Tenable Blog

Today Tenable announced a partnership with Enterasys Networks that enables customers of both companies to operate Nessus and/or the Passive Vulnerability Scanner (PVS) directly on the Dragon sensor. Customers who have existent or planned Tenable and Enterasys security solutions should consider this deployment option.

When deploying the Log Correlation Engine (LCE), Tenable's support group often is asked which is better for network monitoring: using netflow from a router or performing some sort of direct network monitoring. This blog entry will help users choose a strategy and discuss some of the technical and political aspects associated.

Netflow and Direct Sniffing

The Passive Vulnerability Scanner (PVS) has the ability to discover network services which have the characteristic of being "interactive" or being "encrypted". The PVS can analyze traffic in real-time and recognize when the size and frequency of packets is indicative of an "interactive" session. The PVS can also look at the traffic's randomness and determine if the data is encrypted. This blog post helps PVS users understand how to analyze this data, where false positives can occur and what these events mean.

I got the chance to virtually sit down with the folks at PaulDotCom for an interview. We discussed a variety of topics including vulnerability disclosure, Nessus usage, the early days of Dragon and Snort, advice for people entering the computer security industry and my background.

Tenable often receives requests for advice and strategies to help very large organizations decrease their scanning time. Readers should keep in mind that from Tenable's point of view, a "large" organization is someone with multiple Class B networks and more than 1 million items reported by Nessus. A basic concept to keep in mind when modifying how scans run is that there is a balance between scanning speed, thoroughness and invasiveness. For example, one may simply be able to decrease scan speed times by decreasing the number of tests performed.