Searching for "Classified" Content in Documents
May 18, 2007Sensitive government and military organizations classify their documents with familiar terms like "TOP SECRET" and also less well known terms like "NOFORN" (which means the data can't be shared with ...
Detecting SPAM From Inside your Network
May 17, 2007We all receive and are annoyed by the amount of "SPAM" email in our in-box. One way to fight SPAM is to monitor large networks for evidence of compromised hosts that are being used to email ...
Finding Snort Sensors
May 16, 2007Over the past few years, there have been several vulnerabilities disclosed about the Snort network intrusion detection sensor. I recently had a Tenable customer inquire for a strategy of "scannin...
Wireless SSID Enterprise Discovery
May 10, 2007Tenable's research group recently released a WMI based plugin for Nessus 3 that can determine the active wireless SSID for remote Windows devices. This allows an organization to obtain a list of activ...
Vista Configuration Auditing
May 4, 2007Tenable's research group has released a set of seven audit policies for the Vista operating system. These polices are based directly off of Microsoft's Windows Vista Security Guide. This blog entry di...
NIST Audit Policies for Nessus 3
April 30, 2007Tenable has released our first batch of audit policies which can test Windows 2000, 2003 and XP Pro systems for compliance with NIST best practice configuration standards. These ".audit" checks are c...
Asking Vista for its list of network interfaces
April 25, 2007Tenable's research group recently released plugin ID #24904 which speaks with the Link Layer Topology Discovery protocol. This is an Ethernet "layer 2" scan, so it is something you need to p...
Finding Low Frequency Events
April 23, 2007Very often when I speak with Tenable customers about performing IDS or Event analysis, I ask them if they use the Time Distribution tool under the Security Center. This tool is used to identify any co...
Active and Passive Teredo Detection with Nessus and PVS
April 17, 2007Quoting directly from Microsoft's web site about Teredo:"Teredo is an IPv6 transition technology that provides address assignment and host-to-host automatic tunneling for unicast IPv6 traffic whe...
Nessus 3.2 BETA - IPv6 Scanning
April 16, 2007Nessus 3.2 will support scanning of IPv6 addresses. The current BETA (released as Nessus 3.1.3) can be used to perform scans of IPv6 addresses. This blog entry shows how to use the current Nessus 3.2 ...
Microsoft Windows Domain Name Server Service Vulnerability Plugin
April 13, 2007Today, Tenable's research group released a remote Nessus plugin check (ID #25035) for a new vulnerability in Microsoft DNS servers. Microsoft has released a security advisory with details of the vulne...
Support for StoneGate Firewall Logs
April 11, 2007Tenable Log Correlation Engine customers who have Stonegate firewalls within their environment can now make use of a new normalization library. The new PRM parses logs obtained from the Stonesoft prod...