Tenable and CyberCX

The tenable Cyber Exposure Management suite of products provide visibility, management, reporting and alerting across multiple environments including IT, OT, Cloud and IoT. At a high level these include:

• andgt;tenable.sc – on premise vulnerability management
• tenable.io – cloud based vulnerability management
• andgt;tenable.ot – vulnerability management for operational technology
• tenable.ad – continuous, agentless scanning of Active Directory
• Nessus – stand-alone vulnerability assessment

Nessus Professional is a vulnerability scanner made by tenable. It is aimed at security professionals wanting to scan assets and report on vulnerabilities.

Tenable.sc and the cloud based Tenable.io are more comprehensive vulnerability management solutions, powered by the Nessus vulnerability scanning technology. These more comprehensive suites introduce advanced management, monitoring and workflow features such as:

• Continuous scanning for vulnerabilities
• Ongoing vulnerability management
• Automated asset discovery
• Patching prioritization based on risk
• Improved reporting
• Near real-time alerting
• Attack surface monitoring and management

A Security Information and Event Management (SIEM) solution is a collection of services designed to collect an organization’s security related events to find anomalies that could constitute a cyber attack. It does this by correlating and analysing logs and data from multiple systems to find anomalies. While Tenable in itself is not a SIEM, it is often used as an additional source of information, to provide additional context and to enrich the data in a SIEM. The ability to add tenable data to a SIEM enables more advanced correlations to be created while at the same time enabling analysts to obtain critical context during incident investigations.

Application Containers help reduce deployment time, improve efficiency, consistency, and availability of applications. The container is an all-in-one package for software applications. They include the application binaries, software components they depend on, as well as the requirements needed to run the application container. Containerization enables greater portability, scalability, higher productivity, easier management and faster deployment cycles. However, security needs to be carefully considered.

Tenable.io Container Security is integrated into the tenable vulnerability management platform. It continuously monitors container images for security vulnerabilities, potential malware as well as enterprise policy compliance.

Tenable.io Container Security integrates with a variety of continuous integration and continuous deployment (CI/CD) pipelines and solutions to store the container images and scan these as they are built. Tenable.io provides vulnerability and malware detection and continuous monitoring of container images as well as policy compliance enforcement.

Web application vulnerability scanning is a form of external scanning that targets specific vulnerabilities like SQL injection, cross-site scripting, path traversal, command injection and other security related server configuration issues.

Tenable offers this functionality as tenable.io web app scanning or part of their tenable.ep solution suite. It has been designed to minimize false positives and negatives and accurately report vulnerability coverage allowing security teams to understand the actual security risks around an organization’s web applications.

Any discovered issues and related information are presented on an intuitive dashboard so these can be managed by the security teams.

A Network Vulnerability Scanner utilizes multiple components to scan assets and produce a list of vulnerabilities found on these. The scanner works off a constantly updated database of known vulnerabilities. It scans the target systems and tests for the presence of these vulnerabilities. Network vulnerability scans can be run in a number of different ways:

• External – scan of publicly accessible assets over the Internet
• Internal – scan of internal assets by an internal scanner
• Local – scan of local device via locally installed agent software

Internal scans may be either authenticated, assuming credentials to the scan target have been provided, or unauthenticated scans, where only basic fingerprinting can be used to determine the patching state of the target system. Authenticated, internal scans and agent based scans provide maximum visibility into existing, unpatched vulnerabilities on the target assets.

Vulnerability assessments are critical for any organization that wants to prevent unauthorized access to its systems and to reduce their attack surface. Unlike a basic vulnerability scan, a vulnerability assessment provides additional context around the discovered vulnerabilities and comprises of a range of tasks including:

• Cataloguing the different assets, their criticality and the capabilities of each system
• Inventory gap analysis to ensure a vulnerability scan covers all critical assets
• Running a vulnerability scan to discover unpatched vulnerabilities on these systems
• Ranking and classification of discovered vulnerabilities to estimate the relative importance of patching and existing risk exposure

Following this process allows organizations to clearly understand their security posture in relation to vulnerability patching and to then prioritize their patching efforts to minimise exposure as quickly as possible.

The attack surface of any environment, also referred to as the digital footprint, is the total sum of different attack points, including internal and external systems, cloud services, mobile and laptop devices and other endpoints, where an attacker can attempt to bypass security and gain unauthorized access to an organization’s systems.

The tenable suite of products enables organizations to eliminate network blind spots and fully understand and manage an organization’s entire attack surface. Tenable solutions continuously monitor and assess the attack surface to enable the security teams to manage and reduce exposure and in turn reduce the risk of compromise.