Nessus Developments

Recently I reviewed the new Syngress Nessus book, after installing Nessus 2.2 using the security/nessus FreeBSD port. Yesterday Tenable Network Security relaunched the Nessus home page. The author of the Nessus vulnerability scanner is Renaud Deraison, who co-founded Tenable and currently serves as Chief Research Officer there. Tenable formally supports the development of Nessus.

Along with a sharp new Web design and the release of Nessus 2.2.1, the site announced a new policy on plug-ins. Plug-ins are code written in the Nessus Attack Scripting Language (NASL) which perform vulnerability checks. Tenable is offering three feeds for Nessus plug-ins:

  • The Direct Feed "is commercially available [and] entitles subscribers to the latest vulnerability checks," immediately. It costs $1200 per scanner per year.

  • The Registered Feed "is available for free to the general public, but new plugins are added seven days after they are added to the Direct Feed." Registration and conformance with the plug-in license is required.

  • The GPL Feed "does not require registration, and includes plugins written by the user community. As manager of the Nessus project, Tenable continues to accept plugins written from the Nessus and NeWT user communities. Plugins accepted with a copyright under the GNU Public License will be distributed to the Direct, Registered and Public feeds at the same time."


The last feed description mentioned NeWT, which is a Windows-based Nessus server. NeWT is available free of charge, but users can only scan their local subnet. NeWT Pro is a commercial product without limitations. The original Nessus UNIX server remains open source. Tenable also sells the NeVO passive vulnerability monitor, the Lightning ESM console, and the Thunder secure log aggregation and analysis product.
I have no problem with this new arrangement. Tenable offers two core Nessus products. First, there is the vulnerability scanning engine, which has several flavors. Tenable is paying for core developers to maintain and improve the original Nessus UNIX server and clients. They are selling a commercial version that runs on Windows, and offer for free a subnet-limited version that runs on Windows as well. The second product are NASL scripts. Tenable pays full-time salaries for developers to create these scripts.

Consider an alternative approach taken by a similar industry: anti-virus vendors. A company like Symantec sells both its scanning engine and signatures in closed-source form. They do this because the manpower required to create both products is considerable.

Tenable is still making a completely workable Nessus solution (UNIX Nessus server, clients, and signatures) available in open source form. The only change is that NASL scripts developed in-house by Tenable will be available to non-paying users seven days after paying customers receive them. If the NASL scripts developed by the open source community and released under the GPL are so much better than those Tenable creates, those NASL scripts will be immediately available. I would be surprised to see community-developed scripts surpass Tenable's however.
Sourcefire is a company in a similar situation. They and founder Marty Roesch were just featured in a Business Week article. Sourcefire pays developers to work on Snort and its signatures. Sourcefire then sells hardware appliances running Snort, along with an enterprise administration console. Sourcefire's greatest value lies in its RNA product, which provides context for its sensor.

I am surprised Sourcefire makes its signatures available free-of-charge. I would have no problem seeing them adopt a strategy similar to Tenable's. You can judge the effectiveness of one aspect of the open source community's Snort rule creation process by trying the signatures at BleedingSnort.com.

Comments

Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more