration audits to make use of "sudo". Support is available in version 1.4.4 of the UNIX compliance checks. 

Some organizations explicitly prohibit remote "root" logins to their UNIX servers. However, many of these organizations do allow a "non-root" login which has access to the "sudo" command. The "sudo" facility allows a non-root user to run specific restricted commands at the root level. Activity related to "sudo" can be logged as well.

This blog entry marks the 200th post for this blog. I've been very pleased with the content we've created for our Nessus users and customers. The feedback I've received is that the content here is useful to information security practitioners from all walks of life.