Tenable Network Security Podcast Episode 183 - "Hardening Chrome, Measuring Patch Management"
Announcements
- We're hiring! - Visit the Tenable website for more information about open positions.
- Check out our video channel on YouTube which contains new Nessus and SecurityCenter tutorials.
- Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make product and company announcements, provide Nessus plugin statistics, and more!
- Want to ask questions about Nessus, SecurityCenter, LCE, and PVS and get answers from the experts at Tenable? Join Tenable's Discussion Forum for custom scripts, announcements, and more!
- You can subscribe to the Tenable Network Security Podcast on iTunes!
Discussion & Highlighted Plugins
- Devices, Devices, Devices - Plugins this week cover Cisco NAC devices, Cacti, iLO, and Apple Airport vulnerabilities. I think it's great that we're releasing plugins to cover these types of devices. We've talked about it before, and I can't stress it enough – you must scan, patch, and then scan again all of the devices in your your network. The SQL injection vulnerability in the Cisco NAC controller is interesting. To me, that screams "NAC bypass," and if your NAC is easy to bypass, why have one at all?
- Locking Down the Browser - Browser vulnerabilities seem to have patches come out almost every week, and the user is a huge target for attackers. We released a .audit file for Chrome browsers. This is a great strategy; I'm a big fan of hardening your systems and applications. So why not the browser?
- Measuring Patch Management - We recently released a SecurityCenter dashboard which tracks how successful your patch management strategy is in your environment. This is an important exercise: Constantly measure your patch management effectiveness, and constantly try to improve. What are some things we can do to improve patch management?
New & Notable Plugins
Nessus
Passive Vulnerability Scanner
Tenable Compliance Checks
SecurityCenter Dashboards
Security News Stories
- Howto crawl web.xml with ruby to discover servlet urls for a pentest
- Delete any Photo from Facebook by Exploiting Support Dashboard | Arul Kumar.V
- Researchers: Oracle's Java Security Fails
- NSA cracks HTTPS, SSL, 4G smartphone encryption | Digital Trends
- The Router Review: From nmap to firmware | codeinsecurity
- Russia's Cybercrime Market Reaches $1.9 Billion
- 'Don't Travel Abroad' Russia warns Hackers
- Red Hat CIO Takes an Open-Source Approach to Security and BYOD
- People the weakest link in security
- 5 Signs Of Trouble In Your Network
- Android malware spotted hitching a ride on mobile botnet
Related Articles
Tenable Network Security Podcast Episode 198 - "PCI Discussion Featuring Jeffrey Man"
February 13, 2014<p></p>
Securing Financial Data in the Cloud: How Tenable Can Help
November 4, 2024Preventing data loss, complying with regulations, automating workflows and managing access are four key challenges facing financial institutions. Learn how Tenable can help.
Cybersecurity Snapshot: Apply Zero Trust to Critical Infrastructure’s OT/ICS, CSA Advises, as Five Eyes Spotlight Tech Startups’ Security
November 1, 2024Should critical infrastructure orgs boost OT/ICS systems’ security with zero trust? Absolutely, the CSA says. Meanwhile, the Five Eyes countries offer cyber advice to tech startups. Plus, a survey finds “shadow AI” weakening data governance. And get the latest on MFA methods, CISO trends and Uncle Sam’s AI strategy.
FY 2024 State and Local Cybersecurity Grant Program Adds CISA KEV as a Performance Measure
October 31, 2024The CISA Known Exploited Vulnerabilities (KEV) catalog and enhanced logging guidelines are among the new measurement tools added for the 2024 State and Local Cybersecurity Grant Program.
- Podcast