One of the most popular choices for businesses’ security needs, Nessus Professional secures organisations’ security by reducing the attack surface and ensuring compliance. With features such as high-speed asset detection, configuration auditing, target profiling, malware detection and sensitive data detection, Nessus differs from competing solutions by supporting a wide variety of technologies. It stands out in detecting vulnerabilities, threats and compliance violations by scanning many components such as operating systems, network devices, next-generation firewalls, virtualisation platforms, databases, web servers and critical infrastructure.
Nessus Professional
Overview of General Features
- Flexible reporting: Allows reports to be customised on request by classifying by vulnerability or host, generating management summaries or allowing scan results to be compared with notable changes. Compatible with native (XML), PDF (requires Java installation on the Nessus server), HTML and CSV formats.
- Targeted e-mail notifications of scan results and remediation recommendations, and scanning of configuration improvements. Scanning Capabilities Detection: High-speed, accurate and error-free asset detection. Scanning: Vulnerability scanning (including IPv4/IPv6/hybrid networks) – Certified vulnerability detection – Certified vulnerability detection – PCI DSS compliance. Coverage: Broad asset coverage and profiling
- Network devices: Offline configuration auditing for firewalls/routers/switches (Juniper, Check Point, Cisco, Palo Alto Networks), printers and backup devices – Virtualisation: VMware ESX, ESXi, vSphere, vCenter, Microsoft Hyper-V, Citrix Xen Server –
- Operating Systems: Windows, OS X, Linux, Solaris, FreeBSD, Cisco iOS, IBM iSeries – Databases: Oracle, SQL Server, MySQL, DB2, Informix/DRDA, PostgreSQL, MongoDB
- Web applications: Web servers, web services, OWASP vulnerabilities – Cloud: Scanning of the configurations of cloud services such as Amazon Web Services, Microsoft Azure and Rackspace, and cloud applications such as Salesforce
- Compliance: Helps fulfil official requirements, corporate requirements and legal regulations. – Helps implement PCI DSS requirements with secure configuration, system hardening, malware detection, a web application scanner and access controls.
- Threats: Botnet/malicious, process/antivirus auditing – Detects elements such as viruses, malware, backdoors, hosts communicating with botnet-infected systems, known/unknown processes and web services associated with malicious content. – Compliance Auditing: FFIEC, FISMA, CyberScope, GLBA, HIPAA/HITECH, NERC, SCAP, SOX – Configuration Auditing: CERT, CIS, COBIT/ITIL, DISA STIGs, FDCC, ISO, NIST, NSA, PCI Control Systems Auditing: SCADA systems, embedded devices and ICS applications Sensitive Content Auditing: Personally Identifiable Information (PII) (for example, credit card numbers, SSNs)
Next-Generation Vulnerability Analysis Solution
The next-generation vulnerability analysis solution SecurityCenter™ is a comprehensive vulnerability analysis solution that provides complete security visibility for your distributed and complex IT infrastructure. With advanced mathematical analytics, customisable dashboards and workflows, it is designed to reduce the attack surface of your IT assets. It strengthens your security posture by detecting all vulnerabilities, misconfigurations and malware.
SecurityCenter’s vulnerability analysis engine assesses vulnerabilities based on data collected from a set of Nessus scanners within the organisation, identifies trends that may occur over time and prioritises the measures that need to be taken. Configurable workflows accelerate your security team’s response and remediation processes while reducing risk and simplifying compliance processes.
SecurityCenter™ is offered with the industry-first Assurance Report Cards. These reports allow CISOs and managers to measure, analyse and visualise the effectiveness of their security programmes based on business objectives and priority policies.
Main Functions
- Sure, here it is prepared as a list: 1. Assurance Report Cards: Continuously measures the effectiveness of security policies based on the customer-defined high-level business objectives, detects potential gaps and closes vulnerabilities.
- Customisable Performance Assessment Reports: Thanks to the new HTML5-based user interface, it generates performance assessment reports tailored to the specific needs of Chief Information Security Officers, security management, analysts, practitioners and operations operators.
- Dynamic Asset Classification: Using information collected from Nessus, it performs asset classification with customisable policies based on assets meeting specific criteria (for example, assets with Windows 7 in the last 30 days).
- Management of the Security Posture: Scans hosts, virtual, mobile and security devices for vulnerabilities, misconfigurations and malware using customisable plans and black-out periods.
- 5. Cumulative Scan Results: Provides information to identify remediation trends by combining data from many Nessus® scanners within the organisation.
- Advanced Mathematical Analytics Trend Identification: Provides contextual insight and actionable information for the prioritisation of security considerations associated with the security posture of corporate assets.
- Incident Response/Workflows: Creates configurable workflows and alerts so that managers can take manual or automated measures.
- Hierarchical Management Model: Provides support with role-based access control for geographically distributed organisations or those with different teams.
- Automated Load Balancing: Provides automated load balancing to optimise scan cycles in distributed environments.
- Automation of Integration: Uses the SecurityCenter APIs to automate integration with the existing infrastructure for the centralisation of management, reporting, remediation and workflows.
- Simplified Compliance: Offers predefined controls for industry standards and regulatory requirements such as CERT, DISA STIG, DHS CDM, FISMA, SCADA, PCI DSS, HIPAA/HITECH and more.