From: US Infosec (usinfosec@gmail.com)
Date: Thu Mar 30 2006 - 07:35:13 EST
In my last position we used Harris Stat Analyzer for this. Through
Analyzer we could use ISS Internet Scanner, Harris Stat Scanner, and
Nessus. Analyzer would correlate the data from all 3 scans of the
same system into one report, and also identify false positives. It
worked really well.
On 3/28/06, Clemens, Dan <Dan.Clemens@healthsouth.com> wrote:
> >I actually prefer the Tenable line of products. They are the creaters
> of Nessus which is the de facto standard of >>>>>>>>vulnerability
> scanners on the Internet.
>
> One cool thing you can do with some of the other products is use
> multiple scanners, and then do corrilation of the vulnerability data
> once it has been discovered.
>
> Now I guess this is only cool if you want to use multiple scanners in
> hopes that one scanner will catch things another didn't.
>
> Out of curiosity - is anyone on the list actually utilizing multiple
> scanners and corrilating the data within their risk assessment process
> or is everyone that uses other peoples scanners utilizing just one
> brand/vendor?
>
> - Daniel Clemens
>
>
> -----Original Message-----
> From: sol@mail.fullertoninfosec.com
> [mailto:sol@mail.fullertoninfosec.com]
> Sent: Tuesday, March 28, 2006 7:29 AM
> To: r@d
> Cc: pen-test@securityfocus.com
> Subject: Re: Canned audits
>
> I actually prefer the Tenable line of products. They are the creaters
> of Nessus which is the de facto standard of vulnerability scanners on
> the Internet.
>
> Tenable has created a number of tools to surround Nessus to offer (in my
> view) a complete security audit solution.
>
> Nevo is a Passive Vulnerability Scanner
> Thunder is their Log Correlation Engine
> Lightning is the management tool that pulls everything together in one
> easy to manage console. From here you can create policies, run
> distributed scans of your entire enterprise and then create reports as
> generic or as explicit as you need.
>
> From what I hear they are about to release a new version which includes
> policies for compliance for all the major standards in the industry.
>
> Sol
>
>
> Quoting "r@d" <m2rad@gmx.net>:
>
> > Hi Rob,
> >
> > There are quite a few tools around there to perform these kinds of
> > audits. I
> >
> > personally like eEye Retina with REM Events Manager Console best. It
> > allows you to perform scheduled audits and have results posted in a
> > dashboard like way, or even have reports send by email.
> >
> > I see you are especially interested in Wireless, therefor I think eEye
>
> > Retina is speficially fit for your needs.
> >
> > Kind Regards,
> >
> > Rajendra Soebhag
> > Technical Consultant - Trainer
> > CCA, CCEA, CCI
> >
> >
> > ----- Original Message -----
> > From: "ROB DIXON" <rdixon@workforcewv.org>
> > To: <pen-test@securityfocus.com>
> > Sent: Friday, March 24, 2006 8:27 PM
> > Subject: Canned audits
> >
> >
> > Hi All,
> >
> > We have had many audits in the past by 3 party vendors. My company is
> > finally interested in performing some of these audits in house and a
> > little more frequently than the annual 3rd party audits.
> >
> > My question is, is there a software package, a "canned" audit that can
>
> > be performed? Basic info gathering questions regarding authentication
> > controls,
> >
> > network documentation(how and where it is stored), question that
> > should be asked regarding wireless AP and other basic security
> questions?
> >
> > -Rob Dixon
> >
> > Robert L. Dixon, CSO
> > CHFI A+
> > State of West Virginia's
> > West Virginia Office of Techonology
> > Infrastructure Applications
> > Netware/GroupWise Administrator
> > Telephone: (304)-558-5472 ex.4225
> > Email:rdixon@workforcewv.org
> >
> > ----------------------------------------------------------------------
> > -------
> -
> > This List Sponsored by: Cenzic
> >
> > Concerned about Web Application Security?
> > As attacks through web applications continue to rise, you need to
> > proactively protect your applications from hackers. Cenzic has the
> > most comprehensive solutions to meet your application security
> > penetration testing and vulnerability management needs. You have an
> > option to go with a managed service (Cenzic ClickToSecure) or an
> > enterprise software (Cenzic Hailstorm).
> > Download FREE whitepaper on how a managed service can help you:
> > http://www.cenzic.com/forms/ec.php?pubid=10025
> > And, now for a limited time we can do a FREE audit for you to confirm
> > your results from other product. Contact us at request@cenzic.com
> > ----------------------------------------------------------------------
> > -------
> -
> >
> >
> > ----------------------------------------------------------------------
> > -------
> -
> > This List Sponsored by: Cenzic
> >
> > Concerned about Web Application Security?
> > As attacks through web applications continue to rise, you need to
> > proactively
> >
> > protect your applications from hackers. Cenzic has the most
> > comprehensive solutions to meet your application security penetration
> > testing and vulnerability management needs. You have an option to go
> > with a managed service (Cenzic ClickToSecure) or an enterprise
> software (Cenzic Hailstorm).
> >
> > Download FREE whitepaper on how a managed service can help you:
> > http://www.cenzic.com/forms/ec.php?pubid=10025
> > And, now for a limited time we can do a FREE audit for you to confirm
> > your results from other product. Contact us at request@cenzic.com
> > ----------------------------------------------------------------------
> > -------
> -
> >
> >
>
>
>
>
> ------------------------------------------------------------------------
> ------
> This List Sponsored by: Cenzic
>
> Concerned about Web Application Security?
> As attacks through web applications continue to rise, you need to
> proactively protect your applications from hackers. Cenzic has the most
> comprehensive solutions to meet your application security penetration
> testing and vulnerability management needs. You have an option to go
> with a managed service (Cenzic ClickToSecure) or an enterprise software
> (Cenzic Hailstorm).
> Download FREE whitepaper on how a managed service can help you:
> http://www.cenzic.com/forms/ec.php?pubid=10025
> And, now for a limited time we can do a FREE audit for you to confirm
> your results from other product. Contact us at request@cenzic.com
> ------------------------------------------------------------------------
> ------
>
>
>
> -----------------------------------------
> Confidentiality Notice: This e-mail communication and any
> attachments may contain confidential and privileged information for
> the use of the designated recipients named above. If you are not
> the intended recipient, you are hereby notified that you have
> received this communication in error and that any review,
> disclosure, dissemination, distribution or copying of it or its
> contents is prohibited. If you have received this communication in
> error, please notify me immediately by replying to this message and
> deleting it from your computer. Thank you.
>
>
> ------------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Concerned about Web Application Security?
> As attacks through web applications continue to rise, you need to proactively
> protect your applications from hackers. Cenzic has the most comprehensive
> solutions to meet your application security penetration testing and
> vulnerability management needs. You have an option to go with a managed
> service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm).
> Download FREE whitepaper on how a managed service can help you:
> http://www.cenzic.com/forms/ec.php?pubid=10025
> And, now for a limited time we can do a FREE audit for you to confirm your
> results from other product. Contact us at request@cenzic.com
> ------------------------------------------------------------------------------
>
>
------------------------------------------------------------------------------
This List Sponsored by: Cenzic
Concerned about Web Application Security?
As attacks through web applications continue to rise, you need to proactively
protect your applications from hackers. Cenzic has the most comprehensive
solutions to meet your application security penetration testing and
vulnerability management needs. You have an option to go with a managed
service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm).
Download FREE whitepaper on how a managed service can help you:
http://www.cenzic.com/forms/ec.php?pubid=10025
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@cenzic.com
------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:55:46 EDT