No-frills security scanning

IT managers were already busy finding and fixing security holes in their networks when the Blaster worm sparked a new sense of urgency. The good news is, there is no shortage of tools to help with the task. In “Uncovering Network Holes” we looked at two pricey and polished vulnerability assessment products from Qualys and Foundstone. Here we examine two less costly and less capable alternatives from Internet Security Systems (ISS) and the Nessus Project.

Qualys and Foundstone did very well in our tests. Both of these appliance-based solutions combine fast and accurate scanning with a rich set of reporting options and helpful features such as scan scheduling, network mapping, and trouble ticketing systems for tracking your progress in addressing the network vulnerabilities they identify.

We were not so impressed by Internet Scanner 7.0 or Nessus 2.0.6, both of which lack the strong reporting capabilities of Qualys and Foundstone, as well as the ability to map networks, track remediation efforts, and automate scans and updates to the vulnerabilities database. Internet Scanner and Nessus also proved more difficult to set up and manage.

On the other hand, the scanning engines of Internet Scanner and Nessus were accurate, with verifiable reporting and links to Mitre’s CVE (Common Vulnerabilities and Exposures) list. Their reports, while bare-bones, were easily accessible, requiring only that the end user have a Web browser. For shops willing to do without frills, and whose reporting needs are minimal, Internet Scanner and Nessus can do the job. Because Nessus is free, and performed better in our tests, we recommend it over ISS’s Internet Scanner.

The Price Leader

Nessus consists of both server and client components, with the server doing the scanning and assessment. Although the server is only available for Unix and Linux, you can choose from several clients, including those for Windows, several flavors of Unix and Linux, a Java client, and even one in development for the Sharp Zaurus PDA. Tenable Network Security is developing a commercial version of Nessus for Windows servers, scheduled for release in the fourth quarter of 2003. It will add functionality missing in the open source version of Nessus, such as a Web interface and remediation management, but it won’t be free. 

We also tested Nessus under Knoppix-STD (Security Tools Distribution), a product that we can’t rain enough praise on. Knoppix is a one-disk bootable version of Linux, incorporating Nessus as part of the Knoppix toolkit. We found this by far the easiest and most convenient way to run Nessus.

Although Nessus has third-party support for Web access capabilities, the default installation required us to use Windows or Linux clients, neither of which has the ability to schedule a scan. We had to enter our network’s IP addresses manually or via a file import capability in order to scan; in either case, Nessus required us to enter either a range of addresses or a single address at a time. On the plus side, Nessus' client-server approach allows IT staffs to control scans from multiple clients.