Scribd
Upload
48 views7 pages

Cybersecurity

Cybersecurity

Uploaded by

Bennet Ordonez
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
48 views7 pages

Cybersecurity

Cybersecurity

Uploaded by

Bennet Ordonez
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 7

1.

Install Tenable Nessus


a) Download and install Nessus-8.13.1-x64.msi. (or the latest version)
b) Select Next to start the Install Shield Wizard.
c) Accept the license agreement and select Next.
d) Accept the default Destination Folder and select Next.
e) Select Install.
f) For WinPcap 4.1.3 Setup, click Next.
g) Accept the license agreement and select Install.
h) When the installation completes, select Finish.

2. Create an admin login and password for your Nessus session.


a) On the Nessus screen, select the link to Connect via SSL.

b) You are prompted that your connection is not private. Click Advanced and Proceed to localhost.

PUBLIC
For Public Use
c) At the Welcome to Nessus screen, select Continue.

PUBLIC
For Public Use
d) To get an activation code, supply your First name, Last name & Email. Click Email.
e) Enter the activation code received from your email, click Continue.
f) Create a user account, supply a password then click Submit.
g) Nessus will automatically download plugins. The process will take a few minutes.
h) On the Welcome to Nessus Essentials window, click Close.

3. Run the Nessus vulnerability scan and examine the results.


a) Click Create a new scan
b) Select Basic Network Scan

c) Name the scan General Scan


d) In the Targets text box, enter your machine’s IP address.
e) Click Save.
f) To run the scan, click the Launch button.
g) When the scan is finished, click the scan you created.
h) Observe the scanner results. The line graph shows the number of vulnerabilities detected,
categorized by color. The graph to the right of the window has the key for each color vulnerability.

i) Select anywhere on the line graph to see the details about each vulnerability. Note that each
vulnerability includes references and suggested remedies.

PUBLIC
For Public Use
4. Take a screenshot of your scan result – Host tab.

PUBLIC
For Public Use
5. Take a screenshot of your scan result – Vulnerabilities tab.

6. When you fix the major vulnerabilities in a system, how can you ensure that
they are repaired?

After addressing a system's primary vulnerabilities, it's critical to put in place a


thorough plan to guarantee that the vulnerabilities are successfully fixed. The
system should be updated and patched on a regular basis to address any
known vulnerabilities. To find and fix any possible flaws, do extensive testing,
including penetration testing. Install a reliable monitoring system to quickly
identify any anomalous activity or security breaches. To avoid human error,
security best practices must be consistently taught to employees. Using
encryption and strict access rules provides an additional degree of security.
Review and update your security procedures on a regular basis to keep up with
changing threats. Creating a cybersecurity-aware culture inside the company
improves resilience all around. Proactive steps, attentive observation, and
continuous training are what guarantee a system stays safe even after
significant vulnerabilities have been fixed.

PUBLIC
For Public Use
7. Why would you not always be able to fix a vulnerability that Nessus marks as
critical?
Fixing a vulnerability marked as critical by Nessus might face challenges due to
various reasons. Some vulnerabilities might be deeply embedded in the system
architecture, making it difficult to patch without causing disruptions or
compatibility issues with existing software. Resource constraints, such as time,
budget, or technical expertise, could hinder a swift resolution. Certain
vulnerabilities might be linked to third-party applications or dependencies
beyond immediate control, requiring coordination with external entities for a
comprehensive fix. In some cases, applying patches might not be feasible if the
system is outdated or unsupported. There's the risk of false positives, where
Nessus identifies a vulnerability that doesn't actually pose a significant threat.
Balancing the urgency of fixing critical vulnerabilities with these practical
considerations is key to navigating the complexities of system security
effectively.

8. What kind of vulnerability is Nessus unable to find?

Although Nessus is an effective tool for detecting a variety of vulnerabilities,


certain security issues may still go unnoticed. The inability to identify logical
vulnerabilities, or defects in the logic of the program, that might not show up as
traditional security concerns but might be exploited by attackers, is one prevalent
constraint. Nessus may miss newly developing threats or undocumented zero-day
vulnerabilities since it mostly concentrates on existing vulnerabilities.
Furthermore, Nessus may occasionally miss configuration errors particular to a
company's particular arrangement. For this reason, even if Nessus is a useful tool,
a complete approach to cybersecurity must be ensured by combining it with
additional security measures and recurring human evaluations.

PUBLIC
For Public Use
9. How can a vulnerability scan like this be useful to a penetration tester?

A vulnerability scan, like the one done by Nessus, is highly beneficial to a


penetration tester for various reasons. It offers a thorough summary of all
potential flaws in a system and serves as a guide for the tester on where to
concentrate and set priorities. Nessus assists penetration testers in more
accurately simulating real-world attack situations by locating vulnerabilities.
Nessus can find technical flaws, but a penetration tester's knowledge of the
situation is essential for deciphering context, connecting flaws, and seeing
more complex security problems that automated tools might overlook. Nessus
is essentially a potent instrument in the penetration tester's toolbox that
directs their work and strengthens a system's overall security posture.

PUBLIC
For Public Use

You might also like