Re: Local Software Scanner for vulnerabilities

[Todd Haverkos <infosec () haverkos com>]

Pascal Heraud <pascal.heraud () laroueverte com> writes:

> Hello,
>
> I'm looking for a simple tool capable of :
> - Listing local installed software (standard packages) for all linux
> and windows systems.
> - Downloading CVEs database that is free of charge
> - Comparing local software and CVEs to issue security alerts.
> - Simple to install, cross platforms

Tenable Nessus is just $1200 a year and hits all your points except
that wish for something free.  It's agentless so you wouldn't have to
install something on every machine--one scanner can be configured to
login with credentials to do full scanning of the entire environment,
and enumerate installed software on those boxes.  Their plugin
writeups all reference the relevant CVE's. 

If free is important and it's a home network you're interested in
defending, they do offer a home feed for non-commercial use.  If
you're using it in a business of any sort, $1200 is not much to pay a
year.  If you're dealing with a non-profit, it's possible to get pro
feed at no cost
http://www.nessus.org/about-tenable/tenable-in-the-community

If you have more enterprise needs and a desire to see trending,
metrics, and remediation trends for vulnerabilities, reporting, and
control of several scanners in a segmented environment, and having
several users of the vulnerability tools with various privilege
levels, Tenable Security Center is the next step up.  It's licensed by
IP count.

BigFix as suggested by another poster has a rather different model --
that's an agent based solution that'll have pieces installed on every
machine.  You'll find that it's exceedingly non-free, and in fact will
probably cost at least double Security Center for a similar IP count,
and probably 100x a Nessus license depending on your IP count.  :-)
LanDesk and Shavlik are other competitors in that systems management
space.  BigFix can do a lot more than just find vulnerabilities--power
management, patch management (i.e. actually fixing the issues found),
and inventory management are among the itches these things scratch.  

If your task is focused on finding vulenrabilities then tossing the
info over the wall to another group to address them, a vulnerability
scanning solution like Nessus or equivalent is likely what you want. 

Best Regards, 
--
Todd Haverkos, LPT MsCompE
http://haverkos.com/

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------