Nessus is a widely recognized vulnerability scanner used by IT professionals and cybersecurity experts to identify vulnerabilities, misconfigurations, and compliance issues in systems and applications. Developed by Tenable, Nessus is known for its robustness, ease of use, and extensive plugin library, which allows it to scan for a broad range of vulnerabilities.

In this tutorial, we’ll explore how to install, configure, and use Nessus to conduct thorough vulnerability assessments. By the end, you’ll have an understanding of using Nessus to identify and mitigate security risks in your environment.

1. Installing Nessus

1.1. System Requirements

Before installing Nessus, ensure that your system meets the following requirements:

  • Operating System: Windows, macOS, Linux (Ubuntu, CentOS, etc.)
  • RAM: Minimum 4 GB (8 GB recommended)
  • CPU: 2 GHz or faster processor
  • Disk Space: At least 10 GB of free disk space
  • Network: Internet connection for updates

1.2. Downloading Nessus

  1. Visit the Tenable Nessus download page.
  2. Select the appropriate installer for your operating system.
  3. Download the installer.

1.3. Installing Nessus

  1. For Windows:
  • Run the .exe installer file.
  • Follow the installation wizard’s prompts.
  • After installation, Nessus will start as a service.
  1. For macOS:
  • Open the .dmg file and drag the Nessus app to your Applications folder.
  • Launch Nessus from Applications.
  1. For Linux:
  • Use the following command to install Nessus (replace Nessus-<version>.deb with the actual file name): sudo dpkg -i Nessus-<version>.deb
  • Start the Nessus service: sudo systemctl start nessusd
  • Enable the Nessus service to start on boot: sudo systemctl enable nessusd

1.4. Accessing the Nessus Web Interface

  1. Open your web browser and navigate to https://localhost:8834 (replace localhost with your IP address if accessing remotely).
  2. You’ll be prompted to create an account. This will be your Nessus administrative account.
  3. After creating your account, you may need to wait a few minutes for Nessus to initialize.

2. Configuring Nessus

2.1. Licensing Nessus

Nessus requires a license to operate. You can choose from different license types:

  • Nessus Essentials: Free, limited to 16 IPs.
  • Nessus Professional: Paid, designed for security professionals.
  • Nessus Expert: Paid, with additional features like cloud and container scanning.

To activate your license:

  1. Enter the activation code provided by Tenable.
  2. Follow the on-screen instructions to complete the activation.

2.2. Updating Plugins

Nessus relies on plugins to detect vulnerabilities. These plugins are updated regularly.

  1. Navigate to the Settings tab.
  2. Click on Software Update.
  3. Ensure that plugin updates are enabled.
  4. Click Update Now to manually update plugins.

3. Setting Up Your First Scan

3.1. Understanding Scan Types

Nessus offers several types of scans:

  • Basic Network Scan: Scans for common vulnerabilities across an entire network.
  • Advanced Scan: Provides more granular control over scan settings.
  • Web Application Tests: Specifically for web application vulnerabilities.
  • Compliance Audits: Checks for compliance with standards like PCI-DSS, HIPAA, etc.

3.2. Creating a New Scan

  1. Go to the Scans tab.
  2. Click New Scan.
  3. Choose the appropriate scan template (e.g., Basic Network Scan).
  4. Configure the scan:
  • Name: Give your scan a meaningful name.
  • Targets: Enter the IP addresses or ranges you want to scan.
  • Schedule: Set a schedule if you want the scan to run automatically at specific times.
  1. Click Save.

3.3. Running the Scan

  1. After saving the scan, you’ll be redirected to the scan list.
  2. Click the play button next to your scan to start it.
  3. Monitor the progress in real-time.

4. Analyzing Scan Results

4.1. Understanding the Results Dashboard

Once a scan is complete, you’ll be presented with a results dashboard that categorizes vulnerabilities by severity:

  • Critical: Red (High risk)
  • High: Orange (Serious risk)
  • Medium: Yellow (Moderate risk)
  • Low: Blue (Low risk)
  • Informational: Green (No immediate risk)

4.2. Detailed Vulnerability Information

  1. Click on a specific vulnerability to view details.
  2. Information provided includes:
  • Description: What the vulnerability is and its impact.
  • Solution: Recommended steps to remediate the vulnerability.
  • References: Links to more detailed information.
  • Evidence: Logs or data showing the vulnerability’s existence.

4.3. Exporting Results

You can export scan results for reporting or further analysis:

  1. Click on Export.
  2. Choose the format (PDF, CSV, HTML, etc.).
  3. Customize the report (optional).
  4. Download the report.

A Nessus scan report typically includes a summary of the findings, categorized by severity, and detailed information about each vulnerability discovered. Here’s a description of what you might expect in a Nessus scan report, along with a sample format.

4.4. Components of a Nessus Scan Report

  1. Summary:
  • Total Number of Vulnerabilities: Displays the overall count of vulnerabilities found.
  • Vulnerabilities by Severity: A breakdown of vulnerabilities into categories (Critical, High, Medium, Low, and Informational).
  • Top Vulnerable Hosts: List of hosts with the highest number of vulnerabilities.
  1. Vulnerabilities by Host:
  • Host IP/Hostname: Each host scanned.
  • Vulnerabilities Identified: List of vulnerabilities associated with that host.
  • Severity Levels: The severity of each vulnerability (Critical, High, etc.).
  • Exploitability: Whether the vulnerability can be exploited.
  1. Detailed Vulnerability Information:
  • Vulnerability Name: The name or identifier of the vulnerability.
  • Description: A detailed explanation of the vulnerability.
  • Solution: Recommended actions to remediate the vulnerability.
  • References: Links to additional resources or CVE identifiers.
  • Evidence: Logs or specific data showing the presence of the vulnerability.
  1. Compliance Check (if applicable):
  • Compliance Results: Pass/Fail status for each compliance check.
  • Details: Specifics on why a check failed and how to remediate it.

4.5. Sample Nessus Scan Report

Here’s a fictional sample to illustrate what a Nessus scan report might look like:

Nessus Vulnerability Scan Report

Scan Name: Monthly Network Scan
Scan Date: 2024-08-15
Scanned Hosts: 10
Total Vulnerabilities: 125

Vulnerabilities by Severity:

  • Critical: 5
  • High: 30
  • Medium: 50
  • Low: 35
  • Informational: 5

Top Vulnerable Hosts:

  1. 192.168.1.10 – 25 Vulnerabilities (2 Critical, 8 High)
  2. 192.168.1.15 – 20 Vulnerabilities (1 Critical, 10 High)
  3. 192.168.1.20 – 18 Vulnerabilities (2 Critical, 6 High)

Vulnerabilities by Host

  • Host: 192.168.1.10
  • Critical:
    • Vulnerability: MS17-010 (EternalBlue)
    • Description: A remote code execution vulnerability in SMBv1.
    • Solution: Apply the Microsoft patch MS17-010.
    • References: CVE-2017-0144
    • Vulnerability: Apache Struts CVE-2017-5638
    • Description: A remote code execution vulnerability in Apache Struts.
    • Solution: Update to the latest version of Apache Struts.
    • References: CVE-2017-5638
  • High:
    • Vulnerability: OpenSSL Heartbleed
    • Description: Allows attackers to read sensitive memory contents.
    • Solution: Update OpenSSL to version 1.0.1g or later.
    • References: CVE-2014-0160
  • Medium:
    • Vulnerability: SMB Signing Not Required
    • Description: The SMB service does not require signing.
    • Solution: Enable SMB signing.
    • References: Microsoft Documentation
  • Low:
    • Vulnerability: SSL Certificate Expiry
    • Description: The SSL certificate will expire soon.
    • Solution: Renew the SSL certificate.

Compliance Check Results (PCI-DSS):

  • Requirement 2.1: Fail
  • Details: Default passwords not changed on 2 devices.
  • Solution: Change default passwords immediately.
  • Requirement 11.2: Pass

This sample demonstrates the typical structure of a Nessus report. In a real report, each section would include more specific details relevant to the vulnerabilities found in your environment.

5. Advanced Nessus Features

5.1. Custom Scan Policies

For more control over your scans, you can create custom scan policies:

  1. Go to the Policies tab.
  2. Click New Policy.
  3. Choose a template (e.g., Advanced Scan).
  4. Customize the settings:
  • Port Scanning: Define which ports to scan.
  • Plugins: Select or deselect specific plugins.
  • Credentials: Provide SSH or Windows credentials for deeper scanning.
  1. Save your policy and use it in new scans.

5.2. Using Scan Credentials

Nessus can perform credentialed scans, which allow it to log into systems and perform more thorough checks:

  1. During scan setup, go to the Credentials section.
  2. Add credentials:
  • Windows: Username, password, and domain.
  • SSH: Username and private key or password.
  1. This allows Nessus to check for internal vulnerabilities, missing patches, and more.

5.3. Scanning Web Applications

Nessus can also scan web applications for vulnerabilities like SQL injection, cross-site scripting (XSS), and more:

  1. Choose the Web Application Tests scan template.
  2. Enter the target URLs.
  3. Customize settings like authentication if needed.
  4. Run the scan and review vulnerabilities specific to web apps.

6. Best Practices for Using Nessus

6.1. Regular Scanning

Regularly scan your environment to catch new vulnerabilities as they emerge. Consider scheduling scans weekly or monthly, depending on the size and nature of your network.

6.2. Patch Management

Use Nessus scan results to inform your patch management process. Prioritize critical and high-severity vulnerabilities for immediate remediation.

6.3. Compliance Monitoring

If your organization needs to comply with specific standards (e.g., PCI-DSS, HIPAA), use Nessus’s compliance auditing features to ensure continuous compliance.

6.4. Network Segmentation

Use Nessus to assess the security of different network segments. This is especially important in environments with sensitive or critical systems.

7. Troubleshooting and Common Issues

7.1. Scan Failures

  • Network Issues: Ensure that Nessus has network access to the target systems.
  • Authentication Failures: Double-check credentials used for credentialed scans.
  • Resource Constraints: Ensure the Nessus server has enough resources (CPU, RAM).

7.2. False Positives

Nessus may occasionally report false positives. Validate vulnerabilities manually if needed, or use additional tools to confirm them.

7.3. Slow Scans

  • Large Networks: Break down large scans into smaller segments.
  • High-Resource Plugins: Disable high-resource plugins if not needed.
  • Network Latency: Ensure that Nessus and target systems are on a fast and stable network.

Conclusion

Nessus is a powerful tool for vulnerability assessment, offering comprehensive features that make it suitable for both small and large environments. By following this guide, you should be able to install, configure, and effectively use Nessus to enhance your organization’s security posture. Regular scanning, careful analysis of results, and prompt remediation are key to maintaining a secure environment.