Alright, going back to the original post, here's my contribution to "Best Practices". Hopefully this will be chock-full of goodies and general advice for people using nessus in their companies...
IDS is a valid concern and should be set to passive response before trying to scan with nessus. If this cannot be done, set it to at least ignore the machine that nessus is scanning from. IDS systems such as DragonIDS can be configured to take down a subnet or specific router to prevent scanning at all costs (including worm activity). It makes for a very obvious network event and generally looks bad when trying to help a company. Well, unless you're showing off how well the IDS works. ;^] Start small. Most large organizations keep a landscape for the sole purpose of testing out patches from various vendors to make sure they all play nice, and then push these out into production. It's best to scan these first so you don't accidentally kick over anyone's production machine. It also gives you a pretty good idea of how everything is configured and what to look for. You can use this sample data later to do things like detect misconfigured servers (services which should be running and are not, or reverse), figure out if a router is misbehaving (re-writing packets with weird sequence numbers...), or other surprises. Test your results. I received a list of problems with our network from a well meaning person who had used Nessus (without permission and in passive mode) to do a sweep. Unfortunately, this person treated all report events of "possible hole" as "BIG SECURITY HOLE" and never followed up. Nessus reports can also be thrown by services running on nonstandard ports and custom applications/hardware (riblo, lights out, compaq teaming application). If you see something on a high numbered port, do not write it off as either safe nor unsafe. Check it and be thorough. The same applies to IIS or Apache. The version may be vulnerable, or it may be patched. Or there may be some other mitigation, perhaps the company is using an older version of apache for some legacy application (Novient comes to mind) and the apache has problems, but they are running it in a chroot jail with a minimal permission set and compiled without mod_anything. A poor security report says this is a hole. A w o! rse one ignores it because "it is patched". A good one makes a note but says that tests to see if it could be exploited failed. Scan in small blocks. There will always be that backwater service or server which someone forgot about. At best, it's installed and in production and the admin forgot to patch it. At worst, the nmap scan will crash a whole bunch of services that the customer needs. While not entirely nessus's fault -- that server should be patched and up to date with the demo landscape -- it still costs money. While it's a lot easier to give nessus the IP range of everything used in the datacenter and forget about it, these rogue machines are still doing something for somebody. The ideal nessus sweep doesn't crash anything. Use "polite" scanning rate. The servers have enough load already and the company may still be on 100mbit copper for their backbones. If the network gets slow or the server bogs, this affects the scan results and inconveniences people using those machines. Don't forget about attached devices. Photocopiers and plotters especially (old Lexmarks spit out blank pages and the plotter just gives up the ghost until power is cycled). Tape libraries and other SAN/backup/storage goodies can be addressable over the network but don't always answer. These also don't usually appear in demo landscapes. Try to avoid scanning these unless otherwise directed as it's fairly easy to leave them in weird states. Thanks, Joshua Knarr >-----Original Message----- >From: histar2 [mailto:[EMAIL PROTECTED] >Sent: Thursday, November 20, 2003 9:37 AM >To: Discussion of Nessus software >Subject: Best Practices?? > >Hi, > >I have a question and possible "offer"... > >Has anyone ever though of writing some "Best Practices" papers on using >Nessus in small to medium to large environments? Not a full "help" but >some simple case studies with some what-ifs on using some of >the plugins >and interpreting data, etc? > >The offer is - if no one has, then perhaps I will complete what I have >started and then post to the list for review and possible usage on the >site. > >peace, >Kat > > >_______________________________________________ >Nessus mailing list >[EMAIL PROTECTED] >http://mail.nessus.org/mailman/listinfo/nessus > _______________________________________________ Nessus mailing list [EMAIL PROTECTED] http://mail.nessus.org/mailman/listinfo/nessus
