Within the S2Org assessment, there’s the option to ingest and process vulnerability scanning data from your network. The scan requirement can be disabled; however, you are highly encouraged to perform the scan to ensure the most accurate and complete S2Score.

Tenable was the first vulnerability scanning solution integrated into SecurityStudio, starting in 2010, and is still the preferred option for the S2Org assessment. Tenable has several products, but there are three that are most relevant to vulnerability scanning: Nessus, Tenable.io, and Tenable.sc. All three of these products use the Nessus scanning engine and produce the necessary data for ingestion into the S2 platform.

Nessus is the vulnerability scanning program as well as the engine used by other Tenable products. Nessus can be installed on a client system (workstation or server, physical or virtual) and run locally on a network or remotely through a virtual private network (VPN).

The primary advantage with Nessus is that it can be run against an unlimited number of IP addresses/hosts.

Tenable.io uses Nessus from a cloud instance and comes with several additional data visualizations. Scans can be run and managed from the cloud and the vulnerability scanning results are essentially the same as a Nessus client installation.

The primary advantage with Tenable.io is convenience; however, it is much more expensive for active consultants or large organizations because pricing is based upon the number of IP addresses/hosts scanned.

The “sc” stands for “Security Center”. It’s essentially a centrally managed enterprise version of distributed Nessus with many additional features. Tenable.sc also uses the Nessus scanning engine and the vulnerability scanning results are the same.

PLEASE NOTE: Most organizations use Nessus Professional, and the Nessus scanning engine is common throughout the Tenable products; therefore, this guide will focus on Nessus Professional use and requirements.

Nessus can be downloaded from Tenable’s website at https://www.tenable.com/products/nessus. Purchase of the necessary license, usage instructions, and support can all be obtained from Tenable and are outside the scope of this article.

Once Nessus is successfully installed, a login page such as the one below will be presented.

After logging in, the My Scans dashboard will show next.

How scans are performed is a matter of preference and convenience.

There are two common methods for scanning with Nessus Professional, both with several variations according to capabilities and preference.

Local onsite scanning consists of Nessus running on a system that is local, on the network being scanned (or on a subnet that is physically connected).

These scans can be done in several ways, including from a Nessus installation running on a consultant’s laptop connected to a customer’s network, or from a Nessus installation on a customer system (physical or virtual) connected to the network. In the latter instance, it’s not uncommon for the customer to provide remote access into the customer system, allowing the consultant to scan the network locally while being at a remote location.

For larger networks, it may be more advantageous to use multiple Nessus scanning clients. When using multiple Nessus clients, it might make the most sense to break the network into smaller segments, feeding separate segments into separate Nessus scanners. A large network can be time consuming to scan with Nessus, so using multiple scanners will significantly improve time performance.

Nessus can be used to scan remotely over a VPN, meaning the Nessus installation is on a computer in a remote location, there’s a VPN between locations, and the vulnerability scan is run from this remote location.

Vulnerability scanning over a VPN or from a remote location is a low performance method of scanning and should only be used with small networks/scans (Class C, 254 hosts or less).

First, determine how you will perform your vulnerability scan, whether on premise or remotely.

After logging into Nessus, the first thing to check is the status of the scanner. Do this by logging in and navigating to Settings.

There are (at least) two things to note in Settings > About > Overview. Check to make sure the version of Nessus is current (Version 8.13.1 as of the time of this writing), and that the Plugins are up to date. The date the Nessus Plugins were last updated is noted on this page:

Other items of note might include License Expiration, Policy Template Version, and Activation Code. These are important settings, but not necessarily specific or relevant for performing a correct and true vulnerability scan.

Plugins must be no older than 14 days (from the date of the vulnerability scan) for a validated S2Score, meaning the Last Updated status must reflect a date more recent than 14 days from the time a scan is run.

Other Nessus settings can be updated according to preference, but the only setting required for a validated S2Score is a current Nessus version and current Plugins. If there’s interest in tweaking Nessus’ other settings, mostly for performance gains, please review Tenable’s documentation and/or support information available online.

Once the status of Nessus has been validated, navigate to Policies then scan templates.

There are more than 20 scan policy templates provided with the default installation of Nessus. For information about each of the scan policies, please visit Tenable’s website (https://tenable.com).

A Nessus Policy controls how the Nessus scanner will operate and what it will scan for on systems. There are three scan policy options for conducting a vulnerability scan that will produce a validated S2Score, the Basic Network Scan, the S2_Default_Phase3Internal Scan, and a custom scan configured by you from the built-in Nessus Advanced Scan policy. The custom-built policy option, if chosen, must be configured according to SecurityStudio’s requirements (see Minimum Scan Policy Requirements).

The preferred scan policy for a validated S2Score is the S2_Default_Phase3Internal Scan policy provided by SecurityStudio.

The Basic Network Scan policy is sufficient to meet the requirements for a validated S2Score. To use the Basic Network Scan policy:

That’s it. You are ready to begin your vulnerability scan. Please proceed to the Start Scan section of this document.

The S2_Default_Phase3Internal scan policy is a Nessus scan policy that has been customized by SecurityStudio for use by customers and consultants to produce optimal S2Scores. Using this scan policy is the safest way to ensure that you’re using the correct scan settings for the most accurate and validatable S2Score.

The scan policy can be downloaded here:

Internal - Phase 3

External - Phase 4

To use the S2_Default_Phase3Internal scan policy:

That’s it. You are ready to begin your vulnerability scan. Please proceed to the Start Scan section of this document.

If you wish to configure your scan policy from scratch using the Advanced Scan template, these requirements must be met for the resulting scan to qualify for an official and/or validated S2Score:

Scans are configured and managed in the My Scans window.

Scans can be scheduled by using the Schedule option. Clicking “Save” after using the schedule function will schedule the scan to start when you configured it to.

Click the Save button at the bottom of the screen.
​

CAUTION: Use care in scheduling a scan when you’re not present.

Once you are ready to begin your scan, click the play button (unless scheduled).

The scan will begin. To check the status of the scan, click the scan. If things are working correctly, you should see the green circular icon next to the word Running. If the scan is not running correctly, please refer to Tenable’s support documentation online.

If you chose to view Live Results, you will see the vulnerability scanning results as they are collected. Continue to let the vulnerability scan run until it is complete or stopped.

There are times when a vulnerability scan will need to be stopped. The most common reasons for stopping a scan are because it was configured incorrectly or because the scan is causing issues with the network (or systems on the network).

To stop a running vulnerability scan:

This will force the vulnerability scan to stop.

PLEASE NOTE: A stopped vulnerability scan is complete, meaning it cannot be restarted from where it ended. A stopped vulnerability scan must be restarted from the beginning.

Occasionally, it becomes necessary to pause vulnerability scan. Pausing a scan forces Nessus to checkmark the status of the scan and stop it. When the scan is started again, it starts from where it left off instead of starting from scratch (as in “stopping” a scan).

To pause a scan:

The scan can easily be restarted by clicking the Play button associated with the scan (just as it was when starting the scan manually).

Once a scan is complete, it will display as “Completed” within Nessus.

After the scan is completed, it can be checked for completeness before exporting for SecurityStudio processing/scoring.

Once a vulnerability scan has been completed, it may be exported out of Nessus for further processing. Before exporting the results, it’s a good idea to check two things:

Exporting results out of Nessus that don’t adequately meet these criteria will result in incomplete vulnerability scanning and an inaccurate S2Score.

Scans can be checked for completeness manually by clicking the scan itself from the My Scans window. The number of hosts displayed should correspond with the number of hosts that were expected.

If there are discrepancies, work with knowledgeable personnel and Tenable support to troubleshoot the issue. Troubleshoot and reconcile this issue before exporting for use in SecurityStudio. Failure to do so will reflect poor quality results.

Click the Vulnerabilities tab. Check to see how successful authentication was performed during the vulnerability scan by looking for the number of failed authentication plugins. The two most important plugins to look for are:

To search for these plugin messages:

Start with opening the scan you want to export.

Sometimes, it makes sense to scan large networks with thousands of systems in chunks. This is a good idea for many reasons, one of which is scan failure. If your vulnerability scan fails in the middle of a 5,000-system scan, you may need to start over from scratch. If you break the 5,000-system scan into 10-500 system scans, if a scan fails, you only need to restart the one scan affecting 500 (or fewer) system versus the one scan of 5,000 that may have been hours in.

In cases where a large scan has been broken into multiple smaller scans, export each of the scans the same way. SecurityStudio has the capability of ingesting multiple scans and combining them back into one. Save upload time by creating a ZIP file.

Uploading vulnerability scans is simple with SecurityStudio. First, login to SecurityStudio and find the organization’s assessment corresponding to your vulnerability scan.

PLEASE NOTE: If you need to edit the scan file processing, you can do so by clicking the Edit button. This will enable you to add more scan files, download the existing scan file, or delete the scan file altogether (if the wrong scan file was used or the scan needs to be replaced for some reason.

In general, changes to scan files are strongly discouraged and may result in the invalidation of an S2Score; however, there are times when a change is warranted (before processing). The most common reason is to remove a vulnerability that isn’t entirely applicable to the organization. One such example is the removal of vulnerabilities associated with self-signed certificates:

These three plugins are often found associated with each other in scan results. Although these vulnerabilities are relatively easy to fix, if you’ve determined that the hosts associated with these vulnerabilities are 1) internal use only and 2) adequately segregated/isolated from public networks, you may choose to remove these from the scan results.

If you are unsure whether to remove certain vulnerabilities, please contact SecurityStudio. If vulnerabilities are removed without justification, it may invalidate an organization’s S2Score.

To remove a vulnerability from a scan, you must do so within Nessus before export.

Again, please make sure you use the vulnerability modification ability sparingly.