Custom code for vulnerability analysis

Knowing what's on the network and what services are in use is an important part of security. Unfortunately, application programmers and system operators don't always keep the security team in the loop as systems are brought online, updated, patched and reconfigured. A referee, in the form of a vulnerability-analysis tool, can be a valuable adjunct in keeping abreast of services and servers automatically.

Tenable's Nessus, a popular tool for service discovery and vulnerability management, is pushing the limits of what open source means in the data center. Originally it was a fully open source tool; last year, the primary developers of Nessus made it free, but also proprietary, when they released Version 3 of the scanning engine. Changing the license was unpopular with the always-volatile open source community, but the number of enthusiastic users doesn't seem to have diminished. Nessus Version 2 is maintained as an open source project.

With a client/server architecture and several GUI interfaces available, Nessus needs less additional software to make a fully functional package than does SpamAssassin or Snort, depending on how the information Nessus provides will be used. Other vulnerability-analysis scanners and network discovery tool vendors offer more tools for managing scan results, linking to patch-management systems and handling the vulnerability life cycle, but the Nessus team has focused more on making a highly configurable engine.

To gain closer parity with commercial products, Nessus users can buy Tenable's Security Centre. This is a centralized management tool for Nessus scan data that contributes reporting functions, asset and vulnerability management, and a correlation engine that links IDS engine events with detected vulnerabilities to give security managers a better idea of what's important. In addition, most commercial security information management products can digest and correlate Nessus scan data.

Nessus is an active vulnerability scanner, which means it probes systems to discover services, operating systems and vulnerabilities. At many organizations, however, active scanning is unacceptable. The bad reputation they have for crashing or slowing systems, along with other political issues, has spawned a market for passive scanners.

Some limited types of passive scanning (such as operating system fingerprinting) are available from the open source community, but network managers interested in a more comprehensive approach should stick to commercial scanners available from Sourcefire (Realtime Network Awareness) and Tenable (Passive Vulnerability Scanner). (See our Clear Choice Test on these products.)