Tag Archives: security

Nessus Essentials

Nessus is a security product provided by Tenable, that will scan networks in order to find vulnerabilities among hardware, servers, and more. Tenable provides a free version of this product, called Nessus-Essentials, which allow you the following for free:

  • Asset discovery scanning limited to 16 IPs for vulnerability assessment.
  • The power of Tenable Research. Our research team works closely with the security community to discover new vulnerabilities and provide insights into published vulnerabilities to help organizations quickly detect them in their environment. These insights are built into Nessus Essentials to keep you up to date on the latest vulnerabilities. 
  • No time limit for usage. Use Nessus Essentials for as long as it meets your needs. Should you require advanced features and the ability to scan more than 16 IPs, you can seamlessly upgrade to Nessus Professional.
  • Access to the Nessus training curriculum. Enjoy access to Tenable University training classes to help you understand and take full advantage of Nessus Essentials.  
  • Community Engagement. Engage with your peers and the Tenable team in the Tenable Community to get your questions answered quickly and get tips and tricks for optimizing your product. 

Prerequisites

In order to scan up to 50,000 hosts per scan (Huge for a home lab or small office), the prerequisites provided by Tenable are the following (Nessus 8.11.0):

CPU: 4 2GHz cores

Memory: 4 GB RAM (8 GB RAM recommended)

Disk space: 30 GB, not including space used by the host operating system

A Windows or Linux server (I have chosen to run it on the latest Ubuntu 20.04 LTS)

After having installed the .deb on your Linux server

In order to start Nessus, run the following command: 

/etc/init.d/nessusd start

Then go to https://nessusIPaddress:8834/ to configure your scanner

After Nessus has been initialized, select Essentials:

Skip the next step if you have already an activation code, then provide it:

Create a new account for the first scanner administrator

Then wait until the installation is finished:

Plugins will be compiled and that can take a while depending on your server

After you logged in, you will have to decide which IPs to scan:

Then, Nessus will scan the networks you gave it, find devices and computers, and you will be ask to choose the 16 IPs you want to scan. The scan will then starts and the result will be shown like this:

Dealing with cipher suites

A part of my daily job is to improve application security, at large. Doing so, I often have to deal with cipher suites hardening.

This task is not complex at all, yet you have to manage different libraries that are using different naming conventions (RFC, GnuTLS, OpenSSL, etc.). You can always count on the documentation or your favorite search engine, nonetheless, depending on their quality, that will make you waste a lot of time.

Fortunately, I found a very handy website, created by Hans Christian Rudolph and Nils Grundmann, which gives you much information about those libraries, cipher suites, protocols, etc. It also offers an API, yet that still a work in progress. Long story short, anytime you need to deal with cipher suite, you should take a look at it:

https://ciphersuite.info/

Analyzing your website encryption strength

During a recent audit, I had to harden the cipher suites used to secure a worldwide insurance application. The most important part of this task was to help adjust our customers, ensuring their infrastructure to be compatible with our future settings. During the whole project, I used different methods to double-check the settings applied to our differents tests and staging environments (packet analyzes, vulnerability scanner, etc.). I found out that Qualys, one of our security providers, has a free website that can scan a website and provide an interesting report:

https://www.ssllabs.com/ssltest/

There are a lot of similar services ( https://www.immuniweb.com/ssl/ for instance), with more or less the same functionality, but that one was particularly convenient to use.

Manage your passwords in a fancy manner with Bitwarden

Obviously, we all deal with more and more services every day, while some of them are confidential (Bank accounts, social numbers, etc.), others could be shared with your friends, colleagues or family (Netflix for instance, is a perfect example).

Here come software called passwords manager, with them you will be able to:

  • Store all your credentials under a single account, which will be protected by a 2FA. That way, you only have to remember one strong passphrase, changing it from time to time though
  • Generate extremely strong passwords, compared to your puppy name for instance, with special chars, numbers, lower and upper case characters
  • Organize your accounts in different folders
  • Share some of them with your family and friends (depending on your subscription level)
  • Use the browser extension or the Android application to auto-fill application or web login prompts (Supports fingerprint authentication on compatible devices)

If you choose to go with the Cloud version, for a ridiculous fee of $1 a month, you will be able to access your credentials everywhere with your phone or any browser you trust.

For a small price, I’m not able to have pretty much the same features as the business-grade one we are using at my office. You will have to adjust to a new behavior: each time you have to create an account, use the random strong password generator then store it in your Bitwarden vault, that’s it!

https://bitwarden.com/