Re: Recommendation for a Good Vulnerability Scanning Service?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]



On 2/18/2011 3:09 PM, Dr. Ed Morbius wrote:
>
>> I haven't spoken with the hackerguardian people yet but it would be
>> nice if I could just say "I'm using CentOS 5.5" and have them factor
>> that into their report so that I can focus on any real issues. Are
>> there vulnerability scanning services that are more or less
>> sophisticated about this?
> I'd suggest you educate yourself on the PCI compliance issue, and query
> your prospective vendor(s) on what specific scans they run and/or how
> these are tuned to specific operating environments.
>
> I'd tend to suspect that vuln/pen testing is going to be based more on
> known vulnerabilities than your environment.

Very good information, Ed. And yes, you will almost certainly be 
fighting with the compliance company, as I have not yet seen any who 
recognized CentOS. RHEL, yes. CentOS however does not hold the same 
'trusted standard' or clout as the major 'name brand' providers. Yes, 
the trouble is the versioning numbers used by RH. If the system 'is' RH, 
most of the time those 'exceptions' are noted by the scanner but you may 
find yourself trying to 'teach them' a lot. Hopefully they have improved 
on this front.

I really think much of this is no more than smoking mirrors. For 
instance they do not ask about username/password policies and obviously 
do not scan for such. So this scanning leaves a lot to be desired. After 
I met all scan problems, my affected clients discovered they just 
answered a question wrong and found that since CC processing was not 
actually happening on my systems, but instead through other processors, 
this all went away and ended the need to address the same issues 
(backports) for the same applications, sometimes still under the same 
version, just due to a new scan. Basically a huge waste of my time. But 
I must admit, I did learn of just a couple of areas which I did tighten 
up. The rest was just red tape and I started feeling one particular 
compliance company was more into self promotion of their service by 
showing these non-existent flaws. I suppose one could compare it to the 
AV companies that allow broken virus sigs to set off alarms. "We just 
saved your computer <!--from this item that had no potential of harming 
your computer-->."

But, if you must, I did find the Nessus output was fairly close to what 
the compliance companies found and gave me a bit of time to tune systems 
before the real scan. It has been a while, but I think Nessus found some 
things I thought more important, which the commercial scanner did not 
mention.

And hey, if you do breeze through with CentOS being recognized as a RHEL 
clone, I would love to hear about that back to this list.

-- 
John Hinton
877-777-1407 ext 502
http://www.ew3d.com
Comprehensive Online Solutions

_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos


[Index of Archives]     [CentOS]     [CentOS Announce]     [CentOS Development]     [CentOS ARM Devel]     [CentOS Docs]     [CentOS Virtualization]     [Carrier Grade Linux]     [Linux Media]     [Asterisk]     [DCCP]     [Netdev]     [Xorg]     [Linux USB]
  Powered by Linux