How can Nessus protect an enterprise?

One of the requirements to become compliant with known standards and laws in cybersecurity is to have a vulnerability scanner. Nessus is one of the most popular ones among all the other vulnerability scanners in the market. However, when talking about the technical benefits of a Nessus a lot of people still ask how can Nessus protect an enterprise?

Nessus protects enterprises by helping security teams to keep track of newly discovered vulnerabilities in their solutions. This task reduces the time between detecting the vulnerability and patching it, which also decreases the risk for the vulnerability to get exploited by attackers.

As a penetration tester and a cybersecurity expert, dealing with vulnerability scanners is my daily work. This means I know exactly what their value is for companies. So let me explain in detail why vulnerability scanners are so important in a security program for enterprises and how they help secure them.

How can Nessus protect an enterprise?

As you know the infrastructure of any company around the world is just a combination of multiple applications and network solutions. Each one of those components could easily be found vulnerable to a critical vulnerability. Those vulnerabilities are discovered by cybersecurity researchers around the world every day and exploited by attackers.

Most of the time companies get hacked due to one of the following security problems:

1. Due to a zero or one day vulnerability
2. Or due to the lake of education of the employees.

For the Zero-day vulnerabilities, there is basically no efficient solution to stop them. However, those vulnerabilities are very expensive and require a very high level of security skills and dedication to successfully discover a vulnerability and create its exploit.

Therefore, attackers tend to use the one-day vulnerabilities. The one-day vulnerability is a type of security flaw discovered in software and its patch was released, but not all clients have applied the patches.

In the one-day vulnerabilities, the attackers try to reverse engineer the patches produced by the vendors to find the vulnerabilities and exploit them. Even those vulnerabilities are complicated to find and will require a high level of expertise from the attacker to successfully create a working exploit. However, they are still straightforward compared to zero-day vulnerabilities and do not take too much time to get.

The only way to stop those kinds of attacks is by patching the systems directly once the patch is published by the vendor. The quicker this task is performed, the more secure your system will be. Therefore, by performing periodic network scans by Nessus, companies start to detect those one-day vulnerabilities as fast as possible and then patch them before they get exploited.

This way the company network will remain safe against one of the most destructive cyber attacks.

How Nessus work?

Nessus is basically a network vulnerability scanner, so finding vulnerabilities in a network is based on checking the versions of the network components. The idea is that Nessus try to collect the versions of the existing services running on each server and then checks its database for publically published vulnerabilities. You may say that this task can be performed manually, and I will tell you yes you are right. However, this can only be feasible when dealing with small networks with a very limited number of network solutions.

This task can easily become very time-consuming when adding more and more applications to the network. Therefore, using a tool like Nessus will help you track the vulnerabilities you have in your network and patch them as fast as you can.

Moreover, Nessus offers a system of criticality estimation to give you an idea of what vulnerability you should prioritize when fixing.

The power of Nessus and basically any vulnerability scanner compared to manual checks come from the time needed for its team to update the database by newly discovered vulnerabilities. Nessus vendors have so many vulnerabilities feeds that in some cases cannot be affordable by small or medium companies.

Can Nessus replace a penetration test mission?

Nessus or any other vulnerability scanner cannot replace a manual or even a semi-automated penetration test. You should know that a penetration test does not only check publically published vulnerabilities. For example, vulnerabilities related to some system misconfiguration that may allow a privilege escalation problem, cannot be discovered using a vulnerability scanner.

A penetration tester usually performs some lateral movements to take full control over the network. To my best knowledge, this task is not performed by any vulnerability scanner on the market.

Moreover, many standards and laws require performing at least 2 penetration tests per year to get compliant.

For an optimum security level in your company, performing both periodic vulnerability scans and penetration tests is required to cover all the different types of vulnerabilities.

Nessus scan options to optimize security

What makes Nessus better than many other vulnerability scanners, is the number of features it gives to cover many other types of vulnerabilities that cannot be discovered using the usual vulnerability scans.

Here is a list of some of the good security features offered by Nessus:

• Searching for ONE vulnerability in the whole network
• Configuration vulnerabilities (not the ones discussed previously in this blog post)
• Cloud vulnerability scanning
• Scanning Mobile devices
• …

In general, scanning the whole network for the whole database of vulnerabilities may take too much time to finish. Unfortunately, time is a resource that is not always available especially in the security field especially with publically published vulnerabilities with a working public exploit. Therefore, performing a scan for one specific vulnerability is very useful.

Configuration vulnerabilities scan is also a very important task to secure your network and systems. As I said in this type of scan, not all the configuration vulnerabilities can be discovered and a penetration test will remain required.

Usually, when security teams perform a network vulnerability scan they forget about the mobile devices. Having mobile devices connected to your local network is nowadays very common and securing them is becoming a necessity. No device should be left vulnerable as the security of your network depends on the security of its weakest components.

A cloud vulnerability scan is also a very important feature offered by Nessus to look for vulnerabilities in the cloud environment.