Tenable Blog

I got the chance to virtually sit down with the folks at PaulDotCom for an interview. We discussed a variety of topics including vulnerability disclosure, Nessus usage, the early days of Dragon and Snort, advice for people entering the computer security industry and my background.

Tenable often receives requests for advice and strategies to help very large organizations decrease their scanning time. Readers should keep in mind that from Tenable's point of view, a "large" organization is someone with multiple Class B networks and more than 1 million items reported by Nessus. A basic concept to keep in mind when modifying how scans run is that there is a balance between scanning speed, thoroughness and invasiveness. For example, one may simply be able to decrease scan speed times by decreasing the number of tests performed.

If you are performing network monitoring on a large network that is infected with any number of worms or botnets, there are many different techniques you can use with Tenable products to identify infected hosts. This blog entry considers a variety of worms/botnets that attack Symantec anti-virus agents. Many of the techniques identified here can be used to look for other worms that attack other applications and are active on different ports.

This point release provides fixes for multiple minor issues with Nessus 3.0.4. The fixes include:

• Faster startup time, especially on laptops
• Improved the performance of the SYN port scanner
• Fixed a memory leak in the Mac OS X client
• Vista compatibility improved
• Various minor bugs fixed in the NASL engine
• Better chasing of zombie processes

Platform specific changes include:

Version 3.0 of the Passive Vulnerability Scanner (PVS) dynamical alerts when it finds "new" pieces of information about the network. Potential information includes open ports, browsed ports, OS fingerprints, client applications and network services. This blog entry discusses how the occurrence of "new browsed port" events can be used to look for various types of malicious behavior.

Browsed vs. Open Ports